Exhibit4 GSP Acronyms and Definitions 06MAY2022 (DRAFT).pdf

Department of Defense Defense Health Agency

Program Executive Office (PEO) Medical Systems (MS) / CIO J-6

Market Technology Integration Office (MTIO)

GEOGRAPHIC SERVICES PROVIDERS (GSP)

Exhibit 4 –Acronyms and Definitions

Date: 5/6/2022

DRAFT Exhibit 4 –Acronyms and Definitions

DRAFT Page 2 of 12

1.0 Acronyms and Definitions

This is Exhibit 4 (Acronyms and Definitions) to the PWS.

Except where defined herein, terms have the meaning as defined in the Federal Acquisition Regulation (FAR) Part 2 Definitions of Words and Terms.

The Government seeks to maintain consistent terminology among its Information Technology Services.

Consequently, this exhibit may contain certain definitions that are not currently used in the PWS or any Task Orders.

Unless the context requires otherwise, (a) “including” (and any of its derivative forms) means including but not limited to, (b) “may” means has the right, but not the obligation to do something and “may not” means does not have the right to do something, (c) “will,” “must” and “shall” are expressions of command, not merely expressions of future intent or expectation, (d) “or” shall not be exclusive, (e) words used in the singular include the plural, the plural includes the singular, and the neuter gender includes the masculine and the feminine, and (f) the words “herein,” “hereof,” and “hereunder” and other words of similar import refer to the PWS or any Task Orders as a whole and not to any particular Attachment, Exhibit, Section, Subsection or other subdivision.

1.1 Table of Acronyms

Term Acronym 4ENO Fourth Estate Network Optimization ACAS Assured Compliance Assessment Solution ACD Automatic Call Distribution ACIP Advisory Committee on Immunization Practices ADC Authority, Direction, and Control ADLDS Active Directory Lightweight Directory Service ADP/IT Automated Data Processing/Information Technology AHLTA Armed Forces Health Longitudinal Technology Application AI Administrative Instruction AQL Acceptable Quality Level ASI Authorized Service Interruption ATO Authority to Operate A/V Audio/Visual BOD Business Operations Division (PEO Medical Systems/CIO (J-6)) BPA Blanket Purchase Agreement BPR Business Process Reengineering C2C Comply to Connect C&CI Communications and Computing Infrastructure CAB Change Advisory Board(s) CAC Common Access Card CBS Cloud Brokering Service CCIR Commanders Critical Incident Report CCRI Command Cyber Readiness Inspection CDC Centers for Disease Control CDRL Contract Data Requirements List CE Computing Environment CERT Computer Emergency Response Team

DRAFT Page 3 of 12

Term Acronym CHCS Composite Health Care System CI Configuration Item CIA Confidentiality, Integrity, and Availability CIO Chief Information Officer CIP Continual Improvement Practice CKTS MHS Circuit Management CMDB Configuration Management Database CMMI Capability Maturity Model Integration CMR Contractor Manpower Reporting CMRS Continuous Monitoring and Risk Scoring CNSSI Committee on National Security Systems Instruction CO Contracting Officer, also see KO COA Course(s) of Action CONUS Continental United States COOP Continuity of Operations Plan COR Contracting Officer’s Representative COTS Commercial off the shelf CPM Contractor Program Manager CPR Contractor Performance Report CSA Combat Support Agency REM Risk Management Executive Division (PEO Medical Systems/CIO (J-6)) CSI Continual Service Improvement CSMS Compute Storage Management Service CSP Capability Service Providers CUI Controlled Unclassified Information DAD IO Deputy Assistant Director of Information Operations (J-6, DHA) DBSS Defense Blood Standard System DC3 DoD Cyber Crime Center DCSA Defense Counterintelligence and Security Agency DEOS DoD Enterprise Office Solution DES Defense Enclave Service DFARS Defense Federal Acquisition Regulation Supplement DHA Defense Health Agency DHA-AI Defense Health Agency Administrative Instructions DHA-IPM Defense Health Agency Interim Procedure Memorandum DHA IT Defense Health Agency Information Technology DHA PGI Defense Health Agency Procedures, Guidance, and Information DHA-PI Defense Health Agency Procedural Instruction DHHQ Defense Health Headquarters DHMS Defense Healthcare Management Systems DHMSM DoD Healthcare Management System Modernization DHP Defense Health Program DHSS Defense Health Services Systems DISA Defense Information Systems Agency DMLSS Defense Medical Logistics Standard Support DNS Direct Numerical Simulation DSA Data Sharing Agreement

DRAFT Page 4 of 12

DSAA Data Sharing Agreement Application DoD Department of Defense DoD CIO Department of Defense Chief Information Officer DoDD Department of Defense Directive DoDI Department of Defense Instruction DoDM Department of Defense Manual DRMO Defense Reutilization Marketing Office DSL Definitive Software Library EHR Electronic Health Record EITS Enterprise Information Technology Services EITSI Enterprise Information Technology Services Integrator eMASS Enterprise Mission Assurance Support Service ESA-BAD Engineering Solutions Architecture, Business Analytics Division (PEO

Medical Systems/CIO (J-6)) ESB Enterprise Services Branch EUD End User Device EULA End User License Agreement EXSUM Executive Summary FAQ Frequently Asked Questions FAR Federal Acquisition Regulation FCL Facility Clearance Level as issued by DCSA FedRAMP Federal Risk Authorization and Management Program FHP&R Force Health Protection and Readiness FISMA Federal Information Security Management Act FOC Full Operational Capability FSO/Security POC Facility Security Officer / Security Point of Contact FTR Federal Travel Regulation FY Fiscal Year GAHE Government Approved Hosting Environment QC Quality Control GFE Government Furnished Equipment GFI Government Furnished Information GFP Government Furnished Property GNOB Global Network Operations Branch (IOD, PEO Medical Systems/CIO (J-

6)) GNOC Global Network Operations Center GOTS Government off the shelf GSC Global Service Center GSL Geographic Support Leads GSP Geographic Service Provider GSU Geographically Separated Units HA Health Affairs HHS Health and Human Services HIPAA Health Information Portability and Accountability Act IAM Information Assurance Management IAT Information Assurance Technical IATO Interim Authority to Operate

DRAFT Page 5 of 12

IAVA Information Assurance Vulnerability Alert/Assessment IAVB Information Assurance Vulnerability Bulletin IAVM Information Assurance Vulnerability Management IAW In Accordance With ID Identification IdAM Identity and Access Management IDIQ Indefinite Delivery/Indefinite Quantity IOC Initial Operational Capability IOD Infrastructure and Operations Division (IOD, PEO Medical Systems/CIO

(J-6)) IPT Integrated Project Team IMS Integrated Master Schedule IS Information System ISCM Information Security Continuous Monitoring ISSO Information Systems Security Officer IT Information Technology ITIL Information Technology Infrastructure Library (for pre-ITIL 4) ITSM Information Technology Service Management IVR Interactive Voice Response JKO Joint Knowledge Online JTF-GNO Joint Task Force-Global Network Operations JTR Joint Travel Regulation KEDB Known Error Database KMD Knowledge Management Database KO Contracting Officer, also see CO LAN Local Area Network LCM Life-Cycle-Management LCMP Lifecycle Management Plan Med-COI Medical Community of Interest Program Management MHS Military Health System MHS-SHD MHS Service Helpdesk MIM Major Incident Management mJAD Medical Joint Active Directory MS Medical Systems MSAT Medical Situational Awareness in the Theater MSI Multisourcing Services Integrator, see EITSI MTF Military Treatment Facility MTIO Market Technology Integration Office NAF Non-Appropriated Funds NCR National Capital Region NDA Non-Disclosure Agreement NDAA National Defense Authorization Act NMS Network Management System NOS Network Operating Systems NIPRNet Non-classified Internet Protocol Router Network NIST National Institute of Standards and Technology NIWC Naval Information Warfare Center

DRAFT Page 6 of 12

NSS National Security Systems OCI Organizational Conflict of Interest OCONUS Outside Continental United States ODC Other Direct Costs OGP On-Going Program OLA Operating Level Agreement OLB Other Lines of Business OLM Operating Level Measure OU Organizational Unit P-ATO Provisional Authority To Operate PBX Private Branch Exchange PEO Program Executive Office PHI Protected Health Information PIEE Procurement Integrated Enterprise Environment PII Personally Identifiable Information PIR Post Implementation Review PIT Platform Information Technology PK Public Key PKI Public Key Infrastructure PMO Program Management Office PMTM Program Management & Technical Management POAM Plan of Action and Milestones, also POAM POB Program Operations Branch (IOD, PEO Medical Systems/CIO (J-6)) POC Point of Contact POM Program Objective Memorandum PoP Period of Performance POTS Plain-Old-Telephone-Service PPM Performance and Planning Management PRS Performance Requirements Summary PPSM Ports, Protocols, and Services Management PRMD Portfolio and Resource Management Division (PEO Medical

Systems/CIO (J-6)) PSP Personnel Security Program PWS Performance Work Statement QASP Quality Assurance Surveillance Plan QCP Quality Control Program QoS Quality of Service RACI Responsible, Accountable, Coordinate, and Inform RADIUS Remote Authentication Dial-In User Service RBAC Role Based Access Control RCA Root Cause Analysis RFE Request for Estimate (also see ROM) RFS Request for Solution RMF Risk Management Framework ROM Rough Order of Magnitude RPO Recovery Point Objective RTO Recovery Time Objective

DRAFT Page 7 of 12

SAR Security Assessment Report SCAP Security Content Automation Protocol

SDD Solution Delivery Division (PEO Medical Systems/CIO (J-6)) SDLC Software Development Life Cycle Service Ops Service Operations Sub-Branch (GNOB, IOD, PEO Medical

Systems/CIO (J-6)) SF Standard Form SIEM Security Incident and Event Management SIP Service Improvement Plan SIPRNet Secure Internet Protocol Router Network SME Subject Matter Expert SMM Service Management Manual SMS Service Management System SOFA Status of Forces Agreements Sol-Arch Data Solutions Architecture and SQL Support SOP Standard Operating Procedure SP Special Publication SRG Security Requirements Guides SLA Service Level Agreement SSL Secure Socket Layer STIG Security Technical Implementation Guides SV&T Service Validation and Testing System See Information System T1 Tier 1 TA Trusted Agent TMDS Theater Medical Data Store TO Task Order TOS Terms of Service UPS Uninterruptible Power Supply U.S. United States U.S.C. United States Code VLAN Virtual Local Area Network VoD Video on Demand VoIP Voice over Internet Protocol WAN Wide Area Network WLAN Wireless Local Area Network

DRAFT Page 8 of 12

1.2 Table of Definitions

Term Definition

Acceptance

Acceptance, where it refers to acceptance of tasks (i.e. not invoice acceptance), is the written determination in the Government’s reasonable discretion and in accordance with any applicable Acceptance Criteria of the following:

(1) the successful delivery and performance of Contractor Services or other contractual commitments at the designated location(s), including completed and successful Acceptance testing in conformance with the requirements, or

(2) the compliance in all material respects of any Deliverable with the technical, design and functional specifications provided in this contract, or otherwise agreed upon in writing by the Government.

Acceptance Criteria Acceptance Criteria is the standard by which to measure and confirm that a task or Deliverable meets its functional, technical, design, and performance specifications in all material respects, that has been agreed to by the Government in this contract, or otherwise agreed to in writing by the Government through the

GSP.

Alternate Tokens Medium assurance DoD PKI certificates, also known as Alternate Logon Tokens (ALTs), for use cases to include administrators, groups, roles, code signing, and individuals not authorized to receive a CAC.

Assured Compliance Assessment Solution

ACAS is an integrated software solution that provides automated network vulnerability scanning, configuration assessment, and network discovery for the DoD and other agencies. ACAS consists of a suite of products to include Tenable.sc™ (formerly Security Center®), Nessus® Professional and Nessus Network Monitor® (formerly Passive Vulnerability Scanner®) which is provided by DISA to DoD customers.

Availability Ensuring timely and reliable access to and use by authorized users.

Business Day Means each day from Monday through Friday, excluding federal designated holidays.

Change The addition, modification, or removal of anything that could have a direct or indirect effect on the GSP. Generally tracked and managed through a practice of change enablement as units of change against configuration items. See ITIL 4 definition glossary.

Contracting Officer As defined in FAR subpart 1.602-2. A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

DRAFT Page 9 of 12

Contracting Officer’s Representative

As defined in FAR subpart 1.602-2. An individual designated and authorized in writing by the contracting officer to perform specific technical or administrative functions.

Contractor Personnel The Contractor staff who perform the Contractor Services, this includes any director, officer, manager, employee, contractor, subcontractor, representative and agent of the Contractor or Subcontractor of Contractor.

Contractor Program Manager The Contractor Program Manager is a senior level manager and responsible for and able to take action on behalf of the company regarding all GSP related TOs.

Contractor Services All the obligations of the vendor under contract, in this IDIQ contract or task orders; includes transition-in and transition-out activities, as defined in Part 1 section 1.5 Scope.

Customer Any recipient of DHA IT services in the GSP Environment.

Day Means calendar day, unless otherwise specified (i.e. Business Day).

Deliverable Means software, documentation, plans, reports, data, Work Product, and any other materials, items or events, in each case described or itemized as something that is developed, prepared or created and delivered or required to be developed, prepared or created and delivered or made available to the Government as part of the Contractor Services, including the development or creation of Work Product.

It also means any improvements, enhancements, modifications or customization made to the Contractor Materials as part of or in the course of performing Contractor Services.

MHS Governance The governance framework that establishes the rules and provides decision making and oversight of the delivery of the Military Healthcare System

End User Device Equipment utilized by individual users, which includes a personal computer (desktop, laptop, tablet), consumer device (e.g., personal digital assistant (PDA), smart phone), or removable storage media (e.g., USB flash drive, memory card, external hard drive, writeable CD or DVD) that can store information.

Enterprise Information Technology Services Integrator

The contracted integrator of services across all the service providers and Customers in the EITS Environment.

DRAFT Page 10 of 12

Enterprise Mission Assurance Support Service eMASS is a web-based Government off-the-shelf (GOTS) solution that automates a broad range of services for comprehensive, fully integrated cybersecurity management, including controls scorecard measurement, dashboard reporting, and the generation of Risk Management Framework (RMF) for Department of Defense (DoD) Information Technology (IT) Package Reports. eMASS provides an integrated suite of authorization capabilities and prevents cyber security attacks by establishing strict process control mechanisms for obtaining authorization to operate decisions.

Equipment Means the computer, telecommunications, and facility-related hardware, equipment, and peripherals (and all modifications, replacements, upgrades, enhancements, documentation, materials, and media related thereto) that are used in connection with the Contractor Services, including those used by Contractor.

Event Any change of state that has significance for the management of a service or other configuration item. See ITIL 4 definition glossary.

Exhibit As per DFARS PGI 204.7105, referred to in a contract, which is attached and establishes requirements or additional information.

Go-Live Date The date the Contractor is approved by the Government to assume responsibility for operational delivery for a particular scope, such as from a single incumbent vendor. There may be multiple Go- Live Dates. Go-Live Dates are intended to be defined as milestone deliverables.

Government Data Data that belongs to the Government, that should be protected and cared for according to the DOD and agency regulations, policies, and procedures, and appropriately returned to the Government when no longer used or in the custody of the Contractor.

Incident An unplanned interruption to a service or reduction in the quality of a service. See ITIL 4 definition glossary.

Information System A discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. Note: Information systems also include specialized systems such as industrial and process controls systems, telephone switching and private branch exchange (PBX) systems, and environmental control systems. See NIST Special Publication 800-53 Revision 4.

Information Technology Infrastructure Library

A set of best-practice guidance for IT service management published by AXELOS. See ITIL 4 definition glossary.

DRAFT Page 11 of 12

Information Technology Service Management

Employs ITIL documented best practices and in most cases, extends beyond into additional areas such as enhanced processes and implementation to provide additional value-added functionality. ITSM methods have evolved to include specific ways to enable and optimize assessment, planning, and implementation of ITIL best practices.

Integrated Services The overall capabilities provided, and the obligations to deliver those capabilities, of all the Integrated Service Providers that deliver in the EITS Environment for the support of the Customers.

Key Personnel Contractor Personnel designated as key personnel in GSP Exhibit 1 – Labor Role Descriptions.

Material For the purpose of the EITS Environment, this means, collectively, Software, literary works, other works of authorship, documented specifications, designs, analyses, processes, methodologies, concepts, inventions, know-how, programs, program listings, programming tools, documentation, reports, drawings, databases, spreadsheets, machine-readable text and files, whether tangible or intangible.

Med-COI The single, secure, inter-operable network enclave for joint Department of Defense (DoD) medical community communications and information technology (IT) operations. The Med-COI enclave is compliant with the Joint Information Environment Single Security Architecture and also provides segregation from Non-classified Internet Protocol Router Network (NIPRNet) to support seamless interoperability with business and mission partners.

MHS Service Helpdesk Program

The DAD IO/ J-6 program for managing the deployment of ServiceNow within the MHS.

Previously known as the DAD IO/ J-6 ITSM IPT.

Military Health System Includes any military health system, to include Air Force, Navy, Coast Guard, Marines, Army, and any other entity under the mission of the DHA.

Medical Treatment Facility These are military hospitals and clinics and are also referred to as direct care facilities.

Other Lines of Business All aspects and locations of the MHS that are not involved in providing medical care (e.g. Defense Health Headquarters (DHHQ), DoD Medical Research facilities)

Practice Whether capitalized or not, refers to a set of methods, procedures or organizational resources designed for performing work or accomplishing an objective.

DRAFT Page 12 of 12

Problem A cause, or potential cause, of one or more incidents. See ITIL 4 definition glossary.

Quality Assurance Used to assess contractor performance against required standards and acceptable quality levels. The QASP identifies what will be inspected, the inspection process or technique, and who will do the inspecting.

Secure Internet Protocol Router Network (SIPRNet)

A system of interconnected computer networks used by the U.S.

Department of Defense and the U.S. Department of State to transmit classified information (up to and including information classified SECRET) by packet switching over the secure environment.

Services The military service branches of the Armed Forces of the United States, established by act of Congress, which are: the Army, Marine Corps, Navy, Air Force, and Coast Guard; or as defined in the DOD Dictionary of Military and Associated Terms.

Service Provider A third party entity contracted to the Government that is providing services in the EITS Environment and has specific contractual requirements (e.g. OLAs, Shared SLAs, SMM) to work with the EITSI for the mutual support and delivery of services to Customers. At this time, Service Providers are either GSPs or CSPs.

Software Computer programs, procedures, and associated documentation and data pertaining to the operation of a computer system.

Transition A general term for the process of transferring knowledge, documentation, processes, and ultimately operational responsibilities from one vendor to another.

Transition-In Plan The single plan for all transitions and related transition activities to accomplish the transfer of responsibility for delivery from all incumbent vendors to the Contractor.

Transition-In Period The period of time from the award to the completion of all Transition-In activities. Most often this is the period to complete the Transition-In Plan.

User Means a person who is authorized and uses the Service on a regular basis.