Combined Synopsis N6264520R0027.pdf

This is a combined synopsis/solicitation for commercial items prepared in accordance with FAR FAR 12.6, Streamlined Procedures for Evaluation and Solicitation for Commercial Items, as supplemented with additional information included in this notice. Also, this acquisition is being conducted under FAR 13.5, Simplified Procedures for Certain Commercial Items. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation on an SF 1449 will not be issued. The solicitation number is N6264520R0027.

The solicitation is issued as a request for proposal (RFP). Provisions and clauses in effect through Federal Acquisition Circular 2005-97 are incorporated. It is the contractor’s responsibility to be familiar with the applicable clauses and provisions. The clauses may be accessed in full text at these addresses:

https://www.acquisition.gov/content/regulations The NAICS code is 339112. This is a Full and Open Competition requirement; all qualified vendors are encouraged to submit a proposal.

The Naval Medical Logistics Command request responses from qualified sources capable of providing the following:

ESSENTIAL CHARACTERISTICS

ESSENTIAL CHARACTERISTICS

INTRA-AORTIC BALLOON CIRCULATORY ASSIST UNITS

The proposed action is for two (2) intra-aortic balloon pump (IABP) consoles for Naval Medical Center San Diego.

The units shall be capable of providing temporary cardiac assistance by reducing heart afterload and increasing coronary and systemic blood flow. The units shall be capable of use both in the hospital and during patient transport.

For patient transport, a smaller form factor and lighter weight are enhancing factors. The units shall have backlit screens. The units shall have help screen navigation. The units shall have intra-beat timing protocols to support arrhythmic patients. The units shall be capable of automatic deflation timing management. The units shall utilize at least the following triggers: electrocardiograph (ECG) pattern, ECG peak, atrial-fibrillation (A-FIB), atrial paced, ventricular paced, and arterial pressure. The systems shall be capable of continuous evaluation of ECG lead performance, heart rate, and heart rhythm. The units shall be capable of automatic signal and trigger switching. The units shall be capable of gas surveillance at all heart rates with no automatic alarm suspension. The units shall be capable of synchronizing to Cardiopulmonary Resuscitation (CPR) to support coronary perfusion and cardiac output during a code. The units shall be capable of operating in both automatic mode and manual mode. In automatic mode, the units shall have the following features: The units shall have 1-button start up with accurate 1:1 support timing and full volume, the unit shall automatically assess and manage proper inflation and deflation timing, the unit shall have automatic trigger selection based on physiological measurements, the unit shall automatically select the best ECG leads based on signal analysis, the unit shall automatically assess and initiate arrhythmia timing as necessary. In manual mode, the units shall allow for operator control of pump functionality. The units shall have a minimum battery operating time on full charge of 90 minutes. The units shall be compatible with 30mL and 40mL Maquet IABP balloons. The power requirement is 120VAC, 60Hz.

Initial operator training is required. Training shall include face to face group education classes offered by the vendor prior to roll out. Class content will be customized by use area and user role. Classes shall include didactic information as well as hands on return demonstration to meet competency requirements of NMCSD. Classes shall be offered onsite at NMCSD at selected times to include day and night time classes.

The system, including claims made for the product, shall be compliant with Food and Drug Administration (FDA) regulations, with respect to marketing and delivering medical products for use in the United States of America. These requirements shall apply even if delivery is requested outside of the United States of America. The system shall be installed in compliance with OSHA requirements. Proposed equipment shall not have any open FDA Class I recalls at the time of proposal submission.

Contractor shall be an Original Equipment Manufacturer (OEM) authorized dealer, authorized distributor, or authorized reseller for the proposed equipment/system, such that OEM warranty and service are provided and https://www.acquisition.gov/content/regulations maintained by the OEM. All software licensing, warranty, and service associated with the equipment/system shall be in accordance with the OEM terms and conditions.

Upon delivery, the contractor shall be responsible for uncrating the unit/system, transporting it through the facility to the location of intended use for installation, and removing of all trash created in this process. If interim storage is required, the vendor shall make arrangements for the storage.

BASIS FOR AWARD

The government intends to award one (1) firm-fixed price contract resultant from the issuance of this solicitation to the responsible offeror submitting a proposal that is determined most advantageous to the Government, price and other factors considered. Awards under this procurement will be made to the offeror determined to be the best value to the Government. The evaluation of proposals will be based on the following factors:

Volume I: Technical Evaluation Factor A: Conformance to the Essential Characteristics Evaluation Factor B: Conformance to Information Assurance Evaluation Factor C: Design Quality and Capability Volume II: Past Performance Evaluation Factor D: Past Performance Volume III: Business Evaluation Factor E: Price

Relative Importance of Factors. The relative importance of each factor is as follows:

Evaluation Factor A and Evaluation Factor B will be evaluated, individually, on a pass/fail basis. If an offeror’s technical proposal is determined to have failed under Evaluation Factors A or B, either initially or following discussions if they are conducted, the offeror’s proposal will receive no further consideration for award unless there are no other technically acceptable proposals. If an offeror’s technical proposal is determined to have passed Evaluation Factors A and B, then the offeror’s proposal will be further evaluated on a trade-off basis taking into consideration evaluation Factors C through E. In doing so, Factor C – Design Quality and Capability is more important than Factor D – Past Performance. The combination of Evaluation Factors C and D will be more important than Factor E – Price. Since an award will be made on a best value basis, the Contracting Officer reserves the right to award to other then the lowest priced offeror providing the prices are determined fair and reasonable.

The Government intends to evaluate proposals and award a single contract without discussions with offerors.

Offerors are therefore cautioned that their initial proposal should contain the offeror’s best terms. The Government reserves the right to conduct discussions if the Contracting Officer later determines them to be necessary.

The evaluation factors for Technical, Past Performance and Price are listed below; proposals shall include sufficiently detailed information to enable evaluation based on the following factors:

Volume I – Technical.

Evaluation Factor A: Conformance to the Essential Characteristics - Evaluation shall include ability to meet the essential characteristics of this requirement. Vendors not meeting all requirements will not be further considered for award unless there are no other technically acceptable offerors. This will be rated either Pass or Fail.

Evaluation Factor B: Conformance Information Assurance – The Government will evaluate the capability of the contractor to meet Navy Information Assurance (IA) requirements. This evaluation will be based on the information provided in the completed Medical Device Risk Assessment.

Evaluation Factor C: Design Quality and Capability – The Government will evaluate the design quality and capabilities of the proposed intra-aortic balloon pump (IABP) for use during treatment of cardiogenic shock. Also, the Government will evaluate enhancing factors.

The Government will not assume that the offeror possesses any capability or knowledge unless it is specified in the Technical volume.

Volume II – Past Performance.

Evaluation Factor D: Past Performance - The Government will evaluate the offeror's recent relevant past performance record as to (1) the functional performance of the proposed or similar IABP systems that the offeror has delivered to previous customers, and (2) the quality and timeliness of the technical assistance and hardware and software updates/upgrades that the vendor has supplied to its customers following the initial fielding of those systems.

Offerors shall provide past performance data for all similar contracts for the last 3 years, up to 3 data points, or 3 data points for delivery starting with the most recent contracts for which delivery occurred at least 3 months prior to the closing of this solicitation. The data shall include: Organization/Location, POC/Number, Contract Reference Number, Contract Date, Value of the Contract (rounding to the nearest $5K is acceptable), and affirmative or negative response to “Has the POC agreed to be contacted as a reference?”

The Government reserves the right to consider other past performance information at its disposal, in addition to any information obtained from the references provided above. The Government is likely to randomly select references provided for contact and does not commit to contact every reference

Volume III – Business.

Evaluation Factor E: Price - Adequate price competition is expected for this acquisition. The Business volume will be evaluated with consideration to the following factors:

COMPLETENESS. The offeror’s Business volume will be examined to ensure all items required in the Instructions to Offeror’s have been submitted and are complete.

REASONABLENESS. The offeror’s proposed price will be evaluated separately to determine the degree to which the total proposed price compares to the price a reasonable prudent person would expect to incur for the same or similar equipment. The offeror’s total proposed price will be used to evaluate price reasonableness. Since awards will be made on a best value basis, the Contracting Officer reserves the right to award at a premium, provided that the proposed price is determined to be reasonable.

In accordance with FAR 15.306(c), “Competitive Range”, the Government will evaluate all proposals and, if discussions are to be conducted, the Government will establish a competitive range. Based on the ratings of each proposal against all evaluation criteria, the Contracting Officer will establish a competitive range comprised of all the most highly rated proposals. The Contracting Officer may further reduce the competitive range for purposes of efficiency.

Offerors shall be registered in the System for Award Management (SAM) database in accordance with FAR 52.212-

3. The offeror shall verify its online representations and certifications are current, accurate, complete and applicable to this solicitation as of the date of its offer and are incorporated in its offer by reference. The offeror shall also be registered in SAM under the applicable NAICS code for this solicitation; 334516. Registration is free and can be completed on-line at https://www.sam.gov/portal/public/SAM/ . No documentation is required to be submitted in response to this paragraph.

Questions

Any questions must be addressed to Mrs. Gerrie Johnson at Gerrie.m.johnson.civ@mail.mil by e-mail only, no later than 1300 Eastern Time, 24 March 2020.

https://www.sam.gov/portal/public/SAM/ mailto:Gerrie.m.johnson.civ@mail.mil

No phone calls will be accepted.

File Submission

Only electronic files will be accepted. All responses should be submitted to Mrs. Gerrie Johnson at Gerrie.m.johnson.civ@mail.mil no later than 0800 EDT, Monday, April 20, 2020.

Subject line should read: Solicitation #N6264520R0027 Emails shall be no larger than 10 MB

The Technical, Past Performance and Business volumes shall be submitted via e-mail only. Files shall be in Microsoft Word, Microsoft Excel or Adobe PDF only.

All proposals shall include the following information on its cover page:

• Complete company name and address

• Company POC including title, email address and phone number

• Cage Code

• DUNS Number

• Place of Manufacture

INFORMATION ASSURANCE

DHA Cyber Logistics Center of Excellence

Defense Health Agency (DHA) Cyber Logistics (CyberLOG) Cybersecurity/Risk Management Framework (RMF) Requirements Updated: March 25, 2019 mailto:Gerrie.m.johnson.civ@mail.mil

Version Matrix

Version Date Author Description

1.0 16 November 2018 Completed initial draft of Cybersecurity

Language.

1.1 31 January 2019 Updated document to reflect vendor comments/suggestions.

1.2 06 February 2019 CyberLOG Final Document

1.3 25 March , 2019 CyberLOG Addition of Section B 1.11.

Table of Contents A. General Overview of DHA Cybersecurity Requirements

1. New Equipment/Product systems, equipment and software under RMF:

2. Pricing for Cybersecurity:

3. Maintenance and upgrades:

B. DHA Cybersecurity/Risk Management Framework (RMF) Requirements

1. System Security Requirements

2. RMF Assessment Timeframes

3. Assessment and Authorization (A&A)

4. Privileged User Training and Certification Requirements

5. Warranty and Post-Warranty Service Maintenance Agreement Cybersecurity Requirements

Appendix A: Cybersecurity Regulations and Guidance

1) Cybersecurity Regulations and Guidance

N6264520R0027

A. General Overview of DHA Cybersecurity Requirements

1. New Equipment/Product systems, equipment and software under RMF:

The vendor shall agree to comply with References listed in Appendix A.

1.1. Software patches and updates: Many enterprises within the DoD automate patch updates and software updates for operating systems and DoD standard software applications. For applications such as databases and developed applications, updates are scheduled.

Vendors shall notify the assigned CyberLOG analyst of any updates/changes to the system prior to installation, to include but not limited to software updates, Operating System, or Application upgrades, patches, addition/removal of components. If the CyberLOG analyst is unknown, the vendor shall submit all requests to dha.detrick.med-log.mbx.cyberlog@mail.mil. Software updates will be analyzed by the Government to determine if reauthorization is required by Department of Defense Instruction (DoDI)

8510.01 Risk Framework (RMF) for DoD Information Technology (IT). Patches normally address bug fixes and cybersecurity issues. Applying patches usually does not trigger reauthorization. Per the DoDI 8500.01 Cybersecurity, Enclosure 3, paragraph 9.b. (11), “All CYBERSECURITY products and IA-enabled products that require use of the product’s CYBERSECURITY capabilities will comply with the evaluation and validation requirements of Committee on National Security Systems Policy 11, National Policy Governing the Acquisition of Information Assurance (IA) and IA-Enabled Information Technology Products, June 2013, as amended.”

1.2. Vendors shall comply with the National Information Assurance Partnership (NIAP)

Common Criteria Cybersecurity Evaluation and Validation Scheme (CCEVS) evaluation (https://www.niap-ccevs.org) which is published on the NIAP-CCEVS Products Compliance List. The NIAP-certified products have been assessed from a security perspective, helping to reduce the existence of potential vulnerabilities. Vendors are required to continually maintain their products, mitigating vulnerabilities and distributing fixes to licensed users.

1.3. Reauthorization in accordance with DoD RMF requirements: Per DoDI 8510.01, Enclosure 6, para 2.f.(6).(a), “In accordance with Appendix III of Office of Management and Budget (OMB) Circular A-130, systems must be reassessed and reauthorized every 3 years or as a result of a system update that negatively affects the security posture (whichever is less).” Program Offices or appropriate logistics organizations plan for this activity. The results of an annual cybersecurity review or a negative change to the system or environment at any time (i.e., a change increasing the residual risk) may result in a need for reauthorization prior to the regular three-year reauthorization.

1.4. The vendor shall maintain all equipment/product versions provided pursuant to this contract, to include the supported operating system, by issuing patches/updates to mitigate vulnerabilities [e.g., Information Assurance Vulnerability Alerts (IAVA) or Information Assurance Vulnerability Bulletins (IAVB)] and network security configurations [e.g., Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs)]. The vendor must adhere to DHA guidance for remediation or mitigation of vulnerabilities associated with the equipment/product. Vendors shall be responsible for providing CYBERSECURITY maintenance support for six (6) years, or until the end of life date of the equipment identified by the vendor, whichever is longer. The vendor shall include, in its pricing to the Government the cost of patching their equipment throughout its lifecycle.

2. Pricing for Cybersecurity:

If there are any additional costs associated with any element of the Cybersecurity lifecycle, the vendor shall include those costs as follows:

2.1. All costs to achieve the initial Authority to Operate (ATO) and maintain it during the equipment’s warranty shall be included in the initial quote/offer price.

2.2. The cost of updating, and upgrading the vendor’s equipment to maintain the ATO throughout its lifecycle, shall be covered in the vendor’s post warranty maintenance offering. At a minimum, vendors must offer RMF only maintenance which shall cover only actions related to maintaining the ATO and providing continuous monitoring of the system. The Government would need to purchase the RMF maintenance on an annual basis, either individually or as part of their normal maintenance packages, in order to maintain the RMF coverage on a system. The vendor shall be required to provide RMF only maintenance option pricing or RMF coverage as part of higher level maintenance coverage, as required by the Request for Offer (RFO) or Request for Proposal (RFP), in their quote/offer, broken out by each year. This option pricing shall at a minimum be used in the evaluation/selection of vendors. The Government may choose to exercise the RMF only maintenance pricing or use the vendor’s normal maintenance offering under their contract, if it includes Cybersecurity maintenance coverage. Vendors shall be required to have RMF only maintenance coverage on their multiple award basic contract or offer it on any single award contract in order to receive an order/contract, unless they agree to provide the patching, updates, upgrades, and monitoring at no charge to the Government for six (6) years or as long as the system is commercially available, whichever is longer.

Furthermore, the vendor agrees they will offer RMF only maintenance coverage on their contract for six (6) years or as long as the system is commercially available, whichever is longer.

3. Maintenance and upgrades:

Vendors shall agree to the DHA Cybersecurity requirements as outlined in this document for all systems and medical devices, unless an exception has been granted for a system by the Government prior to award/order issuance.

B. DHA Cybersecurity/Risk Management Framework (RMF) Requirements

1. System Security Requirements

1.1. The vendor shall submit to the Government, included in the offer/quote, all sections of the

Medical Device Equipment Risk Assessment (MDERA Questionnaire), which is provided by the government. Additionally, a vulnerability assessment/report is required from a NESSUS scanner as this is the DoD standard. Vendors must provide a fully-credentialed NESSUS scan with RFO submission, and monthly Nessus scans provided by the tenth (10th) day of the month after award.

1.2. Vendor agrees to comply with security regulations and guidance listed in Appendix A:

Cybersecurity Regulations and Guidance and all RMF requirements.

1.3. Failure to meet the requirements may result in termination of the delivery order for cause, in accordance with Federal Acquisition Regulation (FAR) 52.212-4(m).

1.4. The vendor device or system shall pass pre-validation technical screening (vulnerability scans utilizing NESSUS, Security Content Automation Protocol (SCAP) scans, and Security Technical Implementation Guides (STIGs) checklists) within 6 months of contract award. All technical scans will be provided by the vendor to the Government PM for review. Vendor Medical Device and Equipment (MDE) shall pass fully credentialed screening given DHA approved template. Successful pre-validation technical screening must meet the Cybersecurity criteria listed below:

1.4.1. No unmitigated Very High or High Severity/ Category I (CAT I), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx

1.4.2. No unmitigated Moderate Severity/Category II (CAT II), vulnerabilities described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx

1.4.3. No unmitigated Very High or High Severity/ Category I (CAT I) vulnerabilities from Nessus vulnerability scans.

1.4.4. No unmitigated Moderate Severity/ Category II (CAT II) vulnerabilities from Nessus vulnerability scans.

1.5. The government will provide templates of all requested technical documentation no later than twenty (20) days from date of initial contact from the vendor. Initial response and acknowledgement from the vendor is due within ten (10) working days of delivery of the templates. The Vendor shall remit all requested technical documents to the requestor no later than one hundred and thirty (130) days from the Date of Order.

1.6. The vendor shall mitigate all Very High, High, and Moderate Severity/CAT I, and CAT II vulnerabilities discovered during the RMF Assessment process according to the associated Plan of Action & Milestone (POA&M).

1.7. The vendor shall provide a Point of Contact (POC) responsible for the cybersecurity of the vendor device or system, throughout the lifecycle of the system. The vendor shall provide Subject Matter Experts (SMEs) to support all assessments of contracted products and materials outlined in the chart in paragraph 2.

1.8. For all equipment requiring a full Independent Verification and Validation (IV&V) test, the vendor shall not make any delivery and shall not receive payment for the system until the Program Management Office (PMO) has completed a self-assessment, and the IV&V has been scheduled. IV&V cannot be scheduled until all documentation requirements, and technical requirements have been completed to the PMO’s satisfaction. Additionally, all identified POA&Ms must have been identified, and been appropriately mitigated to reduce the risk to the Government network and Protected Health Information (PHI)/Personally Identifiable Information (PII)/For Official Use Only (FOUO) data housed within the system. Delivery may take place prior to this milestone (IV&V scheduling) only if written permission is provided by the Contracting Officer.

1.9. For all equipment requiring an Assess Only certification, the vendor shall not make any delivery and shall not receive payment for the system until the PMO has completed a self-assessment, and the system has been submitted for an Assess Only ATO/APL.

Submission cannot be scheduled until all documentation requirements, and technical requirements have been completed to the PMO’s satisfaction. Additionally, all identified POA&Ms must have been identified, and been appropriately mitigated to reduce the risk to the Government network and PHI/PII/FOUO data housed within the system. The vendor must receive written confirmation from the PMO or Contracting Officer that the system has been submitted for an assess only ATO/APL and that the vendor may proceed with delivery. Delivery may take place prior to this milestone only if written permission is provided by the Contracting Officer.

http://iase.disa.mil/stigs/Pages/index.aspx http://iase.disa.mil/stigs/Pages/index.aspx

1.10. The vendor shall obtain a recommendation of ATO from a Government-appointed third party validator within twelve (12) months of contract award for technologies processed through an Assessment & Authorization (A&A). Additionally, the vendor shall obtain an authorization from a Government official to be added to an APL for systems/devices processed through an RMF Assess Only.

1.11. Prior to final acceptance and installation, the vendor shall ensure that the delivered device matches the DoD authorized configuration. The vendor shall coordinate running Nessus and SCAP scans with the site and the assigned CyberLOG Analyst to verify compliance. Any deviations will require the vendor to bring the system into compliance before final acceptance.

1.12. Pursuant to subsequent warranty period and Service Maintenance Agreements (SMAs), the vendor shall, after the issuance of an ATO or APL approval, ensure that the vendor’s device or system maintains its ATO or operating system platform and patches/updates for six (6) years or as long as the vendor commercially supports the equipment/product, whichever is longer.

The vendor shall maintain an ATO or APL approval on all equipment/product versions owned by the Defense Health Agency (DHA) and Services and originally purchased through the vendor’s contract. If a vendor cannot support the ATO or APL approval for all DHA/Service owned versions of the equipment/product, the vendor can meet this requirement by offering to provide all upgrades to the equipment/product that are required to maintain the ATO or APL approval, either at no cost to the Government or at a fixed price that is included in a RMF only maintenance offering under the vendors contract. During the period of time the vendor has a product installed on the network, the vendor shall provide all required cybersecurity patches/updates. Maintaining the RMF ATO or APL approval shall be included as part of the vendor’s warranty period. For updates/patches, executable files should be distributed by the manufacturer accordingly, or implemented by the manufacturer’s technical staff, dependent on the Service Agreement processes.

1.13. The vendor shall establish appropriate administrative and technical safeguards to ensure the confidentiality, integrity, and availability of Government data under their control.

1.14. The vendor shall notify the PMO and Contracting Officer POCs in writing with any inabilities to comply with DoD security requirements. Vendor will provide anticipated costs and timelines required to address any vulnerabilities in question.

1.15. The vendor shall contact the IA/RMF Office Representative, no later than five (5) business days after delivery order issuance or contract award, to start the process.

Failure to do so would be considered a vendor-caused delay.

1.16. The proposed system shall be Internet Protocol version 6 (IPv6) capable or the vendor shall provide a detailed project, migration or planning documentation to show when the proposed system shall be IPv6 capable.

Minimum IPv6 capabilities include:

• Conformant with the IPv6 standards profile contained in the DoD IT Standards

Registry (DISR);

• Maintaining interoperability in heterogeneous environments with IPv4;

• Commitment to upgrade as the IPv6 standard evolves;

• Availability of vendor IPv6 technical support.

1.17. The contractor shall be able to demonstrate or provide documentation to prove that their product is IPv6 capable.

2. RMF Assessment Timeframes

2.1. Required Vendor Timeframes: The Government shall complete its required actions within the following referenced timeframes but no later than one year after order/contract issuance. If the vendor has completed all required actions in a timely manner and acceptable manner while the Government experiences delays, the vendor would be given additional time for future actions corresponding to the amount of Government delay.

Vendor Requirements: Initial Draft Date Due Final Date Due Vendor to contact Gov POC dha.detrick.med-log.mbx.cyberlog@mail.mil

10 business days post award -

Hardware/Software/Architecture Documents 15 business days post award

20 business days post award

RMF Documentation Production 6 weeks post award 4 months post award

Technical Nessus Scans 1 month post award 6 months post award

Technical STIG Checklists 1 month post award 6 months post award

Technical SCAP 1 month post award 6 months post award

2.2. Required Vendor Timeframes: The Government shall complete its required actions within the following referenced timeframes but no later than one year after order/contract issuance. If the vendor has completed all required actions in a timely manner and acceptable manner while the Government experiences delays, the vendor would be given additional time for future actions corresponding to the amount of Government delay.

Government Requirements Initial Draft Date Due Final Date Due Kickoff Meeting 15 business days post award -

Security Assessment Plan Generation 20 business days post award 30 days post award

RMF Templates sent to Vendor 5 business days post vendor initial contact -

Copies of Applicable STIGs sent to Vendor 17 business days post award 30 days post award

Authorization to Operate with Conditions (ATO-C) Recommendation

ATO-C recommendation submitted to 3rd party validator 2 weeks after final documentation/technical scans received

Independent Verification and Validation (IV&V) Scheduling

Scheduling request to 3rd party validator 3 weeks after final documentation/technical scans received

2.3. Informational Overview of the RMF Process: The following diagrams provide a summary overview of the entire process to obtain approval under DHA Cybersecurity requirements. These diagrams are for informational purposes only, are not contractually binding, and subject to change without notice. Above tables contain the contractual requirements that must be met.

Note: Not all above actions occur in a sequential manner, as some actions may be worked concurrently.

3. Assessment and Authorization (A&A)

3.1. The vendor shall provide hardware/software lists, architecture drawings, and workflow drawings within fifteen (15) business days after contract award. The vendor shall submit all other RMF-required documentation for review and approval, no later than four (4) months after receipt of the templates provided by the Government.

3.2. The vendor shall obtain approval from the Government for any vendor-developed RMF policies, plans, and procedures, prior to implementation.

3.3. The vendor shall provide any additional documentation required by the Government for completion of the A&A process within thirty (30) business days of a request by the Government.

3.4. The vendor shall provide technical scans within one (1) month of the A&A kickoff meeting.

3.5. The vendor shall provide updated technical scans on a monthly basis, on the 10th day of each month until an ATO is granted or the product is added to the APL.

3.6. In accordance with DoD 8582.01 Security of Unclassified DoD Information on Non-DoD Information Systems, incorporating Change 1, October 27, 2017 Section 2.0 INFORMATION SAFEGUARDS, the vendor shall ensure that the selected MDE is capable of supporting the use of DISA approved intrusion detection and prevention, antivirus, and anti-malware applications that are approved at the time of the ATO or APL issuance. The vendor device or system must be configured in such a way that allows the updating of malware definition signatures on a scheduled basis. Scanning shall encompass the entire system (file system, operating system, and real-time processes) by default. In cases where scanning of the entire system may negatively affect its operation, the vendor shall provide a detailed list of exclusions with justifications. The vendor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support either the full security suite or the individual components (e.g.

Data Loss Prevention (DLP), Intrusion Prevention System (IPS), Antivirus, etc.) without performance degradation of the vendor device or system. In cases where the operation of security applications are not technically achievable, the vendor shall provide detailed justification and a POA&M describing steps towards compliance with this requirement.

4. Privileged User Training and Certification Requirements

4.1. If a vendor requires a Business-To-Business (B2B), access, etc. to government networks to maintain, analyze, etc., their equipment/product, they must adhere to the following requirements:

4.2. Information Assurance Contractor Training and Certification. Contractors requiring a privileged-level account for administrative/maintenance support of systems/applications on the DHA network will meet DHA requirements for a privileged-level account before being granted a network account. Requirements include:

4.2.1. Cyber (Information assurance (IA)/information technology (IT)) certification. Per

DoD 8570.01-M and DFARS 252.239.7001, the contractor employees supporting Cyber (IA/IT) functions shall be appropriately certified upon contract award. Contractors will be defined at Information Assurance Technical level I (IAT Level I) and be required to meet minimum Professional Baseline certifications at the time of the contract award. Contractors will be given six (6) months to meet Computer Environment (CE) and Cyber Security Fundamental training requirements. Not meeting the requirements in accordance with DoD 8570.01-M will result in the contractor account and access being ‘Disabled’ or ‘Deleted’ until such time as the conditions of this contract are met.

4.2.2. Background Investigation. National Agency Check with Local Agency Check and Credit Checks (NACLC) or above is required.

4.2.3. Professional Baseline Certification. The minimum Professional Baseline certification for IAT-II are: CCNA Security, CompTIA Cyber Security+. Higher certifications (GSCL, CISM, CISSP, etc.) will satisfy this requirement.

4.2.4. Computer Environment (CE) Certification. The CE certifications are determined by the role of the contractor and must be met within six (6) months of delivery order issuance in accordance with DoD 8570.01-M.

4.2.5. Two-Factor Authentication. Contractors will authenticate using two-factor authentication. The only method for authenticating is the Common Access Card

(CAC).

4.2.6. Network Account Request Package (Authorized & Privileged). The contractor will submit a request package through either the facility Provost Marshall Office in conjunction with the facility Information Management Department (for contractors requiring on-site access), or through the Information Assurance/Cyber Security Branch (for contractors requiring remote access to a DHA network). Remote access must be through a DISA B2B solution.

4.2.7. The CYBERSECURITY Training. DoD Cyber Awareness Challenge Training must be completed by all contractor employees and associated sub-contractor employees prior to issuance of network access and annually thereafter. DoD Cyber Awareness Challenge Training is available at the following website:

https://iase.disa.mil/eta/Pages/online-catalog.aspx

4.2.8. Personally Identifiable Information Training (PII). DoD PII Training must be completed by all contractor employees and associated sub-contractor employees prior to issuance of network access and annually thereafter. DoD PII Training is available at the following website:

https://iase.disa.mil/eta/Pages/index.aspx

4.2.9. Health Insurance Portability and Accountability Act (HIPAA) Training. DoD

HIPAA Training must be completed by all contractor employees and associated sub-contractor employees prior to issuance of network access and annually thereafter. DoD HIPAA Training is available at the following website:

https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf?ORG=MHS

4.2.10. Acceptable Use Policy (AUP). All vendors/contractors will sign/acknowledge the

DHA Standard Acceptable Use Policy (AUP) prior to being granted a DHA network account. The DHA Standard AUP is available at the following website:

https://health.mil/Reference-Center/Policies?query=Acceptable%20Use

5. Warranty and Post-Warranty Service Maintenance Agreement Cybersecurity

Requirements/Continuous Monitoring/Risk Management.

5.1. Using a test/laboratory environment, the vendor shall be able to duplicate all fielded equipment/product that falls under the authorization boundary. The vendor shall ensure that all fielded equipment/product falling under one authorization is tested to maintain the ATO or approved products for as long as the vendor commercially supports the equipment/product. For each version owned by DHA and originally purchased through the vendor’s contract, the vendor will ensure that each component within the authorization boundary is represented in the test group.

5.2. The vendor shall update all ATO or approved products required supporting documentation in the event of a system policy, procedural, logical or technical changes to the system or device.

5.3. The vendor shall maintain the authorized security configuration and notify the government within forty eight (48) hours of any changes for review. A major upgrade such as major software or hardware revision must be reassessed for ATO or addition to the approved products list. Minor upgrades must be assessed by the Government to determine if a reauthorization is required. The Vendor shall support reauthorizations due to both major and minor upgrades.

https://iase.disa.mil/eta/Pages/online-catalog.aspx https://iase.disa.mil/eta/Pages/index.aspx https://health.mil/Reference-Center/Policies?query=Acceptable%20Use

5.4. The vendor shall ensure the vendor’s device or system is in compliance with the Department of Defense (DoD) Information Assurance Vulnerability Management (IAVM) program upon each deployment.

5.5. The vendor shall ensure any new deployment (including rebuilds) deploys with a fully-patched, accredited version.

5.6. The vendor shall maintain the system or device and update to comply with updated

STIGs made available by the Government within three (3) months of notification by the Government.

5.7. The vendor shall provide vulnerability and configuration scan results to the Government on a monthly basis. The vendor shall provide raw scan results and administrative reports no later than the tenth (10th) calendar day of each month.

5.8. The vendor shall close all discovered vulnerabilities within three (3) months of discovery, or provide a POA&M describing how they will work to close the vulnerability.

5.9. The vendor shall submit to the Government for approval, all mitigation plans that addresses any open vulnerabilities.

5.10. The vendor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to the Government for approval.

5.11. The vendor shall use the Government-approved method for remote access administration (DISA B2B) of the system or device.

Appendix A: Cybersecurity Regulations and Guidance

1) Cybersecurity Regulations and Guidance

The vendor shall use and comply with the most recent published versions of the following references, as well as all regulations or guidance referenced within those publications:

(a) United States Law

(i) The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

(ii) The Federal Information Security Management Act (FISMA)

(iii) The E-Government Act of 2002

(b) Office of Management and Budget (OMB)

The following publications are located at https://www.whitehouse.gov/omb/agency/default

(i) Circular A-130

(ii) Guidance M-05-24, Implementation of Homeland Security Presidential Directive

(HSPD) 12-Policy for a Common Identification Standard for Federal Employees and Vendors

(c) National Institute of Standards and Technology (NIST) The following publications are located at http://www.nist.gov/publication-portal.cfm

(i) NIST Special Publication (SP) 800-37 – Guide for Applying the Risk

Management Framework (RMF) to Federal Information Systems

(ii) NIST SP 800-39—Managing Information Security Risk: Organization, Mission and Information System View

(iii) NIST SP 800-53 – Security and Privacy Controls for Federal Information

Systems and Organizations

(iv) NIST SP 800-60—Volume 1 Revision 1: Guide for Mapping Types of

Information and Information Systems to Security Categories

(d) Federal Information Processing Standards (FIPS) The following publications are located at http://www.nist.gov/itl/fipscurrent.cfm

(i) FIPS Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic

Modules

(ii) FIPS PUB 199 – Standards for Security Categorization of Federal Information and Information Systems

(iii) FIPS PUB 200: Minimum Security Requirements for Federal Information and

Information Systems

(iv) FIPS PUB 201-2, Personal Identity Verification of Federal Employees and

Vendors

(e) Department of Defense (DoD) The following publications are located at http://www.dtic.mil/whs/directives/

(i) DoD Instruction 5200.2, DoD Personnel Security Program (PSP)

(ii) DoD Instruction 8500.1, Cybersecurity

(iii) DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK)

Enabling

(iv) DoD Instruction 8510.01, Risk Management Framework Process (RMF)

(v) DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM)

(vi) DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs

(vii) DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in DoD Health Care Programs https://www.whitehouse.gov/omb/agency/default http://www.nist.gov/publication-portal.cfm http://www.nist.gov/itl/fipscurrent.cfm http://www.dtic.mil/whs/directives/

(viii) DoD Directive 5400.11, DoD Privacy Program

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 2 Each

CIRCULATORY ASSIST UNITS, CARDIAC, INTRA

FFP

CIRCULATORY ASSIST UNITS, CARDIAC, INTRA-AORTIC BALLOON at

NMC SAN DIEGO

FOB: Destination

PSC CD: 6515

NET AMT

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 01-JUN-2020 2 BRANCH MEDICAL CLINIC 32ND STREET

RECEIVING OFFICER

2450 CRAVEN STREET

SAN DIEGO CA 92136

619-532-9945 FOB: Destination

N00259

CLAUSES INCORPORATED BY REFERENCE

52.203-3 Gratuities APR 1984 52.204-2 Security Requirements AUG 1996 52.204-7 System for Award Management OCT 2018 52.204-13 System for Award Management Maintenance OCT 2018 52.204-16 Commercial and Government Entity Code Reporting JUL 2016 52.204-18 Commercial and Government Entity Code Maintenance JUL 2016 52.204-19 Incorporation by Reference of Representations and

Certifications.

DEC 2014

52.204-21 Basic Safeguarding of Covered Contractor Information Systems

JUN 2016

52.209-11 Representation by Corporations Regarding Delinquent Tax Liability or a Felony Conviction under any Federal Law

FEB 2016

52.212-4 Contract Terms and Conditions--Commercial Items OCT 2018 52.232-39 Unenforceability of Unauthorized Obligations JUN 2013 52.232-40 Providing Accelerated Payments to Small Business

Subcontractors

DEC 2013

52.242-15 Stop-Work Order AUG 1989 52.247-34 F.O.B. Destination NOV 1991 252.203-7000 Requirements Relating to Compensation of Former DoD

Officials

SEP 2011

252.203-7002 Requirement to Inform Employees of Whistleblower Rights SEP 2013 252.204-7003 Control Of Government Personnel Work Product APR 1992 252.204-7015 Notice of Authorized Disclosure of Information for Litigation

Support

MAY 2016

252.225-7001 Buy American And Balance Of Payments Program-- Basic DEC 2017 252.225-7012 Preference For Certain Domestic Commodities DEC 2017 252.225-7048 Export-Controlled Items JUN 2013 252.232-7003 Electronic Submission of Payment Requests and Receiving

Reports

DEC 2018

252.232-7010 Levies on Contract Payments DEC 2006 252.243-7001 Pricing Of Contract Modifications DEC 1991 252.244-7000 Subcontracts for Commercial Items JUN 2013

CLAUSES INCORPORATED BY FULL TEXT

52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR

EXECUTIVE ORDERS--COMMERCIAL ITEMS (JAN 2020)

(a) The Contractor shall comply with the following Federal Acquisition Regulation (FAR) clauses, which are incorporated in this contract by reference, to implement provisions of law or Executive orders applicable to acquisitions of commercial items:

(1) 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements (JAN 2017) (section 743 of Division E, Title VII, of the Consolidated and Further Continuing Appropriations Act, 2015 (Pub. L.

113-235) and its successor provisions in subsequent appropriations acts (and as extended in continuing resolutions)).

(2) 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities (Jul 2018) (Section 1634 of Pub. L. 115-91).

(3) 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. (AUG 2019) (Section 889(a)(1)(A) of Pub. L. 115-232).

(4) 52.209-10, Prohibition on Contracting with Inverted Domestic Corporations (Nov 2015).

(5) 52.233-3, Protest After Award (AUG 1996) (31 U.S.C. 3553).

(6) 52.233-4, Applicable Law for Breach of Contract Claim (OCT 2004) (Public Laws 108-77 and 108-78 (19 U.S.C. 3805 note)).

(b) The Contractor shall comply with the FAR clauses in this paragraph (b) that the Contracting Officer has indicated as being incorporated in this contract by reference to implement provisions of law or Executive orders applicable to acquisitions of commercial items: (Contracting Officer check as appropriate.)

XX (1) 52.203-6, Restrictions on Subcontractor Sales to the Government (Sept 2006), with Alternate I (Oct 1995) (41 U.S.C. 4704 and 10 U.S.C. 2402).

____ (2) 52.203-13, Contractor Code of Business Ethics and Conduct (Oct 2015) (41 U.S.C. 3509).

____ (3) 52.203-15, Whistleblower Protections under the American Recovery and Reinvestment Act of 2009 (June 2010) (Section 1553 of Pub. L. 111-5). (Applies to contracts funded by the American Recovery and Reinvestment Act of 2009.)

XX (4) 52.204-10, Reporting Executive Compensation and First-Tier Subcontract Awards (Oct 2018) (Pub. L. 109-

282) (31 U.S.C. 6101 note).

___ (5) [Reserved]

___ (6) 52.204-14, Service Contract Reporting Requirements (Oct 2016) (Pub. L. 111-117, section 743 of Div.

C).

___ (7) 52.204-15, Service Contract Reporting Requirements for Indefinite-Delivery Contracts (Oct 2016) (Pub.

L. 111-117, section 743 of Div. C).

XX (8) 52.209-6, Protecting the Government's Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment. (Oct 2015) (31 U.S.C. 6101 note).

XX (9) 52.209-9, Updates of Publicly Available Information Regarding Responsibility Matters (Oct 2018) (41 U.S.C. 2313).

____ (10) [Reserved]

____ (11)(i) 52.219-3, Notice of HUBZone Set-Aside or Sole-Source Award (NOV 2011) (15 U.S.C. 657a).

____ (ii) Alternate I (NOV 2011) of 52.219-3.

____ (12) (i) 52.219-4, Notice of Price Evaluation Preference for HUBZone Small Business Concerns (OCT 2014) (if the offeror elects to waive the preference, it shall so indicate in its offer) (15 U.S.C. 657a).

____ (ii) Alternate I (JAN 2011) of 52.219-4.

____ (13) [Reserved]

____ (14)(i) 52.219-6, Notice of Total Small Business Set-Aside (NOV 2011) (15 U.S.C. 644).

____ (ii) Alternate I (NOV 2011).

____ (iii) Alternate II (NOV 2011).

____ (15)(i) 52.219-7, Notice of Partial Small Business Set-Aside (June 2003) (15 U.S.C. 644).

____ (ii) Alternate I (Oct 1995) of 52.219-7.

____ (iii) Alternate II (Mar 2004) of 52.219-7.

____ (16) 52.219-8, Utilization of Small Business Concerns (Oct 2018) (15 U.S.C. 637(d)(2) and (3)).

____ (17)(i) 52.219-9, Small Business Subcontracting Plan (Aug 2018) (15 U.S.C. 637(d)(4)).

____ (ii) Alternate I (Nov 2016) of 52.219-9.

____ (iii) Alternate II (Nov 2016) of 52.219-9.

____ (iv) Alternate III (Nov 2016) of 52.219-9.

____ (v) Alternate IV (Aug 2018) of 52.219-9.

____ (18) 52.219-13, Notice of Set-Aside of Orders (NOV 2011) (15 U.S.C. 644(r)).

____ (19) 52.219-14, Limitations on Subcontracting (JAN 2017) (15 U.S.C. 637(a)(14)).

____ (20) 52.219-16, Liquidated Damages—Subcontracting Plan (Jan 1999) (15 U.S.C. 637(d)(4)(F)(i)).

____ (21) 52.219-27, Notice of Service-Disabled Veteran-Owned Small Business Set-Aside (OCT 2019) (15 U.S.C.

657f).

____ (22) 52.219-28, Post Award Small Business Program Rerepresentation (July 2013) (15 U.S.C. 632(a)(2)).

____ (23) 52.219-29, Notice of Set-Aside for, or Sole Source Award to, Economically Disadvantaged Women- Owned Small Business Concerns (Dec 2015) (15 U.S.C. 637(m)).

____(24) 52.219-30, Notice of Set-Aside for, or Sole Source Award to, Women-Owned Small Business Concerns Eligible Under the Women-Owned Small Business Program (Dec 2015) (15 U.S.C. 637(m)).

XX (25) 52.222-3, Convict Labor (June 2003) (E.O. 11755).

XX (26) 52.222-19, Child Labor--Cooperation with Authorities and Remedies (Jan 2020) (E.O. 13126).

XX (27) 52.222-21, Prohibition of Segregated Facilities (Apr 2015).

XX (28)(i) 52.222-26, Equal Opportunity (SEPT 2016) (E.O. 11246).

____ (ii) Alternate I (Feb 1999) of 52.222-26.

XX (29)(i) 52.222-35, Equal Opportunity for Veterans (OCT 2015)(38 U.S.C. 4212).

____ (ii) Alternate I (July 2014) of 52.222-35.

XX (30)(i) 52.222-36, Equal Opportunity for Workers with Disabilities (JUL 2014) (29 U.S.C. 793).

____ (ii) Alternate I (July 2014) of 52.222-36.

XX (31) 52.222-37,…