Attachment - Performance Work Statement.pdf

PART 5

5.0 SPECIFIC TASKS

5.1 Musculoskeletal Physical Therapy Pilot Program

5.1.1 Implementation Setup. The contractor shall

5.1.1.1 Establish secure and compliant eligibility verification mechanisms for beneficiary enrollment

5.1.1.2 Develop and configure outcome/value-based billing processes tailored specifically to DHA requirements

5.1.1.3 Develop a comprehensive multi-channel marketing plan encompassing mailers, printed materials, provider referrals, and digital channels. See Part 7, Technical Exhibit

1, CDRL A004.

5.1.1.4 Establish secure and compliant data-sharing protocols

5.1.1.5 Develop and execute a detailed change management strategy, including ecosystem training to facilitate seamless referrals back to Military Treatment Facilities (MTFs)

5.1.1.6 Assign a dedicated Customer Success Manager (CSM) to support enrollment, engagement strategy, and ongoing program success

5.1.2 Member Identification, Enrollment, and Onboarding. The contractor shall

5.1.2.1 Develop and distribute tailored multi-channel marketing and outreach materials (e.g., direct mailers, SMS, emails, fixed site posters) designed specifically for DHA target populations (active-duty service members and spouses in a CONUS MTF (e.g., Portsmouth), active-duty service members at an OCONUS location (Bahrain), and active-duty service members in an operational environment/CONUS location with barriers to traditional PT access), aiming for full enrollment target within 6 months. See Part 7, Technical Exhibit 1, CDRL A004.

5.1.2.2 Deploy electronic enrollment forms to securely verify eligibility, screen for clinical red flags, and capture baseline data

5.1.2.3 Facilitate online scheduling for initial clinical video assessments with Doctor of Physical Therapy (DPTs)

5.1.3 Clinical Screening and Protocol Development. The contractor shall

5.1.3.1 Conduct initial virtual video assessments with DPTs to determine clinical appropriateness, establish rapport, and create personalized care protocols

5.1.3.2 Incorporate mechanisms to refer patients back to MTF based on defined inclusion/exclusion criteria

5.1.3.3 Develop individualized treatment protocols aligned with clinical best practices and tailored to individual member recovery goals

5.1.4 Provision of Digital Therapy and Clinical Oversight. The contractor shall

5.1.4.1 Ship proprietary FDA-listed biomedical feedback devices enabling remote therapy and real-time feedback, independent of internet connectivity

5.1.4.2 Deliver virtual physical therapy sessions using a biofeedback-enabled digital platform, ensuring accurate exercise execution and continuous feedback

5.1.4.3 Maintain ongoing clinical oversight via asynchronous analytics and iterative protocol updates by assigned DPT clinicians, including necessary referrals back into the

MTF

5.1.4.4 Maintain real time inventory of device distribution and enrollment status to participants. See Part 7, Technical Exhibit 1, CDRL A002.

5.1.5 Beneficiary Engagement and Adherence. The contractor shall

5.1.5.1 Provide continuous clinical support through synchronous and asynchronous interactions, including regular virtual check-ins and consultations with assigned DPT clinicians

5.1.5.2 Deploy personalized communication strategies (including in-app messages, app notifications, and emails) designed to maximize adherence and motivation

5.1.6 Data Reporting, Dashboarding, and Outcome Analysis. The contractor shall

5.1.6.1 Provide near real-time (updated daily) dashboards illustrating enrollments, clinical outcomes (pain reduction, WPAI, PHQ-9, GAD-7), heuristically calculated cost savings, and engagement trends

5.1.6.2 Generate monthly Enrollment & Engagement Reports reportable in 5.1.6.5 Monthly Reporting

5.1.6.3 Deliver quarterly Business Review Reports detailing clinical outcomes, member experiences, and financial performance, reportable in 5.1.6.5 Monthly Reporting

5.1.6.4 Prepare an end-of-pilot Impact Report, including detailed ROI estimation derived from the value-based care model and a claims-based analysis (as long as >500 members enroll), reportable in 5.1.6.5 Monthly Reporting

5.1.6.5 Monthly Reporting: the contractor shall provide a summary of all programmatic tasks and metrics undertaken in support of this activity, including but not limited to adoption, attrition, engagement, and other relevant data reporting that indicates program uptake and utility for the population. See Part 7, Technical Exhibit 1, CDRL A003.

5.1.7 Data Integration. The contractor shall

5.1.7.1 Enable members to generate comprehensive, electronic clinical summaries of their interactions with virtual physical therapy services, which they can choose to have their military provider incorporate into their medical record if desired, enhancing ongoing care documentation

5.1.8 Project Management, Stakeholder Coordination, and Success Planning. The contractor shall

5.1.8.1 Conduct initial and recurring meetings with DHA site leadership and clinicians to align pilot objectives, ensure operational success, and facilitate buy-in.

5.1.8.2 Provide comprehensive change management support, including ecosystem training and stakeholder engagement strategies

5.1.8.3 Execute site-specific kickoff events introducing stakeholders, clinical teams, and enrolled members to the virtual physical therapy pilot. Site visits include both CONUS and OCONUS locations to include Naval Station Bahrain.

5.1.8.4 Maintain structured communication channels for continuous feedback, issue resolution, and ongoing updates facilitated by the dedicated CSM

5.1.9 Pilot Evaluation and Reporting. The contractor shall

5.1.9.1 Produce a comprehensive end-of-pilot report summarizing clinical efficacy, participant satisfaction, operational insights, and broader DHA implementation recommendations. See Part 7, Technical Exhibit 1, CDRL A005.

5.1.9.2 Document key insights, best practices, and lessons learned to inform future DHA digital-first healthcare initiatives

5.2 Pelvic Floor Physical Therapy Pilot Program

5.2.1 Implementation Planning and Setup. The contractor shall

5.2.1.1 Establish secure and compliant eligibility verification mechanisms for beneficiary enrollment

5.2.1.2 Develop and configure outcome/value-based billing processes tailored specifically to DHA requirements

5.2.1.3 Develop a comprehensive multi-channel marketing plan encompassing mailers, printed materials, provider referrals, and digital channels. See Part 7, Technical Exhibit

1, CDRL A004.

5.2.1.4 Establish secure and compliant data-sharing protocols

5.2.1.5 Develop and execute a detailed change management strategy, including ecosystem training to facilitate seamless referrals back to Military Treatment Facilities (MTFs)

5.2.1.6 Assign a dedicated Customer Success Manager (CSM) to support enrollment, engagement strategy, and ongoing program success

5.2.2 Member Identification, Enrollment, and Onboarding. The contractor shall

5.2.2.1 Develop and distribute tailored outreach materials specifically targeting active-duty servicewomen at Fort Cavazos, Texas, associated with CRDAMC Medical Center.

See Part 7, Technical Exhibit 1, CDRL A004.

5.2.2.2 Implement electronic enrollment forms that securely verify eligibility, identify clinical contraindications, and gather baseline pelvic health data

5.2.2.3 Facilitate online selection and scheduling for initial clinical consultations with Pelvic Health Specialists (PHS)

5.2.3 Clinical Screening and Personalized Protocol Development. The contractor shall

5.2.3.1 Conduct initial virtual assessments with PHS clinicians to determine clinical appropriateness, establish rapport, and create personalized care protocols.

5.2.3.2 Incorporate mechanisms to refer patients back to MTF based on defined inclusion/exclusion criteria

5.2.3.3 Design personalized pelvic health therapy plans aligning with clinical best practices and individual therapeutic goals

5.2.4 Provision of Digital Therapy and Clinical Oversight. The contractor shall

5.2.4.1 Distribute proprietary FDA-listed biofeedback device specifically designed for pelvic floor therapy to enrolled participants

5.2.4.2 Conduct virtual pelvic health therapy sessions utilizing AI-enabled biofeedback technology for precise execution and real-time feedback

5.2.4.3 Maintain ongoing clinical oversight with asynchronous analytics, iterative protocol updates, and direct PHS clinician management, including referrals back into the MTF as necessary

5.2.4.4 Maintain real-time inventory of device distribution and enrollment status to participants. See Part 7, Technical Exhibit 1, CDRL A002.

5.2.5 Beneficiary Engagement and Adherence. The contractor shall

5.2.5.1 Provide continuous clinical support through synchronous and asynchronous interactions including regular virtual check-ins with PHS clinicians

5.2.5.2 Deploy personalized communication strategies (including in-app messages, app notifications, and emails) tailored specifically to enhance adherence and motivation for active-duty service women

5.2.6 Data Reporting, Dashboarding, and Outcome Analysis. The contractor shall

5.2.6.1 Provide near real-time (updated daily) dashboards illustrating enrollments, clinical outcomes, cost savings, and engagement trends

5.2.6.2 Generate monthly Enrollment & Engagement Reports

5.2.6.3 Deliver quarterly Business Review Reports detailing clinical outcomes, member experiences, and financial performance

5.2.6.4 Prepare an end of pilot Impact Report, including detailed ROI estimation derived from the value-based care model

5.2.6.5 Monthly Reporting: the contractor shall provide a summary of all programmatic tasks and metrics undertaken in support of this activity, including but not limited to adoption, attrition, engagement, and other relevant data reporting that indicates program uptake and utility for the population. See Part 7, Technical Exhibit 1, CDRL A003.

5.2.7 Documentation and Data Integration. The contractor shall

5.2.7.1 Enable participants to generate comprehensive clinical summaries of interactions with virtual pelvic floor therapy services in electronic format, which patients can have their military providers include in their MHS Genesis record as desired

5.2.8 Project Management, Stakeholder Coordination, and Success Planning. The contractor shall

5.2.8.1 Coordinate initial and recurring meetings with Fort Cavazos and CRDAMC leadership, aligning pilot objectives and logistics

5.2.8.2 Provide comprehensive change management support, including ecosystem training and stakeholder engagement strategies

5.2.8.3 Execute site-specific kickoff events introducing stakeholders, clinical teams, and pilot participants to Bloom services

5.2.8.4 Maintain structured communication channels for continuous feedback, issue resolution, and ongoing updates facilitated by the dedicated CSM

5.2.9 Pilot Evaluation and Reporting. The contractor shall

5.2.9.1 Produce a comprehensive end-of-pilot report summarizing clinical efficacy, participant satisfaction, operational insights, and broader DHA implementation recommendations. See Part 7, Technical Exhibit 1, CDRL A005.

5.2.9.2 Document key insights, best practices, and lessons learned to inform future DHA digital pelvic health initiatives

PART 6

6.0 INFORMATION TECHNOLOGY & SECURITY

6.1 All work under this contract is unclassified.

6.2 Reserved

6.3 Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal information requirements: Refer to Clause Section, Attachments 1 and 2 of DHA Procedures, Guidance and Information 224.90, Personally Identifiable Information (PII), PHI), and Federal Information Requirement.

6.3.1. Data Sharing Agreements (DSAs): Contractors requiring access to PII, which includes PHI, or access to de-identified data, are subject to the DHA Privacy and Civil Liberties Office (DPCLO) (Privacy Office) Data Sharing Program. This program requires DHA to enter into DSAs with parties outside the MHS who use or create MHS data. A DHA contract may use the term Data Use Agreement (DUA) rather than DSA. DSAs assure that outside parties protect MHS data in accordance with the Privacy Act and the HIPAA Rules. To apply for a DSA, the contractor submits a Data Sharing Agreement Application (DSAA) to the DHA DPCLO. The contractor submits the DSAA even if a subcontractor will be the party accessing MHS data.

After review and approval of the DSAA, the Privacy Office provides a DSA to the contractor for execution.

6.3.2. Processing Procurement Sensitive Information: All individuals shall seek guidance from the CO regarding the coordination of documents, dissemination, and transmission of procurement sensitive information. Procurement sensitive information shall not be transmitted electronically unless encryption is utilized. Depending on a particular procurement, other restrictions may apply.

6.4 Training

6.4.1 Contractor employees performing cybersecurity/cyberspace functions shall comply with the following requirements:

6.4.1.1 Training: All contractor and associated subcontractor employees working Cybersecurity Information Assurance (IA)/Cyberspace functions must comply with DoD training requirements in Department of Defense Directive (DoDD) 8140.01 and DoD 8570.01-M. Contractors shall identify, document, track, and report qualifications of contract support personnel who perform cyberspace work roles.

6.4.1.2 Certification: The contractor shall ensure that personnel accessing IS have the proper and current IA certification to perform IA functions at contract award in accordance with DoD 8570.01–M, IA Workforce Improvement Program. The contractor shall meet the applicable IA certification requirements as outlined in DFARS 252.239-2001, including:

6.4.1.2.1 DoD-approved IA workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01–M; and

6.4.1.2.2 Appropriate operating system certification for IA technical positions as required by DoD 8570.01–M.

6.4.1.2.2.1 Upon request by the Government, the contractor shall provide documentation supporting the IA certification status of personnel performing IA functions.

6.4.1.2.2.2 Contractor personnel who do not have proper and current certifications shall be denied access to DoD IS for the purpose of performing IA functions.

6.4.2 User requirements: All contractor employees that require access to DHA IT must comply with the requirements of DHA-Procedural Instruction 8140.01, Acceptable Use of DHA IT, to include those contract employees with privileged access.

6.5 Cybersecurity Requirements for Non-DoD IT or Covered Contractor IS:

6.5.1 The contractor shall, at time of award, have implemented the security requirements prescribed in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (available via the internet at http://dx.doi.org/10.6028/NIST.SP.800- 171), in accordance with DFARS clause 252.204-7012.

6.5.2 NIST SP 800-171 DoD Assessment Methodology. The DFARS provision 252.204-7019 introduces the “NIST SP 800-171 DoD Assessment Methodology” requirement. This requirement enables a strategic assessment of a contractor’s implementation of the NIST SP 800- 171 requirements as required in DFARS clause 252.204-7012. The DoD Assessment Methodology requirement flows down to subcontractors.

6.5.2.1 Basic Assessment: The contractor shall obtain and maintain access to the Supplier Performance Risk System (SPRS) via the PIEE, (available via the internet at https://www.sprs.csd.disa.mil/). See Part 7, Technical Exhibit 1, CDRL A005.

6.5.2.1.1 The contractor shall perform a Basic Assessment, using the NIST SP 800-171 DoD Assessment Scoring Template, and enter the results electronically in SPRS for each covered contractor information system that is relevant to an offer, contract, task order, or delivery order.

See Attachment 2, Deliverable Schedule Table.

6.5.2.1.2 The contractor shall ensure that applicable subcontractors also have their results of a current assessment posted in SPRS prior to awarding a subcontract or other contractual instrument in accordance with DFARS clause 252.204-7020.

6.5.3 The contractor shall provide the government with access to its facilities, systems, and personnel when necessary to conduct or renew a higher-level (i.e., Medium or High) assessment in accordance with DFARS clause 252.204-7020.

http://dx.doi.org/10.6028/NIST.SP.800-http://dx.doi.org/10.6028/NIST.SP.800-https://www.sprs.csd.disa.mil/

6.5.4 Cybersecurity Maturity Model Certification (CMMC): Reserved.

6.5.4.1 Reserved.

6.5.5 The contractor shall submit requests to vary from NIST SP 800-171 in writing to the CO or COR, for consideration by the DoD Chief Information Officer (CIO). The contractor need not implement any security requirement adjudicated by an authorized representative of the DoD CIO to be non-applicable or to have an alternative, but equally effective, security measure that may be implemented in its place.

6.5.6 If the DoD CIO has previously adjudicated the contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the CO or COR when requesting its recognition under this contract.

6.5.7 Cloud Computing: If the contractor intends to use an external cloud service provider, on their behalf, to store, process, or transmit any DoD CUI in performance of this contract, the contractor shall require the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/) and that the cloud service provider complies with requirements in paragraphs 6.5.8 through 6.5.14 for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

6.5.7.1 If the information is DoD CUI-specific (e.g., PII/PHI), then the contractor shall ensure the external cloud service provider meet the security requirements equivalent to FedRAMP High baseline.

6.5.8 Cyber Incident Reporting Requirement

6.5.8.1 When the contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the contractor shall:

6.5.8.1.1 Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident, as well as other IS on the contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the contractor’s ability to provide operationally critical support; and https://www.fedramp.gov/

6.5.8.1.2 In accordance with DFARS clause 252.204-7012, rapidly report (within 72 hours) cyber incidents involving DoD CUI to DoD Cyber Crime Center (DC3) via https://dibnet.dod.mil/portal/intranet/. In the event of a cybersecurity incident involving a CUI- Specific breach (i.e., PII/PHI), the contractor, in addition to reporting to the DC3, shall follow the incident reporting guidance prescribed in the TRICARE Operations Manual, Chapter 1, Section 5, “Compliance with Federal Statutes” at https://manuals.health.mil/

6.5.8.2 Cyber incident report: The cyber incident report shall be treated as information created by or for DoD and shall include, at a minimum, the required elements as prescribed at the https://dibnet.dod.mil/portal/intranet/.

6.5.8.3 Medium assurance certificate requirement: In order to report cyber incidents in accordance with this clause, the contractor or subcontractor shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents. For information on obtaining a DoD-approved medium assurance certificate, see https://public.cyber.mil/

6.5.9 Malicious software: When the contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to DC3 in accordance with instructions provided by DC3 or the Contracting Officer. Do not send the malicious software to the Contracting Officer.

6.5.10 Media preservation and protection: When a contractor discovers a cyber incident has occurred, the contractor shall preserve and protect images of all known affected IS and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DoD to request the media or decline interest.

6.5.11 Access to additional information or equipment necessary for forensic analysis: Upon request by DoD, the contractor shall provide DoD with access to additional information or equipment that is necessary to conduct a forensic analysis.

6.5.12 Cyber incident damage assessment activities: If DoD elects to conduct a damage assessment, the CO will request that the contractor provide all the damage assessment information gathered in accordance with paragraph (e) of DFARS clause 252.204-7012.

6.5.13 Apply other IS security measures when the contractor reasonably determines that IS security measures may be required to provide adequate security in a dynamic environment or to accommodate special circumstances (e.g., HIPAA) and any individual, isolated, or temporary deficiencies based on an assessed risk or vulnerability. These measures may be addressed in a system security plan.

6.5.14 The contractor shall maintain within the US or US territories all Government data that is not physically located on DoD premises, unless the contractor receives written notification from the CO to use another location, in accordance with DFARS 239.7602-2(a).

https://dibnet.dod.mil/portal/intranet/ https://manuals.health.mil/ https://dibnet.dod.mil/portal/intranet/ https://public.cyber.mil/

6.5.15. The contractor shall mitigate supply chain risk to the government by complying with DFARS 252.239-7018 and only utilizing unified capability equipment identified on the DODIN Unified Capabilities Approved Products List (https://aplits.disa.mil/processAPList), unless granted a waiver in accordance with DODI 8100.04, DOD Unified Capabilities (UC).

6.6 Risk Management Framework (RMF) for DoD IT: Reserved

6.7. Facility Related Control Systems: Reserved

6.8. System Communications - RESERVED

6.9 MHS Demilitarized Zone (DMZ) Medical Community of Interest (MedCOI) Business-to-Business (B2B) Gateway

6.9.1 If there is an external system connection to a DoD IS required, then the contractor shall, in accordance with contract requirements, connect to the DHA B2B Gateway via a contractor procured Internet Service Provider (ISP) connection.

6.9.2 The contractor shall assume all responsibilities for establishing and maintaining their connectivity to the B2B Gateway. This shall include acquiring and maintaining the circuit used to connect to the B2B Gateway and the acquisition of a Virtual Private Network (VPN) device maintenance agreement and license compatible with the MHS VPN device. The list of compatible devices is detailed in the DHA B2B/MedCOI Gateway questionnaire.

6.9.3 The contractor shall submit a completed current version of the DHA B2B Gateway questionnaire to their Contracting Officer or COR within 10 calendar days after new requirements have been provided to the contractor.

6.9.4 The contractor shall provide information specific to their connectivity requirements, proposed path for the connection and last mile diagram.

6.10 Contractor Provided IT Infrastructure

6.10.1 Platforms shall support Hypertext Transfer (Transport) Protocol (HTTP), HyperText Transfer (Transport) Protocol Secure (HTTPS), web-derived Java Applets, and Secure File Transfer Protocols (SFTPs) (e.g., STFP, Secure Socket Layer/Transport Layer Security), and all software that the contractor proposes to use to interconnect with DoD facilities.

6.10.2 The contractor shall configure their networks to support access to Government systems (e.g., configure ports and protocols for access).

6.10.3 The contractor shall provide full time connections to a TIER 1 or TIER 2 ISP. Dial-up ISP connections are not acceptable. All IP addresses need to be publicly routable. Private address space using Network Address Translation will not be permitted.

https://aplits.disa.mil/processAPList

6.10.4 The contractor shall maintain a valid maintenance contract and pertinent licenses for all devices connecting to the MHS B2B Gateway.

6.11 Reserved.

6.12 MHS Systems Telecommunications

6.12.1 The primary communication links shall be via encrypted tunnels (i.e., Secure Internet Protocol (IPSEC), GetVPN, or Secure Socket Layer) between the contractor’s primary site and the MHS B2B Gateway.

6.12.2 The contractor shall place the VPN appliance device outside the contractor’s firewalls and shall allow full management access to this device (e.g., in router access control lists) to allow Central VPN Management services provided by DHA or other source of service as designated by the MHS to remotely manage, configure, and support this VPN device as part of the MHS VPN domain.

6.12.3 The contractor shall procure and configure for operation an auxiliary VPN device for backup purposes to minimize any downtime associated with problems of the primary VPN.

6.12.4 The contractor shall send devices to the MHS VPN management authority (e.g., DHA) via postage paid and include prepaid return shipping arrangements for the devices(s).

6.12.5 The MHS VPN management authority (e.g., DHA) will remotely configure and manage the VPN appliance once installed by the contractor.

6.12.6 The contractor shall be responsible for the maintenance and repair of contractor procured VPN equipment.

6.12.7 The Government will be responsible for the troubleshooting of VPN equipment.

6.13 Establishment of Telecommunications

6.13.1 Telecommunications shall be established with the MHS through coordination with DHA.

6.13.2 The contractor and DHA Program Office shall identify their requirement(s) for the establishment of telecommunications with the MHS and/or other Government entities.

6.13.3 The DHA/MedCOI B2B Gateway Questionnaire (provided by DHA) identifies the required telecommunication infrastructure between the contractor and the MHS systems. This includes all Wide Area Network, Local Area Network, VPN, Web DMZ, and B2B Gateway access requirements.

6.13.4 The contractor shall complete their applicable portion of the questionnaire and shall return it to the DHA designated POC for review and approval.

6.13.5 The contractor shall, Upon Government request, provide technical experts to provide any clarification of information provided in the questionnaire. DHA will review and process the questionnaire when it is accepted.

6.13.6 DHA will coordinate any requirements for additional information with the POC and schedule any meetings required to review the Questionnaire. Upon approval of the Questionnaire, DHA will coordinate a testing meeting with appropriate stakeholders.

6.13.7 DHA will notify the contractor POC of the meeting schedule. The purpose of the testing meeting is to complete a final review of the telecommunication requirements and establish testing dates.

6.14 Contractors Located on Military Installations

6.14.1 The contractor(s) shall coordinate/obtain the connections with the local MTFs/ Enhanced Multi-Service Markets (eMSMs) and Base/Post/Camp communication personnel located on a military installation who require direct access to Government systems.

6.14.2 These connections will be furnished by the Government.

6.14.3 Contractors located on military installations that require direct connections to their networks shall provide an isolated IT infrastructure. They shall coordinate with the Base/Post/Camp communications personnel and the MTF/eMSM in order to get approval for a contractor procured circuit prior to installation to ensure the contractor is within compliance with the respective organizational security policies, guidance and protocols.

Note: In some cases, the contractor may not be allowed to establish these connections due to local administrative/security requirements.

6.14.4 The contractor shall be responsible for all security certification documentation as required to support DoD IA requirements for network interconnections.

6.14.5 The contractor shall provide, on request, detailed network configuration diagrams to support IA accreditation requirements.

6.14.6 The contractor shall comply with IA accreditation requirements. All network traffic shall be via Transmission Control Protocol/Internet Protocol using ports and protocols in accordance with current Service security policy. All traffic that traverses MHS and/or military Service Base/Post/Camp security infrastructure is subject to monitoring by security staff using Intrusion Detection Systems.

PART 7

7.0 ATTACHMENTS/TECHNICAL EXHIBIT LISTING

7.1 The following forms are to be completed by the FSO/Security POC, or COR once the contractor is granted the proper background investigation.

7.1.1 Contractor CAC Request Process.

DHA CAC Request

Process.pdf

DMDC TASS

Application.xlsx

PART 7, ATTACHMENT 1

PERFORMANCE REQUIREMENTS SUMMARY

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Performance Objective PWS Reference Acceptable Quality Level

(AQL)

Method of Surveillance

Performance Requirements Summary (PRS) # 1.

The contractor shall provide all marketing and planning materials necessary to initiate and establish successful pilot launch in DHN-E

5.1.1, 5.1.2, 5.2.1, 5.2.2 Zero Deviation 100% Inspection

PRS # 2

The contractor shall conduct enrollment and assessment activities for eligible beneficiaries

PWS 5.1.2, 5.1.3, 5.2.2,

5.2.3

Zero Deviation 100% Inspection

PRS # 3

The contractor shall deliver hardware to eligible participants within 7 business days of initial request for CONUS locations, and 14 business days for OCONUS locations

PWS 5.1.3, 5.1.4, 5.2.4,

5.2.4

Zero Deviation 100% Inspection

PRS #4

The contractor shall maintain accurate records of enrollment and device distribution to participants

PWS 5.1.4, 5.1.6 Zero deviation 100% Inspection

PRS #5

The contractor shall provide all clinical summaries to the patient about the patient’s treatment, progress, and clinically meaningful outcomes

5.1.7, 5.2.7 Zero Deviation 100% Inspection

PWS #6

The contractor shall provide final reporting on pilot efficacy and metrics on pilot success

5.1.9, 5.2.9 Zero Deviation 100% Inspection

7.2 Other Attachments

Attachment 1, Cybersecurity Regulations and Guidance (Paragraph 6.7.2.3)

Attachment 3-Cybersecurity Regu

PART 7, TECHNICAL EXHIBIT 1

DELIVERABLES SCHEDULE

Deliverable Frequency Medium/Format Submit To Applicable to:

Quality Program Plan

(QPP)

Within 30 days of task order award

Contractors' discretion

CDRL A001 to

COR

All, See PWS 1.10.1

Hardware Distribution List

Weekly Written summary or digital visualization

CDRL A002 to

COR, DHN-E

Program Manager

5.1.4.4, 5.2.4.4

Monthly Report Monthly Written summary CDRL A003 to COR, Chief Innovation Officer, DHN-E Program Manager

5.1.6.5, 5.2.6.5

Marketing and Communications

As developed Contractors' discretion

CDRL A004 to

COR, DHN-E

Program Manager

5.1.1, 5.1.2, 5.2.1, 5.2.2

Basic Self-Assessment At time of award, and annually thereafter 30 days before anniversary date during each option year

Electronic CDRL A005 to the

COR

6.5.2.1

Security Clearances, Background Investigations, and Security Training for CAC holders

Upon Request Electronic COR 1.17.12

End of pilot impact report

With final monthly report

Written Summary or digital visualization

COR 5.1.9.1, 5.2.9.1