Attachment 1 - Statement of Work.pdf

Statement of Work

Contract Title: Remote Authentication Platform Requiring Activity Name: DHA Medical Libraries Organizational Management Office (DML OMO)/Executive Skills, Continuing Education, & Libraries (EXCEL)/J-7, Falls Church, VA

1. Scope and Background

1.1. Scope

This is a Statement of Work (SOW) for a subscription to a single-platform, commercial-off-the-shelf (COTS) remote authentication platform, which is a web-based authentication and electronic access management system. The remote authentication platform shall provide access to Department of Defense (DOD) and Defense Health Agency’s (DHA) Virtual Medical Library (VML) online (virtual) content via single sign-on (SSO) technology both on and off the physical campus. The remote authentication platform should act as a “gateway” service to facilitate access to publisher content anywhere internet access is available. The remote authentication solution for DOD Medicine and the Military Health System (MHS) as defined in this Statement of Work, will provide secure access to authorized remote VML users of full-text journals, magazines, dissertations, and books, as well as free continuing education credit and evidence-based care sheets for DOD Medicine and the MHS, which include and consist of medical, nursing, clinical support, educational, health administrative functions, all medical-related personnel regardless of location (Continental United States (CONUS), Outside the Continental United States (OCONUS), Military Treatment Facilities (MTFs), shipboard, submarine, forward deployed, or other operational settings), and components located within and belonging to the organizations specified below (here-in known as supported organizations):

• Military Health System (MHS)

• Defense Health Agency (DHA)

• DOD Medical Laboratories

• DOD Medical Research Organizations

• United States Coast Guard Medicine

• United States Air Force (USAF)

• United States Army (USA)

• United States Navy (USN)

The contract period of performance will be a base year plus 4 option years with 52.217-8 .

1.2. Background

The DOD and MHS require access to a secure platform to provide remote VML access to DHA.

Regardless of locality (e.g., CONUS, OCONUS, MTFs, shipboard, submarine, forward deployed, or other operational settings), it is imperative to have up to date, evidenced-based information readily available.

Literature written by subject matter experts in their specialties is key to providing safe and quality care.

The subscription supports access to information required for the patient care, professional development, and research information needs of nurses and allied health professionals, researchers, nurse educators, and students.

1.3. Place of Performance: The work to be performed under this contract will be performed at the vendor’s facilities.

1.4. Period of Performance

Base Year Period of Performance

Base Year Period of Performance Remote Authentication Platform

1 MAR 2026 - 28 FEB 2027

Option Years Periods of Performance

Option Year Period of Performance

Option Year 1 1 MAR 2027 - 28 FEB 2028

Option Year 2 1 MAR 2028 - 28 FEB 2029

Option Year 3 1 MAR 2029 - 28 FEB 2030

Option Year 4 1 MAR 2030 - 28 FEB 2031

52.217-8 1 MAR 2031 - 31 AUG 2031

1.5. The vendor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, technical support, supervision, and other items and non-personal services necessary to provide and maintain access to the databases for supported organizations as defined in this SOW.

1.6. Contracting Officer Representative (COR): The COR will be identified by separate letter. The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the vendor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the vendor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; and monitor vendor’s performance and notify both the Contracting Office and vendor of any deficiencies. . A letter of designation issued to the COR, a copy of which is sent to the vendor, states the responsibilities and limitations of the COR, especially regarding changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

2. Requirements

2.1. Application Requirements

2.1.1. The product shall provide all authorized remote library users with access to a single online, web-based product; the product shall be entirely web-based with no software components requiring installation.

2.1.2. The product shall support Single Sign On (SSO) authentication through Security Assertion Markup Language (SAML) validation on an enterprise-wide basis.

2.1.3. The product shall include an administrative interface that supports appointment of one or more Government administrators at the owner or administrator level.

2.1.4. The product shall support designation of administrators at levels ranging from local, single-site administrator to organization owner level.

2.1.5. The product shall provide component IDs as follows:

CLIN Structure Component IDs End Users

CLIN 0001 Air Force Medicine 5,000

CLIN 0002 Army Medicine 5,000

CLIN 0003 Defense Health Agency 2,500

CLIN 0004 Navy Medicine 5,000

2.1.6. The product shall allow accounts paid through other contracts to be placed under the components listed above in this SOW as sub-accounts.

2.1.7. The product shall allow a Government administrator to move user accounts within the hierarchy of each component listed above in this SOW.

2.1.8. The product shall provide an end-user self-registration interface that is configurable by a Government administrator with no mediation from the vendor required and that allows end users to register for sub-accounts.

2.1.9. The product shall provide an end-user portal in which the user can identify, locate and link to subscribed resources that is configurable by a Government administrator.

2.1.10. The product shall provide an end-user portal that is configurable with multiple blocks or tiles that can be customized with various types of content.

2.1.11. The product shall provide an administrative interface that allows customization of the end-user portal as to layout, colors, and branding by a Government administrator without intervention by the vendor.

2.1.12. The product shall provide the ability to create and maintain durable Uniform Resource Locators (URLs) to provide support for direct access to specific access to vendor content.

The vendor shall maintain the durable URLs for the life of the contract. If changes are required, the vendor shall notify the Government 15 calendar days prior to the planned actions and shall provide the updated durable URLs information so that the Government may take the appropriate actions.

2.1.13. The product shall provide a reporting module as part of the administrative interface. The reporting module shall include a system data “dashboard” that displays system metrics for the last week including most frequently used resources, number of authentications and number of active and expired accounts.

2.1.14. The administrative interface shall allow one or more Government appointed systems administrators to view, create, and download system utilization data reports as needed.

2.1.15. The product shall support simultaneous users up to contract user limits. Authorized users are to have immediate access from any web-enabled device.

2.1.16. The system shall provide the ability to access online clinical reference resources across multiple Government approved devices (e.g. Government-approved workstations, mobile devices, etc.).

2.1.17. The product shall support full access to online clinical reference resources via mobile devices in accordance with the DOD Unified Capabilities Approved Products List (DOD UC APL). Product support shall extend to devices using Android, IOS, or other operating systems on the Government Approved Products List. The system shall provide the ability to access online clinical reference resources across multiple Government-approved platforms (e.g. Government-approved operating systems).

2.1.18. The product shall provide the ability to authenticate authorized users in accordance with the DOD Security standards outlined in Federal Information Processing Standards (FIPS).

2.2. System Accessibility

2.2.1. System downtime shall be minimal, and the designated Point of Contact and Contracting Officer’s Representative (COR) shall be notified and shall be provide notification of scheduled maintenance 10-15 calendar days prior to scheduled start date. A minimum of 24 hours before an unplanned system downtime must occur or as soon as a system outage occurs or is noticed.

2.2.2. The system shall be accessible 24 hours per day.

2.2.3. The system shall be accessible 7 days a week.

2.2.4. The vendor shall schedule routine maintenance outside of normal clinical hours (in accordance with Government-negotiated time frames and time zones).

2.2.5. The product shall be fully compatible with the currently approved web browsers on the Government Approved Product List (APL) including most standard web browsers (Mandatory support required for Microsoft Internet Explorer, Mozilla Firefox and Google Chrome), which have cookies enabled. To ensure privacy, the product shall use session cookies rather than persistent cookies.

2.2.6. The vendor shall support the current version of all products on the DoD APL and three previous versions back.

2.2.7. The product shall be compatible with the Windows operating system environment, Apple operating system environment and other approved operating system environments on the Government APL.

2.2.8. The system shall provide the ability to create personal accounts.

2.2.9. The Vendor and its associated subcontractors and supplies (if applicable) shall have the capability to accept and manage up to 2.5 million Internet Protocol (IP) address.

2.2.10. The vendor shall have the documented ability to support the MHS operational networking environment and multiple physical sites within this environment who access content electronically via the requirements of the SOW.

2.3. Reporting Requirements for Usage Data and Statics

2.3.1. The reporting interface shall allow customization of date ranges for display on screen and report outputs.

2.3.2. The reporting interface shall allow customization of date range granularity such as daily, or monthly for report and display output.

2.3.3. The reporting interface shall provide session data by country of login.

2.3.4. The reporting interface shall provide number of authentications within a specified time frame.

2.3.5. The reporting interface shall provide number of active and expired accounts.

2.3.6. The reporting interface shall provide the ability to track and report usage down to the specific resource level for a specified time range.

2.3.7. The reporting interface shall support saving reports and scheduling reports to run on an automated schedule.

2.4. Support Requirements

2.4.1. The vendor support personnel shall be highly experienced in the remote authentication platform.

2.4.2. The vendor support shall be available to all end users within normal US business operating hours. The contractor is responsible for conducting technical and support activities that may require the assistance of the onsite Government personnel, between the hours of 0700

– 1700 local for the facility, Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

2.4.3. All support calls will be addressed by a non-automated system within 4 hours of the initial request.

2.4.4. The vendor shall provide all self-registration page changes and additional page capabilities that the Government can edit at no additional cost to the government. Additional capabilities shall include (or have the vendor edit at no cost) the ability to edit user groups (all) by the Organization Unique ID.

2.4.5. The vendor shall ensure that all subscriptions that are compatible with IP authentication are accessible on the platform.

2.4.6. All support costs not specifically addressed in this SOW shall be included in the subscription cost.

2.4.7. All support functions and product capability that are standard to the product but not addressed by this SOW shall be included at no additional cost to the Government. Any normally provided support functions and product capabilities not covered in the SOW should be listed as included capabilities and function in the offeror’s bid.

2.4.8. The vendor shall provide telephone and email technical support for authorized users worldwide.

2.4.9. The vendor shall provide virtual user training sessions upon request at no additional cost.

2.4.10. The vendor shall provide promotional and instructional flyers and brochures upon request at no additional cost.

2.4.11. The vendor shall provide instruction on management of the administrative module upon request at no additional cost.

2.4.12. The vendor shall provide an administrative portal into which the COR and government civilians in the DML OMO can log to manage resources, settings, pull statistics, etc.

2.4.13. The vendor shall provide ad-hoc statistics on demand.