Cyber Attachment 1 MDE PMO Cybersecurity_RMF Requirements-May 2026.xlsx

System Capability b.Cyber RFO DLA-DHA 04242025: VENDOR SUBMISSION FORM (Completed by Vendors)

The rest of form is to be completed by vendors.

2. A strength may be applied if vendor has current RMF for proposed solution.

3. A strength may be applied if all 3rd party applications are currently included within current RMF or have their own RMF Approval. Vendor has a current ATO or RMF Approval.

System is authorized to be on the DHA Network.

Prime Contractor submitting the RFO must have an agreement in writing with any 3rd party, or component being resold in the RFO to hold the 3rd party vendor accountable to comply with the IA Terms and Conditions necessary to achieve a system RMF ATO for their system. If no agreement is in place, the Prime Contractor in the offering agrees in writing to be responsible for completion of the RMF ATO for all 3rd party components, to include the security lockdown (STIGS, Patching, Scans, etc.) of the equipment offered.

All 3rd party applications/components must meet all IA SRDs for the offering to be considered. Prime contractor is responsible for ensuring all information from 3rd parties are included and accurate.

2. A strength may be applied if vendor performs all OS, Vulnerability, and critical system patches on a monthly basis. System is in compliance with DHA Security Technical Implementation Guides.

System can be auto patched via Microsoft System Center Configuration Manager or Tanium Endpoint Manager.

C8 Data At Rest Encryption System utilizes FIPS 140-2 level encryption for all PHI/PII data. 1. A strength may be applied if the vendor provides a plan on how the device will provide data at rest encryption for all Protected Health Information (PHI)/Personally Identifiable Information (PII) stored (temporarily or permanently) on the device. The plan should cover all offered devices and importance of strength will be determined based on how detailed and realistic the plan is, to include Hardware, Software or Both level encryption techniques.

2. A strength may be applied is if the vendor can demonstrate that a device only has real time communications with no data being retained on the device.

1. Login/Logout information

2. modification and deletion of PHI/PII

3. The import and export of data to and from utilizing removable media

4. Execution of privileged/elevated functions.

5. Remote Service Activity 1. A strength may be applied if the system has the capability to link auditing information to a site owned central log monitoring system.

2. A strength may be applied if the system has the capability to send email notifications based on certain predetermined events.

3. A strength may be applied if the system has a customizable dashboard for viewing and acknowledging events.

All Admin accounts are separate from general user level access All accounts support DoD password complexity requirements.

Live Environment Definition: System that is joined to the network and clinically in use. Vendor must indicate if the offered system can be scanned.

Must provide details and requirements for scanning and any directory exemptions necessary.

Must indicate if vendor intervention is required for scanning.

Vendor must include the supplier and/or manufacturer, and country of origin for each electronic component.

Vendor must provide identification of any components sourced (in whole or in part) from a Foreign Adversary Country, Prohibited Source of Supply, or any non-TAA Compliant Country.

Vendor must provide other information as is required under the representation provided in compliance to FAR 52.204-24 and DFARS 252.204-7017.

C14 Secure Development Practices and ICT Supply Chain Risk Management (SCRM) Using NIST SP 800-218 as a reference, and as applicable to the vendors’ product(s) to be delivered under the contract, the vendor must demonstrate, based on its own documented procedures, a commitment to secure software development practices.

Vendor must also demonstrate that it has processes and procedures in-place for vetting third-party components (hardware and software), managing open-source software and related supplier and supply chain risks, managing changes to system and component configuration, and discovering and responding to vulnerabilities.

C15 HBOM and SBOM Change Management The vendor shall be responsible for change management and notification to the Government in cases where there have been changes to the baseline HBOM and SBOM post award. Notification of the COR will be required under the following conditions:

•Upon any Software/Firmware Update: An updated SBOM shall be delivered within 15 business days of the release of any software or firmware update which would impact the product or component baseline for subsequent deliveries under the contract.

•Upon Hardware Component Revision: An updated HBOM shall be delivered if any hardware component of the system undergoes a revision or part substitution which would impact the configuration of devices delivered under the contract.

•Upon Government Request: The Contractor shall provide the most current SBOM and HBOM within 30 days of a request from the COR.

C16 Vulnerability Management, Continuous Monitoring and Notification of Non-Compliance Post award, and every 90 days thereafter, the vendor shall monitor the list of prohibited equipment and or services at https://www.fcc.gov/supplychain/coveredlist, or otherwise posted to SAM.gov. Should the vendor based on these Government sources or through any other source including any subcontractor or supplier, determine that any equipment or component violates these requirements relative to prohibited sources of supply, the Vendor shall:

•Notify the Contracting Officer within 3 business days of discovery and follow the other reporting procedures under FAR 52.204-25 and DFARS 252.204-7018.

•Within 30 days of discovery, provide a detailed mitigation strategy to address any potential security risks, including required configuration changes and or upgrades that would remediate the potential risks.

•If the component is deemed critical to the operation of the system relative to the system functional requirements or specifications, and cannot otherwise be mitigated or remediated, provide an alternative sourcing plan for the affected component within 30 days of notification.

In addition, the vendor shall proactively monitor all components in the baseline SBOM/HBOM for new vulnerabilities. For any ‘High’ or ‘Critical’ severity vulnerability (CVSS v3.x score of 7.0 or higher), the Contractor shall notify the COR and the DHA Cyber Operations Center within 72 hours of discovery using secure mail or by contacting the DHA Cyber Operations Watch Desk at (866)-786-4432. This notification must include the CVE, a description of vulnerability, the affected components, potential impact, and immediate mitigation instructions. A formal remediation plan and timeline for corrective action shall be delivered within 30 days of notification.

•System Architecture Diagram (required in all cases except where the configuration consists of a single stand-alone device) •Completed DHA Security Questionnaire •Hardware and Software Bills of Material (provided as part of the Solicitation or updated at time of Award) •Comprehensive discovery, configuration, and vulnerability scans (all system components and devices), using Tenable Nessus And within 60 days:

•Completed Controls Selection Worksheet (as provided by the Government for the system, component(s), or device(s)