Contract Requirements.pdf

Contract Requirements

1. Provide the supplies required for organism sensitivity and identification testing.

1.1. All routine supply orders shall be delivered within 3 workdays of receipt of the order.

2. Contractor provides for delivery and installation, all required maintenance, and final removal of equipment upon expiration/termination of contract. All installation, testing materials and consumables required during the installation of the equipment are included in the price and represent no additional cost to the Government.

3. Contractor shall perform the initial Method Validations per Clinical Laboratory Improvement Amendments (CLIA)/National Committee for Clinical Laboratory Standards (NCCLS) guidelines furnishing the necessary calibrators/standards, reagents/reagent packs, and quality control materials.

4. The Contractor shall provide one (1) paper copy and one (1) CD copy of the Operator’s and Maintenance manuals and a statement of the warranty terms in the English language.

5. Ongoing preventive & unscheduled maintenance and parts for the equipment as required; the instrument must be operational 95% of the time per month for daily operations (Monday-Sunday).

5.1. The Contractor shall be responsible for furnishing maintenance, services, repairs, and parts as required in order to maintain the system as clinically operational in accordance with the Collage of American Pathologist (CAP) and CLIA/Clinical and Laboratory Standards Institute (CLSI) guidelines to include all repair and replacement of defective and other parts, complete maintenance program (as required by the manufacturer’s maintenance manuals) and calibration, in addition to hotline telephone service, to assist operators in troubleshooting problems.

5.2. Upon notification of equipment failure, the Contractor shall respond to telephonic requests for unscheduled repair within two (2) workdays. A repair service engineer should be available on-site to repair the equipment failure within three (3) workdays of the initial contact from Department of Pathology and Area Laboratory Services (DPALS) personnel. If the equipment is designated inoperable and out of service for longer than five (5) workdays (from the time-of-service technician’s arrival on site), the Contractor shall notify the Contracting Officer’s Representative (COR), in writing, as to the reason(s) (i.e. non-availability of parts, etc.) for non-compliance. If the equipment cannot be repaired, a replacement instrument shall be provided within ten (10) workdays. If the equipment cannot be replaced within ten (10) workdays, the Government may seek remedies for damages in accordance with FAR 52.212-4(a), “Contract Terms and Conditions – Commercial Items, Inspection/Acceptance”.

6. Software add-ons and updates, as they become available, shall be included.

7. Risk Management Framework for Department of Defense (DoD) Information Technology (IT)

7.1. Risk Management Framework (RMF) for DoD IT: All IS, Platform Information Technology (PIT) and IT Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data shall be accredited in accordance with DoDI 8510.01, Risk Management Framework (RMF) for DoD IT and comply with annual Federal Information Security Modernization Act (FISMA) security control testing. IS and PIT systems shall be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the National Institute of Standards and Technology (NIST) SP 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

7.1.1. All systems subject to RMF shall present evidence of authorization in the System Security Plan, Security Assessment Report) a Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has a DoD RMF or equivalent DoD Component PIT system accreditation decision that is current within 3 years within 5 workdays of Contracting Officer request. Evidence of FISMA compliance shall be presented in the form of a POA&M. Systems shall have and maintain an Authority to Operate (ATO) or Authority to Operate with Conditions (ATO-C) by contract award.

7.1.2. The Contractor shall implement security controls in accordance with NIST implementation and validation requirements specified in the NIST SP 800-37 Risk Management Framework (RMF) and DoDI 8510.01, Risk Management Framework (RMF).

7.1.3. The Contractor shall configure the information system in accordance with Defense Information Agency (DISA) Security Requirements Guides (SRGs) and security technical implementation guides (STIGs).

7.1.4. The Contractor shall ensure that the information system conforms to the requirements of DoDI 8551.01 “Ports, Protocols, and Services Management (PPSM)”.

7.1.5. The Contractor shall ensure that the information system shall authenticate all entities as specified in DoDI

8520.03 “Identity Authentication for Information Systems” prior to granting access.

7.1.6. The Contractor shall Public Key (PK) enable the information system, implementing digital signature and encryption requirements specified in DoDI 8520.02, “Public Key Infrastructure (PKI) and Public Key (PK) Enabling”.

7.1.7. The Contractor shall be responsible for compliance with the Joint Force Head Quarters – Department of Defense Information Network issuances and IA Vulnerability Management (IAVM) issuances by ensuring that the issuances are assessed, implemented and maintained throughout development and sustainment in accordance with specified timelines.

7.1.8. The Contractor shall support reciprocity, by providing all directed information in NIST security documents to the government.

7.1.9. The Contractor shall implement system level protection and detection capabilities that are consistent with their contract for NIST Security requirements that meet DoD and Defense Health Agency (DHA) Cybersecurity Architectures.

7.1.10. Cyber Incident Reporting Requirement: The Contractor shall comply with the incident management requirements of Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B, “Cyber Incident Handling Program”.

7.1.11. Information security (IS) continuous monitoring (ISCM): ISCM is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions.

ISCM is a critical part of the risk management process to ensure that IS and PIT operations remain within an acceptable level of risk despite any changes that occur. The Contractor shall maintain ongoing monitoring, analysis and incident response procedures for all ARRT and PIT systems under this requirement in accordance with NIST SP 800-137.

7.1.12. The Contractor shall mitigate supply chain risk to the government by complying with DFARS 252.239-7018 and only utilizing unified capability equipment identified on the DODIN Unified Capabilities Approved Products List (https://aplits.disa.mil/processAPList), unless granted a waiver in accordance with DODI 8100.04, DOD Unified Capabilities (UC).

https://aplits.disa.mil/processAPList