Attachment_02_Statement_of_Work.docx

STATEMENT OF WORK

DESCRIPTION/SPEC/WORK STATEMENT

For Blood Gas/Co-Ox analyzer

C.1 The contractor shall furnish the laboratory analyzers, data management systems, all other equipment, reagents, parts, supplies to include syringes/capillary tubes, and consumables necessary to operate the contractor's equipment, training for government personnel and equipment maintenance, emergency repair, parts, and preventive service, necessary to fulfill the testing requirements.

C.2 The contract will be based on a Reagent Rental Program over five years (60 months), two (2) Blood Gas/Co-Oximetry Analyzers with accessories, Operator Training, one-year warranty, and four years of instrument service.

C.2.1 All reagents and consumables necessary to perform testing.

C. 2. 2 The contractor will be responsible for validating the use of the analyzers performing accuracy, precision, comparisons, linearity studies and hemoglobin correlations with Hematology analyzer.

C. 2.3. Additional supplies required for commencing operations and all supplies including reagents, cartridges, paper, quality control, calibrators, and linearity material along with any other supplies not listed that are necessary to perform all required validation studies shall be provided by the contractor at no cost to the government.

C. 2. 4 Training to all equipment operators will be provided on site at no cost to the government prior to day one of GoLive of analyzers.

C. 2. 5 Delivery and installation of equipment.

C. 2. 6 All calibration solutions for automatic and manual calibration if manual calibration required and linearity material necessary to maintain analyzers and perform required parameters.

C.3 Reagents will be provided bearing the same lot number within the designated shipments. These items will be of the highest quality, sensitive, specific and tested to assure precision and accuracy. The contractor must provide stock that meets proficiency testing standards of the College of American Pathologist (CAP), The Joint Commission, the Clinical and Laboratory Standards Institute (CLSI), and be approved by the Food and Drug Administration (FDA).

C.4 Testing System will have the following characteristics:

C.4.1 Disposable multiuse cartridge reagent with contained self-cleaning sample probe to perform ionized calcium, blood gas and co-oximetry, requiring the following parameters: pH, pCO2, pO2, tHb, sO2, O2Hb, COHb, MetHb, Deoxy-Hgb, HCO3, Base excess, TCO2, O2 concentration.

C.4.2 Minimal lot to lot variance.

C.4.3 The system must have a Data management system for storage of patient results, quality control and preventative maintenance data and must meet CLIA 88 requirements. All data/results must have capability to be backed up from analyzers. System shall be interfaced to the analyzer and capable of being interfaced to the hospital information system (MHS Genesis) for rapid test data transfer.

C.4.4 The contractor is required to provide new state of the art equipment. Discontinued models are not acceptable.

C.4.5 The contractor will provide all upgrades to the equipment hardware and operating system software without additional charge to the government. These enhancements to the contractor's equipment shall be delivered to the government site and installed by the contractor within 60 days of their issuance of date of first commercial availability.

C.4.6 All system shall perform satisfactorily at any laboratory temperature between 68 and 80 degrees Fahrenheit and at any laboratory relative humidity between 40 and 80%.

C.4.7 The analyzer(s) shall be fully operational on the first day of this contract's performance period. Validations, accuracy, precision, comparisons, linearity studies, and hemoglobin correlations with Hematology analyzer shall be performed and completed by day one of contract.

C.4.8 Billing by the vendor will be based type and quantity of supplies ordered and submitted through Wide Area Work Flow. The vendor will provide a courtesy copy of each monthly payment invoice to the operating facility’s COR (Contracting Officer Representative).

C.4.9 The contract period will be for 5 year (60 months), which consist of 1 primary year and 4 option years.

C.4.10 The analyzers shall have the capability to be on a benchtop and portable and the dimensions shall not take up more than 24 x 24 x 24 inches when on a benchtop.

C.4. 11 Analyzers shall have the capability to sustain an annual throughput of 2,208 tests. This includes running patient samples, rerunning patient samples due to possible air and/or clots, CAP proficiency testing, 3 levels of quality control ran 3 times a day every 8 hours as well as hemoglobin correlations and linearity studies done twice a year.

C.4.12 Capability to print all hard copy patient results, calibrations, linearity, and quality control. Adequate amount of paper supply to print every result ran on the analyzers. This includes the annual throughput of 2,208--- running patient samples, rerunning patient samples due to possible air and/or clots, CAP proficiency testing, 3 levels of quality control ran 3 times a day every 8 hours as well as hemoglobin correlations and linearity studies done twice a year.

120 samples for hemoglobin correlations/year.

1,205 for quality control runs/year 48 samples for linearity studies/year 35 samples for CAP proficiency testing/year

C.4.14 Minimal to no maintenance required.

C.4.15 Suitable specimen types of venous, arterial, and capillary whole blood with a minimum sample volume of 200 µL.

C.4.16 Barcode scanning available to scan patient ID’s. Scanning of the hospital’s barcoded patient labels shall automatically input patient demographics to include patient first and last name, date of birth, and SSN.

C.4.17 Hard copy of patient result must contain patient demographics to include patient first and last name, date of birth, and SSN as well as results of all required parameters: ionized calcium, pH, pCO2, pO2, tHb, sO2, O2Hb, COHb, MetHb, Deoxy-Hgb, HCO3, Base excess, TCO2, O2 concentration and result flags.

C.4.18 Automatic bubble detection in samples that flag user of air in sample.

C.4.19 Analyzers must have easy clot clearance of samples containing clots and are ready for use within two minutes after flushing of clot.

C.4.20 Analyzers must be ready for use upon changeover to new consumables and/or reagents following quality control run. The wait time for analyzer to come back up and register new consumables and/or reagents loaded shall be no more than 30 minutes.

C.4.21 Closed system. No external gas tanks required.

C.4.22 Turnaround time of no more than 60 seconds from time of sample introduction to result availability.

C.4.23 Internal automated quality control programmed to run every 8 hours. Automatic disabling of parameter when quality control is out. Analyzer performs frequent auto calibrations and quality checks in the preanalytical, analytical, and post analytical phases of testing.

C.4.24 28 day or more shelf life of cartridge when on board analyzer.

EARLY TERMINATION: The government will have the option to terminate this delivery order, without cost to the government, with a 30 day written notice if the analyzer(s) do not perform optimally with minimal operational problems and downtime regardless of guaranteed service, when there is a need to take advantage of improved technology, or if there are changes in mission (operational) requirements to better serve the patient and care providers.

C.4.25 In the event that the contract is terminated for any reason, the contractor must allow the analyzer(s) to remain in place for a period not to exceed 60 days at no cost to the government for the purpose of meeting regulatory requirements of performing correlation/validation studies.

C.4.26 Reagents/Consumables will be ordered and shipped on an as needed basis. If the laboratory needs any supply item: reagent, consumable, calibrator, linearity material, quality control, etc., shipped earlier it will be released from shipment earlier than scheduled by the vendor at no cost to the government.

C.5 Special Handling for Emergency Orders of Supplies. In the event that the consumables are found to be defective and unsuitable for use with the contractor's equipment, or the contractor failed to comply with the requirements for routine supply delivery, the contractor is required to deliver the consumable supplies within 24 hours of receipt of verbal order(s) from the government activity. If either circumstance has occurred, the contractor shall deliver to the government, the necessary consumables in sufficient quantity as required allowing operation of the contractor's equipment for one week (under normal government test load volume).

C. 5. 1 In the event the reagent and/or consumables are defective and quality control will not come in after troubleshooting the contractor shall replace the consumable and/or reagent at no cost to the government.

C.6 Site Preparation:

C.6.1 The contractor as a part of the equipment proposal, for any equipment not already in place, shall furnish site preparation specifications in writing. These specifications shall be in such detail as to ensure that the equipment to be installed shall operate and conform to the manufacturer's specifications.

C.6.2 The government shall prepare the site at its own expense and in accordance with the specification(s) furnished by the contractor.

C.6.3 Any alteration or modifications in site preparation, which are attributable to incomplete or erroneous specifications provided by the contractor, which would involve additional expense to the government, shall be made at the expense of the contractor.

C.7 Ownership of Equipment:

C.7.1 Title to equipment shall remain with the contractor. All accessories furnished by the contractor shall accompany the equipment when returned to the contractor.

C.7.2 The contractor, at termination and/or replacement of equipment, shall remove the equipment. The contractor shall disconnect the equipment and will be responsible for all packing and shipping required to remove the equipment within seven (7) calendar days.

C.8 Preventive Maintenance. The government is responsible for any routine operator maintenance. The contractor shall perform ongoing preventive maintenance necessary to fulfill test requirements at no cost to the government as well as provide preventative maintenance service reports to the government.

C.9 Emergency Repair:

C.9.1 Emergency repairs shall be performed after notification that equipment is inoperative. The contractor shall provide the government with a designated point of contact and shall make arrangements to enable the maintenance representative to receive such notification. Entire agreement to include 24 hours per day, 7 days per week Tech support, and a next day loaner when a hardware failure is identified; covering service parts and labor.

C.9.2 The contractor shall perform emergency repair service within 24 hours of the time of notification of malfunction. In the event both analyzers are down simultaneously the contractor shall be required to perform repair service within 4 hours of notification of malfunction. The contractor shall provide all tools, parts and labor needed to repair the malfunction. All expenses occurred with the repair shall be borne by the contractor.

C.9.3 The contractor shall furnish a malfunction incident report to the Contracting Officer Representative upon completion of any maintenance call. A copy of the maintenance report shall be furnished to the Chemistry Supervisor. The report shall include as a minimum, the following: (1) date and time of notification, (2) data and time of arrival, (3) type and model number(s) of equipment, (4) time spent for repair, (4) description of malfunction and (5) proof of repair.

C. 9.4 Any additional costs associated with equipment or supplies not disclosed in the contract, by the contractor, needed for full operation of this equipment, shall be paid by the manufacturer at no cost to the government.

C.10 Integrating Antiterrorism (AT) and Operations Security (OPSEC) Contract Support:

C.10.1 AT Level I Training. This provision/contract text is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 15 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: https://atlevel1.dtic.mil/at.

C.10.2 Access and General Protection/Security Policy and Procedures. This standard language text is for contractor employees with an area of performance within an Army controlled installation, facility or area. Contractor and all associated sub-contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by the BACH Personnel Security Specialist. Contractor workforce must comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

C.10.3 OPSEC Training. Per AR 530-1, Operations Security, all contract employees must complete Level I OPSEC Training within 30 calendar days of commencing performance and annual OPSEC Awareness training thereafter. Training completion will be reported to the COR within 30 calendar days.

C. 10.4 iWATCH Training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. Thecontractor and all associated sub-contractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This locally developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 05 calendar days of new employees commencing performance with the results reported to the COR NLT 30 calendar days after contract award.

C.10.5 For contracts that require OPSEC Training. Per AR 530-1 Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter. OPSEC Awareness for Military Members, DoD Employees and Contractors is available at the following website: http://cdsetrain.dtic.mil/opsec/index.htm

C.10.6 For Cyber Awareness (Information assurance (IA)/information technology (IT)) training. All contractor employees and associated sub-contractor employees must complete the DoD Cyber awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within six months of appointment to IA/IT functions. DoD Cyber Awareness Challenge Training is available at the following website: https://ia.signal.army.mil/DoDIAA/

C.11 Quality Assurance Surveillance Plan:

The following minimum Quality Assurance Plans applies. The Government may modify inspection methods at its discretion.

Requirement: Provide technical representative IAW paragraphs 1 through 10 for emergency and routine cases.

Performance Standard: Comply at least 95% of the time.

Method of Surveillance: 100% Inspection.

Remedy for non-performance: Notify the contractor and Contracting Officer in writing within (10) ten days.

Standard Measurement Past Performance Assessment:

b. The contractor shall use their own calibration equipment for preventive maintenance or for emergency repair.

c. Outcome: The contractor shall provide blood gas testing at a standard enabling the Medical Treatment Facility (MTF) to provide such services at a high level of quality.

d. Standards: Acceptable measures include: Provide all required reagent and supplies along with rental of two (2) Blood Gas Analyzers with CO-OX.

e. How measured: Department supervisory personnel will monitor analyzer performance through observations of equipment performance, Government information systems, records, patient records, and customer service information.

Appendix 1- Army Cybersecurity/Risk Management Framework (RMF) Requirements, Version 8-21-17

A. GENERAL OVERVIEW OF ARMY CYBERSECURITY REQUIREMENTS

1. New Equipment/Product (systems, equipment and software under RMF): The Vendor shall agree to the Army Cybersecurity/RMF requirements, receive an Authority to Operate (ATO), and maintain the ATO for 6 years or as long as the vendor commercially supports the equipment/product, whichever is longer.

The vendor shall maintain an ATO on all equipment/product versions owned by the Army and originally purchased through the vendors DLA contract. If a vendor cannot support the ATO for all Army owned versions of the equipment/product, the vendor can meet this requirement by offering to provide all upgrades to the equipment/product that are required to maintain the ATO for 6 years from date to ATO, either at no cost to the Government or at a fixed price that is included and evaluated as part of the vendor’s new equipment/product offer. Vendors who cannot support all versions of the equipment/product and cannot offer upgrades required to maintain the ATO for 6 years shall not be considered.

During the period of time the vendor must maintain the ATO; 6 years or as long as the vendor commercially supports the equipment/product, whichever is longer; the vendor shall provide all required cybersecurity patches/updates. If the patches are separate from updates as required by the vendor’s contract, the vendor shall offer the cybersecurity patches under a maintenance offering on their DLA contract that provides for all required cybersecurity patches/updates needed to maintain the ATO. Maintaining the RMF ATO shall be included as part of the vendors warranty period.

2. Maintenance: Vendors must agree to the Army Cybersecurity requirements for all systems purchased after June 6, 2017, systems under a DIACAP ATO or systems in process for RMF ATO approval. Vendors may otherwise request an exception to cybersecurity policy . Exceptions to cybersecurity policy must be requested from the MTF purchasing the maintenance and any exception are contingent on approval by local and MEDCOM CIOand Approving Official (AO).

3. Upgrades: Vendors must agree to the Army Cybersecurity requirements for all upgrades. Although there is an exception to cybersecurity policy process for upgrades similar to maintenance, the Army does not envision granting exceptions to cybersecurity policy and would instead replace the system in lieu of approving upgrades that do not comply with cybersecurity policy.

B. Army Cybersecurity/Risk Management Framework (RMF) Requirements 1 System Security Requirements

1.1 The vendor shall submit to the Government, included in the quote, the blue section of the Medical Device Cybersecurity Assessment (Questionnaire), which is provided by government, as well asNessus Scans. A Nessus scanner must be procured by the vendor, at their own cost, in order to comply with RMF requirements.

1.2 Vendor agrees to comply with security regulations and guidance listed in attached Appendix A and all Risk Management Framework (RMF) requirements.

1.3 Failure to meet the requirements may result in termination of the delivery order for cause, in accordance with FAR 52.212-4(m).

1.4 The vendor device or system shall pass pre-validation screening (Vulnerability scans utilizing Nessus, and SCAP scans), administered within six (6) months of contract award that will be conducted by Government, and must meet criteria listed below:

1.4.1 No unmitigated Very High or High Severity/ Category I (CAT I), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx

1.4.2 No unmitigated Moderate Severity/Category II (CAT II), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx

1.4.3 No unmitigated Very High or High Severity/ Category I (CAT I) vulnerabilities from Nessus vulnerability scans.

1.4.4 No unmitigated Moderate Severity/ Category II (CAT II) vulnerabilities from Nessus vulnerability scans.

1.5 The vendor shall mitigate all Very High, High, and Moderate Severity/CAT I and CAT II vulnerabilities discovered during the Assessment and Authorization (A&A) process according to a schedule published by Government.

1.6 The vendor shall appoint a vendor point of contact responsible for the cybersecurity of the vendor device or system throughout the lifecycle of the system. The vendor shall provide Subject Matter Experts (SMEs) to support all assessments of contracted products and materials, and meet required deliverable timelines.

1.7 The vendor shall obtain a recommendation of Authority to Operate (ATO) as determined by a Government appointed third party validator within twelve (12) months of contract award.

1.8 The vendor shall not make any delivery and shall not receive payment for the system until the ATO is granted. Receiving the ATO document from the U.S. Army shall constitute permission to perform on the order and to proceed with delivery. All delivery dates shall be reset in accordance to contract and in days after the date the ATO is communicated in writing to the vendor. Delivery may take place prior to ATO only if written permission is provided by the DLA Contracting Officer.

1.9 Pursuant to subsequent warranty period and Service Maintenance Agreements (SMA), the vendor shall, after the issuance of an ATO, ensure that the vendor’s device or system maintains its ATO for 6 years or as long as the vendor commercially supports the equipment/product, whichever is longer.

The vendor shall maintain an ATO on all equipment/product versions owned by the Army and originally purchased through the vendors DLA contract. If a vendor cannot support the ATO for all Army owned versions of the equipment/product, the vendor can meet this requirement by offering to provide all upgrades to the equipment/product that are required to maintain the ATO for 6 years from date to ATO, either at no cost to the Government or at a fixed price that is included and evaluated as part of the vendor’s new equipment/product offer. Vendors who cannot support all versions of the equipment/product and cannot offer upgrades required to maintain the ATO for 6 years shall not be considered.

During the period of time the vendor must maintain the ATO; 6 years or as long as the vendor commercially supports the equipment/product, whichever is longer; the vendor shall provide all required cybersecurity patches/updates. If the patches are separate from updates as required by the vendor’s contract, the vendor shall offer the cybersecurity patches under a maintenance offering on their DLA contract that provides for all required cybersecurity patches/updates needed to maintain the ATO. Maintaining the RMF ATO shall be included as part of the vendors warranty period. For updates/patches, executable files should be distributed by the manufacturer accordingly, or implemented by the manufacturer technical staff dependent on Service Agreement processes.

1.10 The vendor shall establish appropriate administrative and technical safeguards to ensure the confidentiality, integrity, and availability of Government data under their control.

1.11 The vendor shall notify the PMO and Contracting Officer POCs in writing with any inabilities to comply with DoD security requirements. Vendor will provide anticipated costs and timelines required to address vulnerabilities in question.

1.12 The vendor shall contact the IA/RMF Office Representative, no later than 5 business days after delivery order issuance or contract award, to start the process. Failure to do so would be considered a vendor caused delay.

2 RMF Timeframes

The following table provides an overview of the entire Process to obtain approval under Army Cybersecurity requirements. Vendor actions must start as cited in the number of days after date of order column noted below and be completed in the number of days listed below in the Duration column.

GOVERNMENT

Note: Not all above actions occur in a sequential manner as some actions may be worked concurrently.

3 Assessment and Authorization (A&A)

3.1 The vendor shall submit all RMF required documentation, as specified by Government Reps for review and approval, no later than four (4) months after request by the Government.

3.2 The vendor shall obtain approval from the Government, any vendor developed RMF policies, plans, and procedures prior to implementation.

3.3 The vendor shall provide any additional documentation required by the Government for completion of the A&A process within thirty (30) business days of request by the Government.

3.4 The vendor shall provide technical scans within one (1) month of the A&A kickoff meeting.

3.5 The vendor shall provide updated technical scans on a monthly basis, on the 10th day of each month until an ATO is granted.

3.6 The vendor shall ensure that the vendor device or system is capable of supporting the use of DISA approved intrusion detection and prevention, antivirus, and antimalware applications that are approved at the time of ATO issuance. The vendor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support either the full security suite or the individual components (e.g. DLP, IPS, Antivirus, etc.) without performance degradation of the medical system/device. In cases where the operation of security applications are not technically achievable, the vendor shall provide detailed justification and a Plan of Actions and Milestones (POA&M) describing steps towards compliance with this requirement.

3.7 The vendor shall ensure that the vendor device or system is configured in such a way that allows the system (file system, operating system, real-time processes) by default. In cases where scanning of the entire system may negatively affect its operation, the vendor shall provide a detailed list of exclusions with justifications.

4 Privileged User Training and Certification Requirements

If a vendor requires a B2B, access, etc to government networks to maintain, analyze, etc, their equipement/product, they must adhere to the following requirements:

Information Assurance Contractor Training and Certification. Contractors requiring a privileged-level account for administrative/maintenance support of systems/applications on the Army network will meet Army requirements for a privileged-level account before being granted a network account. Requirements include:

•Cyber (Information assurance (IA)/information technology (IT)) certification. Per DoD 8570.01-M , DFARS 252.239.7001 and AR 25-2, the contractor employees supporting Cyber (IA/IT) functions shall be appropriately certified upon contract award. Contractors will be defined at Information Assurance Technical level I (IAT – II) and be required to meet minimum Professional Baseline certifications at the time of contract award. Contractors will be given six (6) months to meet Computer Environment (CE) and Cyber Security Fundamental training requirements. Not meeting the requirements in accordance with DoD 8570.01-M will result in the contractor account and access being ‘Disabled’ or ‘Deleted’ until such time as the conditions of this contract are met.

•Background Investigation. NACI or above is required. Vendors should email: usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain guidance on the process

•Professional Baseline Certification. The minimum Professional Baseline certification for IAT-II is CompTIA Security+. Higher certifications (GSCL, CISM, CISSP, etc.) will satisfy this requirement.

•Computer Environment (CE) Certification. Computer Environment (CE) certifications are determined by the role of the contractor and must be met within six months of delivery order issuance. Contractors working on servers are encouraged to have a Microsoft 2008 Server or 2012 Server certification. Contractors working on End-User devices are encouraged to have a professional certification that coincides with the technology inherent in the system (i.e. MCSE, CCNA, RHCSE, etc.). The CompTIA A+ certification will also satisfy the CE certification requirement.

•IA Training Requirements. Contractors will meet minimum training requirements within six months of contract award. Contractors will be required to complete Cyber Security Fundamentals located at URL: https://ia.signal.army.mil/IAF/

•Two-Factor Authentication. Contractors will authenticate using two-factor authentication. The only method for authenticating is the Common Access Card (CAC).

•Army Training Certification Tracking System (ATCTS). Contractors with a need for elevated privileged- level access will be defined to ATCTS. https://atc.us.army.mil/iastar/regulations.php

•Network Account Request Package (Authorized & Privileged). The contractor will submit a request package through either the ITC One-Stop Shop for contractors requiring on-site access or through the Information Assurance/Cyber Security Branch for contractors requiring remote access to an Army network. Remote access must be through a Defense Health Agency (DHA) Business-To-Business (B2B) solution. Vendors should email: usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain remote access through DHA, for Army requirements.

•IA Training. DoD Cyber Awareness Challenge Training must be completed by all contractor employees and associated sub-contractor employees prior to issuance of network access and annually thereafter. DoD Cyber Awareness Challenge Training is available at the following website: https://ia.signal.army.mil/DoDIAA/

•Acceptable Use Policy (AUP). All vendors/contractors will sign/acknowledge the Army Standard Acceptable Use Policy (AUP) prior to being granted a Army network account. The Army Standard AUP is available at the following website: https://atc.us.army.mil/iastar/docs/aup.pdf

5 Warranty and Post-Warranty Service Maintenance Agreement Cybersecurity Requirements

1 Continuous Risk Management

1.1 The vendor shall maintain a duplicate of the fielded equipment/product falling under one authorization; for testing in a vendor supplied lab environment at vendor location for 6 years from initial ATO approval or as long as the vendor commercially supports the equipment/product, whichever is longer. The vendor shall maintain a duplicate of the equipment/product for each version owned by the Army and originally purchased through the vendors DLA contract. The duplicate equipment/product does not have to be a physical duplication and can just be virtual duplication, as long as all components within the authorization boundary are represented

1.1.1 The vendor shall maintain the duplicate system or device in operational condition with the latest security patches installed.

1.2 The vendor shall update all ATO required supporting documentation in the event of a system policy, procedural, logical or technical changes to the system.

1.3 The vendor shall maintain the authorized security configuration and notify the government within forty eight (48) hours of any major changes for review. A major upgrade such as major software or hardware revision must be reassessed for ATO. Vendor shall support reauthorizations due to major upgrades.

1.4 The vendor shall ensure the vendor’s device or system is in compliance with the Department of Defense (DoD) Information Assurance Vulnerability Management (IAVM) program upon each deployment.

1.5 The vendor shall ensure any new deployment (including rebuilds) deploy with a fully patched, accredited version maintained in a lab environment.

1.6 The vendor shall make the duplicate device or system available for periodic security reviews, within forty five (45) business days of notification by Government. The vendor shall perform monthly vulnerability scans using the most recent and updated version of approved DoD scan tools.

1.7 Vendor shall maintain system and update to comply with updated STIGS as made available by the Government within three (3) months of notification by the Government.

1.8 The vendor shall provide vulnerability scan and SCAP scan results to Government on a monthly basis. Vendor shall provide raw scan results and administrative reports no later than the 10th calendar day of each month.

1.9 The vendor shall close all discovered vulnerabilities within three (3) months of discovery.

1.10 The vendor shall submit to Government detailed explanations for the inability to close discovered vulnerabilities.

1.11 The vendor shall submit to Government for approval of any mitigation that addresses any open vulnerabilities.

1.12 The vendor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to Government for approval.

1.13 The vendor shall use the Government approved method for remote access administration (DISA B2B) of system or device.

6 Appendix A: Cybersecurity Regulations and Guidance

1. Cybersecurity Regulations and Guidance The vendor shall use and comply with the most recent published versions as of the date of contractual agreement of the following references as well as all regulations or guidance referenced within those publications:

a. United States Law

i. The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

ii. The Federal Information Security Management Act (FISMA)

iii. The E-Government Act of 2002

b. Office of Management and Budget (OMB)

i. The following publications are located at https://www.whitehouse.gov/omb/agency/default

ii. Circular A-130

iii. Guidance M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12- Policy for a Common Identification Standard for Federal Employees and Vendors

c. National Institute of Standards and Technology (NIST)

i. The following publications are located at http://www.nist.gov/publication-portal.cfm

ii. NIST Special Publication (SP) 800-37 – Guide for Applying the Risk Management Framework (RMF) to Federal Information Systems

iii. NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations

d. Federal Information Processing Standards (FIPS)

i. The following publications are located at http://www.nist.gov/itl/fipscurrent.cfm

ii. FIPS Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules

iii. FIPS PUB 199 – Standards for Security Categorization of Federal Information and Information Systems

iv. FIPS PUB 201-2, Personal Identity Verification of Federal Employees and Vendors

e. Department of Defense (DoD)

i. The following publications are located at http://www.dtic.mil/whs/directives/

ii. DoD Instruction 5200.2, DoD Personnel Security Program (PSP)

iii. DoD Instruction 8500.1, Cybersecurity

iv. DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling

v. DoD Instruction 8510.01, Risk Management Framework Process (RMF)

vi. DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM)

vii. DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs

viii. DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in DoD Health Care Programs

ix. DoD Directive 5400.11, DoD Privacy Program

x. DoD Manual 5400.11-R, Department of Defense Privacy Program