Combined Synopsis Solicitation HT941026Q2004.pdf

NOTICE TO CONTRACTOR

This is a combined synopsis/solicitation for commercial products or commercial services prepared in accordance with FAR Part 12. This announcement constitutes the only solicitation. Quotes are being requested, and a separate written solicitation will not be issued. Solicitation Number

HT941026Q2004 is issued as a Request for Quotation (RFQ). This solicitation incorporates provisions and clauses by reference. The full text of provisions and clauses may be accessed electronically at www.acquisition.gov. The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular (FAC) 2026-01 effective 03/13/2026 and Defense Federal

Acquisition Regulation Supplement (DFARS) change 11/10/2025. The North American Industry

Classification System (NAICS) Code for this acquisition is 334516 – Analytical Laboratory Instrument

Manufacturing. The size standard is 1000 employees. The Product and Service Code (PSC) for this requirement is 6550 – In-Vitro Diagnostic Substances, Reagents, Test Kits and Sets. This acquisition is not set-aside for small business concerns. This is an unrestricted procurement, inviting full and open competition. It is the responsibility of the contractor to be familiar with the applicable clauses and provisions.

The requirement is for a cost per reportable result (CPRR) contract for coagulation analyzers to support the following military treatment facilities (MTFs) and their workloads as indicated:

MTF

Current

Analyzer

Quantity Test Type

Total Tests/

Year

Pacif Rim Network

Naval Hospital Camp Pendleton, CA 2 PT, aPTT, D-Dimer, Fibrinogen 3,710

Naval Hospital Bremerton, WA 1 PT, Partial Thromboplastin Time (PTT), Fibrinogen, D-

Dimer 741 Robert E. Bush Naval Hospital

Twentynine Palms, CA 2 PT/INR, aPTT, D-Dimer, Fibrinogen

2,700

Naval Medical Center San Diego, CA - Core Lab

PT, Partial Thromboplastin Time (PTT), Fibrinogen, D-

Dimer, Heparin, Factor VIII 28,873 Indo Pacific Network

Madigan Army Medical Center, Joint

Base Lewis-McChord, WA

PT, aPTT, Fibrinogen, D-Dimer, Lupus Anticoagulant, Factor VIII Assay, DIC Panel, Heparin (Low Molecular

Weight), Patient Thrombin Time, Patient Thrombin

Time, Mixing Studies, Reptilase Time, Factor V Assay, Factor VII Assay, Factor VIII Assay, Factor IX Assay, Factor X Assay, Factor XI Assay 25,695

Tripler Army Medical Center, Fort

Shafter, HI

PT, APTT, Fibrinogen, D-Dimer, Factor VIII Assay, Patient Thrombin Time, Mixing Studies, Factor V

Assay, Factor VII Assay, Factor IX Assay, Factor X

Assay, Factor XI Assay, Antithrombin III, Von

Willebrand Factor Antigen, Factor II Assay 12,603

Continental Network

99th Medical Group, Mike

O'Callaghan Military Medical

Center, Nellis AFB, NV

PT, Partial Thromboplastin Time (PTT), Fibrinogen, D-

Dimer, Heperin 15,694

Central Network

60th Medical Group, David Grant

Medical Center, Travis AFB, CA

PT, Partial Thromboplastin Time (PTT), Fibrinogen, D-

Dimer, Heperin 9,276

673rd Medical Group, Joint Base

Elmendorf-Richardson (JBER), AK 1 aPTT, D-Dimer, Fibrinogen

3,216 56th Medical Group, Luke AFB, AZ 1 PT, APTT 729 West Network

Weed Army Community Hospital, Fort Irwin, CA

PT, Partial Thromboplastin Time (PTT), Fibrinogen, D-

Dimer, INR 1,200

Totals: 18 104,437

FOB Destination: The supplier is responsible for the performance of all inspection requirements and quality control.

DEFENSE BIOMETRIC IDENTIFICATION SYSTEM (DBIDS)

a. DBIDS is the current system for access control verification and management for the Department of Defense (DoD).

b. DBIDS guidance for Vendors/Contractors to obtain a pass is accessible through the following website: https://www.cnic.navy.mil/Operations-and-Management/Base-Support/DBIDS/

c. For more information or to enroll in the DBIDS Program, call: 1 (202) 433-4784. Multiple locations are included on this contract. Please coordinate with Contracting Officer upon award.

d. Pre-enrolling will help expedite your processing time. To pre-enroll for a DBIDS card, visit the following website: https://dbids-global-enroll.dmdc.mil/preenrollui/

e. Vendors, contractors, suppliers, and other service providers shall present their pass upon entry at the entry control point (ECP).

The provisions and clauses applicable to this Request for Quote, and therefore, applicable to a resultant award, are listed below. In accordance with FAR 52.102 the provisions and clauses are incorporated by reference to the maximum practical extent, rather than being incorporated in full text:

This acquisition incorporates by reference the following Revolutionary FAR Overhaul (RFO) Provisions and Clauses:

52.202-1 Definitions (Jun 2020)

52.203-3 Gratuities (Apr 1984

52.203-12 Limitation on Payments to Influence Certain Federal Transactions (Jun 2020)

52.204-7 System for Award Management (DEVIATION 2025-O0038) (FEB 2026)

52.204-9 Personal Identity Verification of Contractor Personnel (Jan 2011)

52.204-13 System for Award Management Maintenance (DEVIATION 2025-O0038) (FEB 2026)

52.204-18 Commercial and Government Entity Code Maintenance (Aug 2020)

52.212-4 Contract Terms and Conditions—Commercial Products and Commercial

Services (DEVIATION 2025-O0038) (FEB 2026)

52.217-5 Evaluation of Options (DEVIATION 2026-O0038) (Feb 2026)

52.222-90 Addressing DEI Discrimination by Federal Contractors (Apr 2026)

52.232-18 Availability of Funds (Apr 1984)

52.232-39 Unenforceability of Unauthorized Obligations (Jun 2013)

52.237-2 Protection of Government Buildings, Equipment, and Vegetation (Apr 1984)

52.247-34 F.O.B. Destination (Jan 1991)

The following additional DFARS Provisions and Clauses applicable to this acquisition are incorporated by reference:

252.203-7000 Requirements Relating to Compensation of Former DoD Officials (Sep 2011) https://www.cnic.navy.mil/Operations-and-Management/Base-Support/DBIDS/ https://dbids-global-enroll.dmdc.mil/preenrollui/

252.203-7002 Requirement to Inform Employees of Whistleblower Rights (Dec 2022)

252.203-7005 Representation Relating to Compensation of Former DoD Officials (Sep 2022)

252.204-7003 Control of Government Personnel Work Product (Apr 1992)

252.204-7004 Antiterrorism Awareness Training for Contractors (Jan 2023)

252.204-7015 Notice of Authorized Disclosure of Information for Litigation Support (Jan 2023)

252.204-7016 Covered Defense Telecommunications Equipment or Services—Representation

(Dec 2019)

252.204-7017 Prohibition on the Acquisition of Covered Defense Telecommunications

Equipment or Services—Representation (May 2021)

252.204-7022 Expediting Contract Closeout (May 2021)

252.204-7024 Notice on the Use of the Supplier Performance Risk System (Mar 2023)

252.209-7004 Subcontracting with Firms that are Owned or Controlled by the Government of a Country that is a State Sponsor of Terrorism (May 2019)

252.211-7003 Item Unique Identification and Valuation (Jan 2023)

252.211-7008 Use of Government-Assigned Serial Numbers (Sep 2010)

252.215-7007 Notice of Intent to Resolicit (Jun 2012)

252.215-7008 Only One Offer (Dec 2022)

252.223-7008 Prohibition of Hexavalent Chromium (Jan 2023)

252.225-7001 Buy American and Balance of Payments Program—Basic (Feb 2024)

252.225-7002 Qualifying Country Sources as Subcontractors (Mar 2022)

252.225-7012 Preference for Certain Domestic Commodities (Apr 2022)

252.225-7021 Trade Agreements—Basic (Feb 2024)

252.225-7036 Buy American—Free Trade Agreements—Balance of Payments Program—Basic (Feb

252.225-7048 Export-Controlled Items (Jun 2013)

252.225-7052 Restriction on the Acquisition of Certain Magnets, Tantalum, and Tungsten (May 2024)

252.225-7055 Representation Regarding Business Operations with the Maduro Regime (May 2022)

252.225-7056 Prohibition Regarding Business Operations with the Maduro Regime (Jan 2023)

252.225-7059 Prohibition on Certain Procurements from the Xinjiang Uyghur Autonomous Region–

Representation (Jun 2023)

252.225-7060 Prohibition on Certain Procurements from the Xinjiang Uyghur Autonomous Region

(Jun 2023)

252.225-7966 Prohibition Regarding Russian Fossil Fuel Business Operations—Representation

(DEVIATION 2024-O0006, Revision 1) (Mar 2024)

252.225-7967 Prohibition Regarding Russian Fossil Fuel Business Operations (DEVIATION 2024-

O0006, Revision 1) (Feb 2024)

252.226-7001 Utilization of Indian Organizations, Indian-Owned Economic Enterprises, and Native

Hawaiian Small Business Concerns (Jan 2023)

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports (Dec 2018)

252.232-7010 Levies on Contract Payments (Dec 2006)

252.239-7098 Prohibition on Contracting to Maintain or Establish a Computer Network Unless Such

Network is Designed to Block Access to Certain Websites—Representation

(DEVIATION 2021-O0003) (Apr 2021)

252.243-7002 Requests for Equitable Adjustment (Dec 2022)

252.244-7000 Subcontracts for Commercial Products or Commercial Services (Nov 2023)

252.247-7023 Transportation of Supplies by Sea—Basic (Oct 2024)

The following RFO Provisions and Clauses incorporated by full text apply to this acquisition:

52.212-1 INSTRUCTIONS TO OFFERORS—COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (DEVIATION 2025-O0038) (FEB 2026)

(a) Submission of offers. Submit signed and dated offers to the office specified in this solicitation at or before the exact time specified in this solicitation. As a minimum, offers shall include—

(1) The solicitation number;

(2) The name, address, telephone number of the Offeror;

(3) The Offeror’s Unique Entity Identifier (UEI) and, if applicable, Electronic Funds Transfer

(EFT) indicator;

(4) Information necessary to evaluate the factors contained in the provision at 52.212-2 or as described in the solicitation;

(5) Responses to provisions that require Offeror completion of information, representations, and certifications (other than those collected via the System for Award Management (SAM)); and

(6) A statement specifying the extent of agreement with all terms, conditions, and provisions included in the solicitation and any solicitation amendments.

(b) Period for acceptance of offers. The Offeror agrees to hold the prices in its offer firm for 60 calendar days from the date specified for receipt of offers, unless another time period is specified in an addendum to the solicitation.

(c) Late submissions, modifications, revisions, and withdrawals of offers.

(1) Offerors are responsible for submitting offers and any modifications or revisions to the Government office designated in the solicitation by the time specified in the solicitation.

(2) Any offer, modification, or revision received after the time specified for receipt of offers is “late” and will not be considered unless it is received before award is made and the Contracting

Officer determines that accepting the late offer would not unduly delay the acquisition. However, a late modification of an otherwise successful offer that makes its terms more favorable to the Government will be considered at any time it is received and may be accepted.

(3) If an emergency or unanticipated event interrupts normal Government processes so that offers cannot be received at the Government office designated for receipt of offers by the exact time specified in the solicitation, and urgent Government requirements preclude amendment of the solicitation or other notice of an extension of the closing date, the time specified for receipt of offers will be deemed to be extended to the same time of day specified in the solicitation on the first work day on which normal Government processes resume.

(4) Offerors may withdraw their offers by written notice to the Government received at any time before award.

(d) Contract award (not applicable to Invitation for Bids). The Government intends to evaluate offers and award a contract without discussions with Offerors. Therefore, the Offeror’s initial offer should contain the Offeror’s best terms. However, the Government reserves the right to conduct discussions, if necessary. The Government may reject any or all offers if such action is in the public interest, accept other than the lowest offer, and waive informalities and minor irregularities in offers received.

(e) Debriefings. If a postaward debriefing is given to requesting Offerors, the Government will disclose the following information, if applicable:

(1) The agency’s evaluation of the significant weak or deficient factors in the debriefed Offeror’s offer.

(2) The overall evaluated cost or price and technical rating of the successful Offeror and the debriefed

Offeror and past performance information on the debriefed Offeror.

(3) The overall ranking of all Offerors when any ranking was developed by the agency during source selection.

(4) A summary of the rationale for award.

(5) For acquisitions of commercial products, the make and model of the product to be delivered by the successful Offeror.

(6) Reasonable responses to relevant questions posed by the debriefed Offeror as to whether the agency followed source-selection procedures set forth in the solicitation, applicable regulations, and other applicable authorities.

Addendum to FAR 52.212-1, Instructions to Offerors—Commercial Products and Commercial Services

The following is inserted as new paragraph (m) of the provision:

(f) QUOTER INSTRUCTIONS

The Government intends to award a firm-fixed-price (FFP) contract resulting from this RFQ to the responsible Quoter, whose quote conforms to the solicitation and is the most advantageous (best value) to the Government, price and other factors considered as defined in the EVALUATION FACTORS FOR

AWARD section below. The Government will review the quotes received to determine if they are compliant with the RFQ requirements. A compliant quote is one that meets all of the terms, conditions, and specifications in the RFQ. The Quoter must provide all documents listed and comply with all RFQ instructions in order for their quote to be considered “compliant” with this RFQ. Only compliant quotes will be evaluated for award.

Quoter shall be an original equipment manufacturer (OEM), authorized dealer, authorized distributor, authorized reseller, or authorized service provider for the proposed medical supplies, medical equipment, and/or services contracts for maintenance of medical equipment (i.e., replacement parts), verified by an authorization letter or other document(s) from the OEM, such that the OEM’s warranty and service are provided and maintained by the OEM. All software licensing, warranty, and service associated with the medical supplies, medical equipment, and/or services contracts for maintenance of medical equipment shall be in accordance with the OEM terms and conditions.

All questions regarding the RFQ, of a contractual or technical nature, must be submitted electronically by email to bobbie.s.dobberstein.ctr@health.mil and cha-on.p.gordon2.civ@health.mil no later than 1300 p.m. Pacific on Thursday, 19 May 15, 2026. Questions submitted after the specified date and time may not receive a response. Questions, along with the Government’s responses, will be posted as an attachment to the RFQ.

Please be advised that the Government reserves the right to transmit those questions and answers of a common interest to all prospective Quoters.

mailto:bobbie.s.dobberstein.ctr@health.mil mailto:cha-on.p.gordon2.civ@health.mil

Electronic Submission of Quotes: Quotations shall be submitted electronically via email to bobbie.s.dobberstein.ctr@health.mil and cc cha-on.p.gordon2.civ@health.mil.

Factor 1: Technical

The Quoter shall complete and submit Attachment 2 (Technical Submission Form). Responses shall clearly explain and demonstrate the design quality and capabilities of the proposed solution to perform coagulation testing and meet all requirements outlined in the SOW. Attachment 2 (Technical Submission

Form) shall reference (including page & paragraph number) any substantiating documentation submitted by the Quoter as necessary to provide clear explanation and demonstration as required.

Factor 2: Past Performance

The Government will evaluate the Quoter’s record of RECENT and RELEVANT performance in the

Supplier Performance Risk System (SPRS) and the Contractor Performance Assessment Reporting

System (CPARS) to determine the Quoter’s probability of successfully delivering the supplies required in this solicitation as scheduled.

RECENT is defined as supplies delivered within the past three (3) years from the date of issuance of this

RFQ. RELEVANT is defined as supplies the same as or similar to the supplies specified in the Statement of Work (SOW). Past Performance information not meeting the above criteria will not be used for evaluation.

Factor 3: Information Assurance.

The Quoter shall submit a completed CyberLOG-ICS Medical Device and Equipment Risk Assessment

(MDERA) Questionnaire (SOW Enclosure B – CyberLOG-ICS Combined MDERA v6.4.1) for each offered system along with its quote. This includes any third-party vendor items.

Factor 4: Price

The Quoter shall use Attachment 3 (Quote Sheet) to submit a firm-fixed-price for all contract line item numbers (CLINs) identified. The Quoter shall submit a separate Pricing List of the CPRR reagents, controls, and consumables for the required testing. Attachment 3 (Quote Sheet) and Pricing List shall be completed and signed, with acknowledgment of all amendments to the solicitation. Quoters are not authorized to reformat or remove cells is authorized. Submission of pricing data shall be complete and accurate. Incomplete pricing may result in a Quoter’s quotation being deemed ineligible for award.

LATE SUBMISSIONS MAY NOT BE CONSIDERED.

It is a Quoter’s responsibility, when transmitting its quote electronically, to ensure the quote’s timely delivery by transmitting the quote sufficiently in advance of the time set for receipt of quotes to allow for timely receipt by the Government no later than the date and time stated in this RFQ. Quoters shall allow adequate time to upload files, which may be slower for non-DoD users, and to avoid other technical difficulties that may be encountered. A Quoter risks the late receipt and rejection of a quote where it delays transmitting its quote until the last few minutes before the time set for receipt of quotes. Quotes that are received after the date and time stated in this RFQ will not be considered except at the discretion of the Contracting Officer; the Contracting Officer reserves full discretion to accept any late quotes at any time prior to award if it serves the best interest of the Government.

Quoters are responsible for submitting their quote in the format specified, consistent with requirements stated elsewhere in this RFQ. Quoters are asked to submit only the information required.

Files that cannot be opened or are otherwise missing the required content are the responsibility of the

Quoters. Submissions that do not adhere to format and content requirements may be considered non-mailto:bobbie.s.dobberstein.ctr@health.mil mailto:cha-on.p.gordon2.civ@health.mil compliant. The Government reserves the right to eliminate any such quotes from consideration for award.

Quotations must be received no later than 1:00 p.m. Pacific on Tuesday, June 2, 2026.

(End of provision)

52.212-2 EVALUATION—COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES

(DEVIATION 2025-O0038) (FEB 2026)

The Government will award a contract resulting from this solicitation to the responsible Offeror whose offer conforming to the solicitation will be most advantageous to the Government, price and other factors considered. The following factors will be used to evaluate offers:

1. FACTOR 1 Technical

2. FACTOR 2 Past Performance

3. FACTOR 3 Information Assurance

4. FACTOR 4 Price

(b) Options (if applicable). The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced. The evaluation of options does not obligate the Government to exercise the option(s).

(c) Notice of award. A written notice of award or acceptance of an offer furnished to the successful

Offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. Before the offer’s specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

Addendum to FAR 52.212-2, Evaluation—Commercial Products and Commercial Services

The following is inserted as new paragraph (d) of the provision:

(d) EVALUATION FACTORS FOR AWARD

Quoters rated Unacceptable for Factor 1 (Technical) or Factor 3 (Information Assurance) will not be further considered for award. Quoters rated Limited Confidence or No Confidence in Factor 2 (Past

Performance) will not be further considered for award. Factors 1 (Technical) and 2 (Past Performance) are considered approximately equal in importance, and when combined, will be more important than Factor 3

(Information Assurance). Non-price Factors 1 (Technical), 2 (Past Performance), and 3 (Information

Assurance), when combined, will be more important than Factor 4 (Price).

Contract award shall be made on a “Best Value Tradeoff” basis. This process allows for a tradeoff between price and non-price factors and allows the Government to accept other than the lowest priced quote or other than the highest rated quote to achieve a best-value contract award. This may result in an award to a higher-rated, higher-priced quote if the Government determines that the non-price proposal of the higher-priced quote outweighs the price difference. The selection process is subjective by nature and professional judgment is implicit throughout the tradeoff process. Quoter providing a quote that is deemed most advantageous to the Government by trading off the non-price factors [Factor 1

(Technical), Factor 2 (Past Performance), and Factor 3 (Information Assurance)] against

Factor 4 (Price).

The Government intends to award based on initial quotes. Notwithstanding this intent, the Contracting

Officer reserves the right to communicate with Offerors if it is within the best interest of the Government, a matter within their discretion.

Certified cost or pricing data is not required for commercial acquisitions or for acquisitions at or below the simplified acquisition threshold. However, if only one quote is received, other than certified cost or pricing data may be required.

EVALUATION

Factor 1: Technical

The Government will evaluate the design quality and capabilities of the proposed solutions to perform coagulation testing and meet all requirements outlined in the SOW. Quoters not meeting all requirements will not be further considered for award unless there are no other technically acceptable Quoters. Ratings for this factor will be assigned according to the following rating scale:

Rating Description

Acceptable The quote demonstrates an adequate approach and understanding. Risk of unsuccessful performance is acceptable.

Unacceptable The quote does not meet requirements of the solicitation, and thus contains one or more deficiencies, and/or risk of unsuccessful performance is unacceptable.

Factor 2: Past Performance

Past Performance is defined as the Quoter’s ability to deliver supplies as scheduled. The Government will evaluate the information from the references provided and the Quoter’s record of RECENT and

RELEVANT performance in the Supplier Performance Risk System (SPRS) and the Contractor

Performance Assessment Reporting System (CPARS) to determine the Quoter’s probability of successfully delivering the supplies required in this solicitation as scheduled.

The past performance evaluation will result in an integrated assessment of the Quoter’s probability of successfully performing the RFQ requirements. The past performance evaluation considers each

Quoter’s demonstrated recent and relevant record of past performance in assessing the risk to deliver supplies required in this solicitation. The Government will consider the recency and relevance of the information, the source of the information, context of the data, and general trends in the Quoter’s performance. The Past Performance Confidence Assessment Rating is based on the Quoter’s overall record of recency, relevancy, and quality of performance. These are combined to establish one past performance confidence assessment rating for each Quoter.

Ratings for this factor will be assigned according to the following rating scale:

Substantial

Confidence

Based on the Quoter’s references, CPARS evaluations, and SPRS records (with a Supplier

Risk Score of above 15%), the Government has a high expectation that the Quoter will successfully deliver the required supplies.

Satisfactory

Confidence

Based on the Quoter’s references, CPARS evaluations, and SPRS records (with a Supplier

Risk Score between 10% to 15%), the Government has a reasonable expectation that the

Quoter will successfully deliver the required supplies.

Neutral

Confidence No references, CPARS evaluations, or SPRS record are available or the Quoter’s performance record is so sparse that no meaningful confidence assessment rating can be reasonably assigned. The Quoter may not be evaluated favorably or unfavorably on the factor of delivery requirement.

Limited

Confidence

Based on the Quoter’s references, CPARS evaluations, and SPRS records (with a Supplier

Risk Score between 5% to 10%), the Government has a low expectation that the Quoter will successfully deliver the required supplies.

No

Confidence

Based on the Quoter’s references, CPARS evaluations, and SPRS records (with a Supplier

Risk Score below 5%), the Government has no expectation that the Quoter will be able to successfully deliver the required supplies.

NOTE: If a Quoter is rated Limited Confidence or No Confidence in Factor 2, the Quoter will no longer be eligible for award nor be evaluated in any remaining factors.

SPRS COLOR LEGEND

Top 5%: BLUE Next 10%: PURPLE Next 70%: GREEN Next 10%: YELLOW Lowest 5%: RED No Scorable Data: WHITE (*) Scorable Data Pending: GREEN (*) Vendor Excluded: GREY No Score: BLACK

Factor 3: Information Assurance

The Government will evaluate the capability of the proposed system to meet the Information Assurance

(IA) requirements below, and risk of not meeting said requirements will be assessed. Ratings for this factor will be assigned according to the following rating scale:

Acceptable

None of the proposed medical devices and equipment (including any third-party applications/components) have a DoD/DHA Risk Management Framework

(RMF) authorization, but some or all are currently undergoing the DoD/DHA RMF

Authorization process. Risk of the proposed system not meeting the IA requirements is moderate.

Unacceptable

One or more of the proposed medical devices and equipment (including any third-party applications/components) have either failed the DoD/DHA Risk Management

Framework (RMF) Authorization process, or have one or more deficiencies. Risk of the proposed system not meeting the IA requirements is unacceptable. Proposed solution is unawardable.

Information Assurance Requirements:

o Quoters shall only offer items, including third-party vendor items, which already have an

Authorization or Approval to Operate (ATO), or items for which the Quoter, and third-party vendor if applicable, agrees to go through the Risk Management Framework (RMF) approval process and obtain an RMF ATO.

o Quoters, and any third-party vendor items, must meet all cybersecurity requirements listed in the

“RMF CYBERSECURITY REQUIREMENTS” table below. These cybersecurity requirements are listed as minimum requirements C1 – C11.

o Any quoted system must meet DoD Cybersecurity/RMF requirements and the attached DHA

Contracting Requirements for Medical Device and Equipment (MDE) Cybersecurity/RMF dated

January 17, 2024 (SOW Enclosure B). Each Quoter must provide a statement with its quote that they, and any third-party vendors, agree to the Cybersecurity/RMF requirements, DHA Health

Insurance Portability and Accountability Act (HIPAA) requirements, and DHA Business-to-

Business (B2B) Gateway requirements.

o Submitting a quote in response to this solicitation constitutes full agreement to all specific RMF requirements listed here and in the attached DHA Contracting Requirements for MDE

Cybersecurity/RMF dated January 17, 2024. This includes:

▪ For all MDE identified by the Government as requiring a full Assess and Authorize

(A&A), including IV&V test, the Quoter shall not make any delivery and shall not receive payment until the PMO has completed a review of submitted RMF documentation and technical results, and the IV&V has been scheduled. Delivery of all system components, including any third-party items, may take place prior to this milestone (IV&V scheduling) only if written permission is provided by the Contracting Officer.

▪ For all MDE identified by the Government as requiring an Assess and Incorporate (A&I) certification, the Quoter shall not make any delivery and shall not receive payment until the PMO has completed a review of submitted RMF documentation and technical results, and the system has have been submitted for an approval. Delivery of all system components including any third-party items, may take place prior to this milestone only if written permission is provided by the

Contracting Officer.

▪ For all MDE identified by the Government as requiring an Assess and Use (A&U) certification, the Quoter must receive written confirmation from the PMO or Contracting Officer that the system has been submitted for an assess only Approval and that the Quoter may proceed with delivery.

▪ Prior to final acceptance and installation, as a part of acceptance testing, the Quoter shall provide procedures for the accepting sites to ensure the delivered device matches the DHA authorized configuration. The Quoter shall coordinate running Nessus and SCAP scans, or the vendor prescribed alternative procedures required to validate the configuration, with the site and the assigned DHA Cybersecurity Analyst to verify compliance. Any deviations from the approved configuration will require the Quoter to bring the system into compliance before final acceptance and payment.

▪ The Quoter shall maintain an Approval on all equipment/product versions, owned or operated by the DHA, and covered under this contract. If the Quoter cannot support the Approval for all DHA contract/ordered versions of the equipment/product, the Quoter can meet this requirement by offering to provide all upgrades to the equipment/product that are required to maintain the Approval. During the period of time the Quoter’s product is installed on the DHA network, the Quoter shall provide all required cybersecurity patches/updates/upgrades, including Operating System and application upgrades where necessary. Maintaining the Approval shall be included as part of the Quoter’s warranty. For updates/patches, executable files shall be distributed by the Quoter accordingly, or implemented by the manufacturer’s technical staff, dependent on the contract/order processes.

o Maintaining the RMF Approval shall be included as part of the Quoter’s pricing and contractual obligation.

o All RMF costs related to the initial fielding of the equipment must be included.

o Quoters must clearly state in their quote if there are any costs associated with RMF support for any support term, including life of the system.

▪ RMF support is defined as the support required to maintain the RMF Approval by providing all required cybersecurity patches/updates/upgrades, including Operating System and application upgrades where necessary.

o Failure to agree to the attached DHA Cybersecurity Requirements document, disclose third-party vendor items requiring RMF Approval, provide a completed SOW Enclosure B – CyberLOG-ICS

Combined MDERA v6.4.1 questionnaire, and provide or state any RMF related costs, may result in rejection of the Quoter’s quote. Failing to disclose that a system has third-party components requiring

RMF Approval, the system cannot meet RMF requirements, failure to meet certification timeframes, or failure to receive RMF Approval, including third-party items, may result in termination for cause in accordance with FAR 52.212-4(m).

RMF CYBERSECURITY REQUIREMENTS

Req# Description Minimum Requirement Exceed Minimum Objective

C-1

Authority to

Operate (ATO), or RMF

Approval

Quoter agrees to comply with IA Terms and

Conditions necessary to achieve and maintain a

RMF ATO for the proposed solution.

1. A strength may be applied if

Quoter has completed an RMF within the last 24 months.

2. A strength may be applied if

Quoter has current RMF Approval for proposed solution.

3. A strength may be applied if all third-party applications are currently included within current

RMF Approval or have their own

RMF Approval.

Quoter has a current ATO or RMF Approval.

System is authorized to be on the DHA Network.

C-2

CyberLOG-ICS

Medical Device

Equipment Risk

Assessment

Questionnaire

Provide a completed CyberLOG-ICS Medical

Device Equipment Risk Assessment

Questionnaire for the quoted system.

All third-party components/applications included in the proposal must have their own

MDERA filled out in its entirety.

N/A N/A

C-3 Third-party

Applications/

Components

Any third-party applications/components must be clearly identified in the quote as being sold by the Prime Contractor. Prime

Contractor submitting the proposal must have an agreement in writing with any third party, or component being resold in the proposal to hold the third-party vendor accountable to comply with the IA Terms and Conditions necessary to achieve a system RMF ATO for their system. If no agreement is in place, the

Prime Contractor in the quote agrees in writing to be responsible for completion of the RMF

ATO for all third-party components, to include the security lockdown (STIGS, Patching, Scans, etc.) of the equipment quoted.

All third-party applications/components must meet all IA SRDs for the quote to be considered. Prime contractor is responsible for ensuring all information from 3rd parties are included and accurate.

N/A N/A

C-4 Provide Current

Nessus Scans

Provide fully credentialed full audit/port scans using Nessus of all system components provided with the system, to include third-party applications/components listed in the quote Scans must be completed within 30 days of submission date to be considered acceptable.

N/A

Provide fully credentialed full audit/port scans using

Nessus of all system components provided with the system, to include third-party applications/components listed in the quote AND all applicable STIGs, checklist, SRGs.

C-5 Operating

System

Operating System used on the Medical Device must have no less than 36 months before reaching its commercial End of Life (OS

EOL).

For any OS with less than 36 months, provide a plan of action towards upgrading the OS.

Include any costs associated with upgrading the OS after deployment, and specific timelines associated with availability of the updated OS.

A strength or weakness may be assigned based on the details provided.

N/A 72 months of commercial support

C-6 Application major

Components

All major component software applications

(SQL, IIS, Net, Etc.) used on the Medical

Device must have no less than 36 months before reaching their commercial End of Life

(OS EOL).

For any major component software applications with less than 36 months, provide a plan of action towards upgrading the application. Include any costs associated with upgrading after deployment, and specific timelines associated with availability of the updated OS. A strength or weakness may be assigned based on the details provided.

N/A 72 months of commercial support

C-7 Vulnerability management

Quoter must describe established policies and procedures to distribute and install security updates within a documented timeframe to include all critical security patches within 15 calendar days. Response must include how often patches are reviewed/released, as well as information on how patches are distributed, and any costs associated with patch management.

1. A strength may be applied if

Quoter has website where all patches can be downloaded.

2. A strength may be applied if

Quoter performs all OS, vulnerability, and critical system patches on a monthly basis.

System is in compliance with DHA Security

Technical Implementation

Guides.

System can be auto patched via Microsoft

System Center

Configuration Manager or

Tanium Endpoint

Manager.

C-8 Data At Rest

Encryption System utilizes FIPS 140-2 level encryption for all PHI/PII data.

1. A strength may be applied if the

Quoter provides a plan on how the device will provide data at rest encryption for all Protected Health

Information (PHI)/Personally

Identifiable Information (PII) stored

(temporarily or permanently) on the device. The plan should cover all quoted devices and importance of

All ePHI/PII stored on system meets DODI

8580.02 requirements.

strength will be determined based on how detailed and realistic the plan is, to include Hardware, Software or Both level encryption techniques.

2. A strength may be applied is if the Quoter can demonstrate that a device only has real time communications with no data being retained on the device.

C-9 Auditing

System is capable of providing a time specific audit trail on system events to include:

1. Login/Logout information

2. modification and deletion of PHI/PII

3. The import and export of data to and from utilizing removable media

4. Execution of privileged/elevated functions.

5. Remote Service Activity

1. A strength may be applied if the system has the capability to link auditing information to a site owned central log monitoring system.

2. A strength may be applied if the system has the capability to send email notifications based on certain predetermined events.

3. A strength may be applied if the system has a customizable dashboard for viewing and acknowledging events.

System has the capability to audit user and system interactions.

C-10 User accounts

All general users of the system must have individual user IDs to log into the application.

All Admin accounts are separate from general user level access

All accounts support DoD password complexity requirements.

A strength may be applied if system uses active directory to provide system authentication and access.

Admin accounts support

FIPS 201 compliant multifactor DoD

CAC/PIV based authentication.

C-11

Scan ability

Live

Environment

Definition:

System that is joined to the network and clinically in use.

Quoter must indicate if the quoted system can be scanned.

Must provide details and requirements for scanning and any directory exemptions necessary.

Must indicate if Quoter intervention is required for scanning.

For systems/components that cannot be scanned, the Quoter must detail how RMF configuration compliance is to be verified in the live environment.

1. A strength may be applied if the system can be scanned in a live environment.

2. A strength may be applied if directory exemptions are not necessary and system can be fully scanned without impacting clinical workflow.

A system capable of supporting unrestricted

(automated scanning with no restrictions on timing)

ACAS/Nessus/SCAP scanning.

Factor 4: Price

The Government will evaluate the quoted price for price reasonableness. The following price analysis techniques may be used to ensure a fair and reasonable price:

- Comparison of quoted prices received in response to the solicitation.

- Comparison of quoted prices with the independent Government estimate.

- Comparison of quoted prices with available historical information.

- Comparison of quoted prices with prices obtained through market research for the same or similar items.

The quoted price will be evaluated for the entire effort, inclusive of all options. Evaluation of options shall not obligate the Government to exercise the option(s).

Price must be determined fair and reasonable in order to be eligible for award. A price is reasonable if, in its nature and amount, it does not exceed that which would be incurred by a prudent person in the conduct of competitive business. A price that is found to be unreasonably high may be indicative of an inherent lack of understanding of the solicitation requirements and may result in the overall quote not being considered for award.

FAR 52.217-6 OPTION FOR INCREASED QUANTITY (MAR 1989)

The Government may increase the quantity of supplies called for in the Schedule at the unit price specified. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days of the required delivery date. Delivery of the added items shall continue at the same rate as the like items called for under the contract, unless the parties otherwise agree.

(End of clause)

FAR 52.217-7 OPTION FOR INCREASED QUANTITY-SEPARATELY PRICED LINE ITEM

(MAR 1989)

The Government may require the delivery of the numbered line item, identified in the Schedule as an option item, in the quantity and at the price stated in the Schedule. The Contracting Officer may exercise the option by written notice to the Contractor within 30 days of the required delivery date. Delivery of added items shall continue at the same rate that like items are called for under the contract, unless the parties otherwise agree.

52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB 1998)

This solicitation incorporates one or more solicitation provisions by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. The offeror is cautioned that the listed provisions may include blocks that must be completed by the offeror and submitted with its quotation or offer. In lieu of submitting the full text of those provisions, the offeror may identify the provision by paragraph identifier and provide the appropriate information with its quotation or offer. Also, the full text of a solicitation provision may be accessed electronically at this/these address(es):

https://www.acquisition.gov/browse/index/far https://www.acquisition.gov/dfars

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address(es):

(End of clause) https://www.acquisition.gov/browse/index/far https://www.acquisition.gov/dfars

52.252-5 AUTHORIZED DEVIATIONS IN PROVISIONS (NOV 2020)

(a) The use in this solicitation of any Federal Acquisition Regulation (48 CFR Chapter 1) provision with an authorized deviation is indicated by the addition of “(DEVIATION)” after the date of the provision.

(b) The use in this solicitation of any Defense Federal Acquisition Regulation Supplement (48 CFR

Chapter 2) provision with an authorized deviation is indicated by the addition of “(DEVIATION)” after the name of the regulation.

52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES (NOV 2020)

(a) The use in this solicitation or contract of any Federal Acquisition Regulation (48 CFR Chapter 1) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the clause.

(b) The use in this solicitation or contract of any Defense Federal Acquisition Regulation Supplement (48

CFR Chapter 2) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the name of the regulation.

252.232-7006 WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (JAN 2023)

(a) Definitions. As used in this clause—

“Department of Defense Activity Address Code (DoDAAC)” is a six position code that uniquely identifies a unit, activity, or organization.

“Document type” means the type of payment request or receiving report available for creation in Wide

Area WorkFlow (WAWF).

“Local processing office (LPO)” is the office responsible for payment certification when payment certification is done external to the entitlement system.

“Payment request” and “receiving report” are defined in the clause at 252.232-7003, Electronic

Submission of Payment Requests and Receiving Reports.

(b) Electronic invoicing. The WAWF system provides the method to electronically process vendor payment requests and receiving reports, as authorized by Defense Federal Acquisition Regulation

Supplement (DFARS) 252.232-7003, Electronic Submission of Payment Requests and Receiving

Reports.

(c) WAWF access. To access WAWF, the Contractor shall—

(1) Have a designated electronic business point of contact in the System for Award Management at https://www.sam.gov; and

(2) Be registered to use WAWF at https://wawf.eb.mil/ following the step-by-step procedures for self-registration available at this web site.

(d) WAWF training. The Contractor should follow the training instructions of the WAWF Web-Based

Training Course and use the Practice Training Site before submitting payment requests through WAWF.

https://www.sam.gov/ https://wawf.eb.mil/

Both can be accessed by selecting the “Web Based Training” link on the WAWF home page at https://wawf.eb.mil/.

(e) WAWF methods of document submission. Document submissions may be via web entry, Electronic

Data Interchange, or File Transfer Protocol.

(f) WAWF payment instructions. The Contractor shall use the following information when submitting payment requests and receiving reports in WAWF for this contract or task or delivery order:

(1) Document type. The Contractor shall submit payment requests using the following document type(s):

(i) For cost-type line items, including labor-hour or time-and-materials, submit a cost voucher.

(ii) For fixed price line items—

(A) That require shipment of a deliverable, submit the invoice and receiving report specified by the

Contracting Officer.

INVOICE AND RECEIVING REPORT COMBO

(B) For services that do not require shipment of a deliverable, submit either the Invoice 2in1, which meets the requirements for the invoice and receiving report, or the applicable invoice and receiving report, as specified by the Contracting Officer.

(iii) For customary progress payments based on costs incurred, submit a progress payment request.

(iv) For performance based payments, submit a performance based payment request.

(v) For commercial financing, submit a commercial financing request.

(2) Fast Pay requests are only permitted when Federal Acquisition Regulation (FAR) 52.213-1 is included in the contract.

[Note: The Contractor may use a WAWF “combo” document type to create some combinations of invoice and receiving report in one step.]

(3) Document routing. The Contractor shall use the information in the Routing Data Table below only to fill in applicable fields in WAWF when creating payment requests and receiving reports in the system.

Routing Data Table

Will be included on the award document to specify each CLIN location and DoDAAC.

(4) Payment request. The Contractor shall ensure a payment request includes documentation appropriate to the type of payment request in accordance with the payment clause, contract financing clause, or

Federal Acquisition Regulation 52.216-7, Allowable Cost and Payment, as applicable.

(5) Receiving report. The Contractor shall ensure a receiving report meets the requirements of DFARS

Appendix F.

https://wawf.eb.mil/

(g) WAWF point of contact.

(1) The Contractor may obtain clarification regarding invoicing in WAWF from the following contracting activity’s WAWF point of contact.

Will be included on the award document to specify each CLIN location and DoDAAC.

(2) Contact the WAWF helpdesk at 866-618-5988, if assistance is needed.

The following Defense Health Agency (DHA) Procedures, Guidance, and Information (PGI) apply to this acquisition:

PROPER IDENTIFICATION OF CONTRACTOR PERSONNEL

1. Contractors, including subcontractors at all tiers, shall provide for a clear distinction from Government personnel. Contractor employees shall not act, advertise, or presume to be Government employees, agents, or representatives. Contractor employees are required to appropriately identify themselves as contractor employees at all times, including in telephone conversations, formal and informal written correspondence, paper and electronic, and in any other situation where their actions could be construed as acts of Government officials, unless, in the judgment of the Government, no harm can come from failing to identify themselves. Contractor employees shall be introduced as contractor personnel and display distinguishing visible identification at all times whether in conversations, meetings, or other forms of communication with Government personnel.

2. Contractor personnel, while performing in a contractor capacity, shall refrain from using their retired or reserve component military rank or title (if applicable) in written or verbal communications associated with the contracts for which they provide services.

3. The Contractor shall incorporate the substance of this requirement in all subcontracts awarded under this contract.

(End of requirements language)

DHA PGI 233.103-90 AGENCY LEVEL PROTESTS (March 22, 2020)

An interested party filing a protest with Defense Health Agency (DHA) has the option of requesting review by either the Contracting Officer (CO) or an independent review Official (IRO), who is a DHA official at a level above the CO. Alternately, an interested party may request IRO review as an appeal of the CO’s protest decision.

Where applicable, an interested party must clearly state in the protest that IRO review is requested, and must specify the nature of the independent review sought – whether as an alternative to CO review or as an appeal of the CO’s decision.

Regardless of which review is requested, all protests must be complete and submitted to the CO within the timeframes specified in FAR Subpart 33.1.

(End of DHA language)

List of CSS Attachments:

Attachment 1 – SOW

SOW Enclosures:

Enclosure A – Site Specific Information

Enclosure B – CyberLOG-ICS

Attachment 2 – Technical Submission Form

Attachment 3 – Quote Sheet

Attachment 4 – Pre-Solicitation Q&A

******* End of Combined Synopsis/Solicitation ********