GSP PWS 12MAY2022 (DRAFT).pdf

Performance Work Statement

Geographic Service Providers (GSP)

Program Executive Office (PEO) Medical Systems (MS) / CIO J-6

Market Technology Integration Office (MTIO)

Solicitation Number: Draft Date: 12 May 2022

GSP PWS DRAFT

Summary of Changes Section Changed Date

PART 1

1.0 General Information: Geographic Service Providers (GSP) Performance Work Statement

(PWS)

1.1 This is a non-personal services PWS to provide standardized enterprise IT support services to Medical Treatment Facilities (MTF) and Other Lines of Business (OLB).

1.2 Description of services/introduction: The Contractor shall provide all personnel, supplies, transportation, supervision, and non-personal services necessary to perform standardized Information Technology (IT) services as defined in this Performance Work Statement (PWS) except for those items specified as Government Furnished Property (GFP) and services in PWS Part 3. The Contractor shall perform the requirements in this PWS and as ordered under Indefinite Delivery Indefinite Quantity (IDIQ) Task Orders (TOs). Requirements in the GSP PWS are applicable for all Task Order (TO) PWSs that may be issued in the future under the GSP basic contract.

1.3 Background: The Defense Health Agency (DHA) is the “centerpiece of the Military Healthcare System (MHS) governance reform” (Deputy Secretary of Defense March 11, 2013, memorandum, Implementation of Military Health System Governance Reform:

https://www.health.mil/Reference-Center/Policies/2013/03/11/Implementation-of-Military- Health-System-Governance-Reform) with the intention of tighter integration of healthcare delivery systems to achieve medical readiness, improve health of people, enhance experience of care, and lower healthcare costs. As a result, the Department of Defense (DoD) began a multi-year transition of MTFs from the military departments to the DHA for the purposes of implementing an integrated system of readiness and health required by sections 702 and 703 of the FY 2017 National Defense Authorization Act (NDAA) and updated in sections 711 and 712 of the FY 2019 NDAA.

Consistent with NDAA mandates, the DHA established the MHS Enterprise Information Technology Services Program Management Office (EITS PMO) to provide a framework for transforming MHS IT from the current decentralized model to centralized management and coordination with distributed delivery. The MHS EITS strategy includes three major components: EITS Integrator (EITSI), Capability Service Providers (CSPs), and GSPs.

Coordination between all three components is expected and essential for successful execution of the DHA mission.

The EITSI Contractor specializes in coordination, integration, and management activities and replaces certain existing enterprise contracts, including the DHA Global Service Center (GSC).

The EITSI Contractor will coordinate with both CSPs and GSPs.

CSPs are specialist Contractors that provide a particular IT capability or service to the entire MHS Enterprise.

GSPs are Contractors that perform a wide variety of IT tasks and services for MTFs and OLBs.

1.4 Objective: To acquire IT service support throughout the DHA enterprise supporting the Continental United States (CONUS) and Outside the Continental United States (OCONUS) MTFs and OLBs.

1.5 Scope: GSPs are Contractors that perform a wide variety of IT tasks and services to standardize and provide robust IT support at MTFs and OLBs. GSP services may augment enterprise capabilities. The Contractor(s) will provide the expertise, technical knowledge, staff support, and other related resources necessary. GSP scope areas include:

Scope Area 1: IT Service Desk Scope Area 2: Database, Application, and Web Development Scope Area 3: Identity Management and Desktop Support Scope Area 4: Data Center Operations Scope Area 5: Information Assurance Scope Area 6: Network Operations Scope Area 7: Telecommunications Scope Area 8: Clinical Informatics Scope Area 9: Information Business Operations

1.5.1 GSP Labor Categories. The Contractor shall meet all qualifications provided in Exhibit 1 GSP Labor Categories. The Government may add new labor categories, by modifying and publishing Exhibit 1, consistent with the GSP scope.

1.6 Ordering Period/Period of Performance (PoP): The ordering period will be 10 years from the date of IDIQ award(s). TO PoP will be specified in the TOs.

1.6.1 Transition: Where required by TOs, the Contractor shall create, and obtain Government approval of, a detailed Transition-In Plan and Transition-Out Plan addressing the transition and implementation of Contractor services. Contractor shall submit the Transition-In Plan in accordance with (IAW) the defined deliverable, see Part 7 Deliverable List (Deliverable 1).

Contractor shall submit the Transition-Out Plan in accordance with the defined deliverable, see Part 7 Deliverable List (Deliverable 2).

1.6.1.1 Transition Reporting: The Contractor shall report on the execution of the Transition-In Plan weekly until contractor services are fully deployed. Similarly, the contractor shall report on the execution of the Transition-Out Plan weekly until the TO is complete.

1.6.1.2 Transition-In: The period between the award date and full performance start date of a TO constitutes the Transition-In period. The transition-in period will be identified in the TO. During the Transition-In period, the Contractor shall prepare to meet all TO requirements and ensure incoming personnel are functionally trained and qualified on the full performance start date.

1.6.1.2.1 Additional Transition-In procedures may be required at the local site level.

1.6.1.2.2 In-Process Work Activities: Upon the full performance start date, as specified in the TO, the Contractor shall assume responsibility for continuing the development, implementation, and support of current projects and requests for services as identified by the Government.

During the Transition-In Period, the Contractor shall review current work activities with the Government.

1.6.1.2.3 Transition-In Plan: Transition-In plans shall include:

Review, evaluation, and transition of current support services Government-approved training and certification process Establish credentials for Contractor Personnel and for the transition of other credentials Transfer of hardware warranties and software licenses (if applicable) Transfer of all necessary operations and technical documentation Transfer of compiled and un-compiled source code, to include all versions, maintenance updates and patches (if applicable) Orientation phase to introduce Government personnel and users to the Contractor's team, tools, methodologies, and business processes Transfer of Government Furnished Equipment (GFE) and Government Furnished Information (GFI), and GFE inventory management assistance Applicable DHA, site, and contract company briefing and Contractor Personnel onboarding procedures Coordinate with the Government to account for Government keys, ID/access cards, security codes, and alternative tokens

When required by the TO, the Contractor shall provide the Government with a written evaluation and assessment of the status of all current projects in accordance with the deliverable, see Part 7 Deliverable List (Deliverable 3).

1.6.1.3 Transition-Out: The Contractor shall execute transition out based on the approve plan.

The Contractor shall complete all transition-out activities IAW individual TOs and the transition-out plan. Transition may be to a Government entity, another Contractor under contract, or to the Contractor under a new contract. The Contractor shall assist the Government in planning and implementing a complete transition from this contract and any TOs issued under this contract to a successor. This shall include formal coordination with Government staff and successor staff and management. It shall also include delivery of items such as copies of existing policies and procedures, and delivery of required metrics and statistics.

1.6.1.3.1 The Contractor shall not allow performance to degrade during transition-out. Except as approved by the Government, the Contractor shall not make any changes to the transition-out plan. Transition-Out Assistance will include the assistance and obligations, as requested by Government, described in the Transition-Out Plan.

1.6.1.3.2 Transition-Out Plan: The Contractor’s transition-Out plans shall include:

Review, evaluation, and transition of current support services Government-approved training and certification process Transfer of hardware warranties and software licenses (if applicable) Transfer of all necessary operational and technical documentation Transfer of compiled and un-compiled source code, to include all versions maintenance updates and patches (if applicable) Orientation phase to introduce Government personnel and users to the Contractor's team, tools, methodologies, and business processes Transfer of Government Furnished Equipment (GFE) and Government Furnished Information (GFI), and GFE inventory management assistance Applicable DHA, site, and contract company debriefing and Contractor Personnel out-processing procedures Turn-in of all Government keys, Identification (ID)/access cards, security codes, and alternative tokens.

1.7 Administrative specifications

1.7.1 GSP Geographic Locations: The Contractor shall perform IT Services at various locations within the CONUS, OCONUS, and virtually as specified in individual TOs. Individual Locations are listed in Exhibit 2. Multiple geographic locations may be consolidated in individual TOs.

1.7.1.1 The Contractor shall identify virtual Contractor Personnel both in the TO proposal as well as in communications with the Government to include the MTFs or OLBs.

1.7.1.2 Contractor Personnel who are approved to work virtually may be required to physically report to the local site during orientation, for Government Furnished Equipment issuance, for training, or for other reasons through the life of the TO. The Government will attempt to minimize these on-site requirements. The Contractor shall be responsible for paying for this travel.

1.7.1.3 Telework: The Contractor shall complete all initial and ongoing telework requirements if telework authorization is provided by the MTF or OLB. The Contractor shall meet all telework responsibilities for teleworking Contractor Personnel.

1.7.2 Unless stated otherwise in the TO, the contractor shall recognized the following Federal holidays:

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

1.7.3 Hours of operation: The Contractor shall conduct business during hours specified in TOs except Federal holidays unless otherwise specified in the TO.

1.7.3.1 Non-standard work hours may be required in support of after-hours IT requirements that may not be performed during normal duty hours, as directed by local site Chief Information Officer (CIO) or IT Director.

1.7.3.2 Closures: During a planned closure of the facility due to training, holiday or unplanned closure due to unusual and compelling circumstances (e.g., natural disasters, military emergencies, severe weather) the Contractor will only be paid for the actual hours the Contractor Personnel provided services, unless otherwise identified in the TO or by the Contracting Officer

(CO).

1.7.4. Hours of Performance: The Contractor shall provide Contractor Personnel as describe in the TO PWS.

1.7.4.1 On occasion, services may be required to support an activation or exercise of contingency plans outside the normal duty hours. Total worked hours shall not exceed maximum identified in the TO.

1.7.4.2 Contractor personnel will be able to start working (billable time) once a clearance and CAC have been obtained and are onsite.

1.7.4.3 The contractor shall provide enhanced and expedited Very Important Person (VIP) support that may include direct hands-on pick-up and or drop-off of the devices and or peripherals to the VIP users’ locations. The Current list VIP End Users are a sub-set of the overall user-base and will be identified at the TO. Currently there are 70-100 VIP users at DHA. The CO or Contracting Officer Representative (COR) will approve all additions, changes, or removal of individuals identified as VIPs.

1.7.5. Personnel Conduct: The Contractor shall ensure the stability and continuity of its workforce and at all times maintain an adequate workforce for the uninterrupted performance of associated PWS tasks and performance standards. The Contractor shall provide services IAW its proposed approach and/or staffing plan and all Contractor personnel shall be qualified for the labor category in which they are performing.

Contractor personnel shall adhere to standards of conduct, appropriate dress, phone etiquette, and professional respect and courtesy as established by the DHA Director and local site.

1.7.6 Recording time: The Contractor shall be responsible for recording arrival and departure times, reporting absenteeism, and signing timesheets for Contractor Personnel, unless otherwise identified in the TO. This information shall be provided to the Government upon request by the

COR.

1.8 Contractor Travel: The Contractor may be required to travel within/between CONUS or OCONUS locations to participate in conferences, meetings, to support mission objectives, or other events. Except for local travel as provided in section 1.8.1, the Contractor will be authorized reimbursement of travel expenses consistent with the substantive provisions of the Joint Travel Regulation (JTR), the cost principles and procedures in Federal Acquisition Regulation (FAR) Part 31.2, Travel Costs, and the limitations of funds for ODCs specified in individual TOs. All travel requires Government approval and authorization by the COR prior to travel. Arrangements for and costs of all travel, transportation, meals, lodging, and incidentals are the responsibility of the Contractor. The Contractor shall ensure good stewardship of travel funds, with all travel complaint with, and adhering to, Government per diem rates whenever possible. Travel costs shall be incurred and billed in accordance with FAR Part 31. Costs for these expenses will be reviewed by the COR, and approved to the extent they are allowable and allocable to this contract. Travel shall be reported in the Monthly Progress Report as described in the Performance Requirements Summary.

1.8.1 Local and Non-local Travel: Travel within a 50-mile radius from the individuals' primary place of performance will not be reimbursed (e.g., subsistence, travel time, or other travel related expenses). Travel greater than a 50-mile radius from the individuals' primary place of performance is considered non-local travel and will be reimbursed in accordance with section 1.8 above.

1.8.2 OCONUS Travel: OCONUS travel requirements will be addressed by specific TOs. The Contractor shall comply with any Status of Forces Agreement (SOFA) and other country specific requirements to travel and work overseas. Prior to OCONUS travel, the Contractor shall coordinate with the COR at least 20 business days prior to travel. The Contractor shall comply with requirements in the DoD Electronic Foreign Clearance Guide for all travel outside the United States. The Contractor shall also obtain information on, and adhere to, any specific country/theater-specific clearances, specialized training, or other requirements necessary for the type of intended travel to that country/theater as early as possible prior to travel so as to meet all lead times. Further guidance for Contractor travel can be found at https://www.defensetravel.dod.mil/site/faqctr.cfm. Additional OCONUS travel requirements may be provided as necessary in individual TOs.

1.8.3 Approval for Travel: The Contractor shall ensure that travel and travel costs are approved by the CO or designated representative prior to travel per DHA and/or site requirements. The Contractor shall schedule travel at least two weeks in advance whenever possible to maximize savings to the Government through receiving the best travel rates available. The Contractor shall ensure good stewardship of travel funds, and shall seek rates lower than per diem whenever possible.

1.8.4 Trip Reports: The Contractor shall submit a trip report per DHA or site requirements within 5 business days after completion of travel. The trip report typically includes:

• Personnel traveled

• Dates of travel

• Destination(s)

• Purpose of Trip; contract effort supported; Government Agency supported (if applicable), explain the benefits of the travel to the Government.

• Actual Trip Costs

• Approval Authority

• Summary of events

1.9 Other Direct Costs (ODCs): All reimbursable ODCs (including travel) will be identified in individual TOs and must be authorized by the CO or COR prior to purchase and be in conformance with TO requirements and IAW the FAR Subpart 31.

1.9.1 The Contractor shall bill TO ODCs on a cost reimbursable, no-fee basis. Contractor will be authorized reimbursement of ODC expenses consistent with the limitation of funds for ODCs specified in the individual TO. All ODCs shall be reported in the Monthly Progress Report as described in the Performance Requirements Summary.

1.9.2 The Contractor shall receive prior approval for all ODCs from the CO or COR. The ODC Approval Request shall include a description of the item(s) to be procured, the part number if applicable, identification of the sources and prices found with the recommended source highlighted, the quantity of each item to be procured, a total price prior to the application of Contractor indirect rates, the total indirect costs, a total price, and the delivery date. If the delivery date is expedited, resulting in additional or greater cost, a rationale shall be provided.

After Government approval, the Contractor shall be responsible for procuring and ensuring delivery and receipt of the items procured. After items have been procured and received, a detailed invoice with a breakdown of expenses shall be submitted to the COR.

1.10 Quality: The Contractor shall develop and maintain an effective quality control (QC) program to ensure services are performed IAW this PWS and any TO PWSs. The Contractor shall develop and implement procedures to identify, prevent, and ensure no recurrence of defective services. The Contractor’s QC program is the means by which the work complies with stated requirements. The Quality Control Plan (QCP) shall document how the Contractor will meet and comply with the quality standards established in this PWS. Within 30 days of award, the contractor shall submit its QCP in accordance with the contract deliverable, see Part 7 Deliverable List (Deliverable 4).

1.11 Contractor Personnel

1.11.1 The Contractor shall comply with the onboarding processes for the site to which they are assigned; details will be included in TOs or provided after award. Onboarding processes may include but are not limited to: mission orientation, background investigation, Common Access Card (CAC) issuance, Joint Knowledge Online (JKO) mandatory/annual training, network access, access to classified information and/or systems (if required), employee emergency notification service registration.

1.11.2 Contractor Personnel Security Investigation: The Contractor shall comply with the security background investigation, screening requirements and processes as described in Part 6 of this PWS. Additional site specific security requirements may be included in TOs.

1.11.3 DHA New Employee Handbook. The Contractor Personnel shall comply with Exhibit 3 DHA New Employee Handbook and/or local site new employee processes.

1.11.4 The Contractor Personnel shall complete all DHA or site specific orientation program(s), initial and annual training requirements.

1.11.5 Contractor Personnel Qualification: The Contractor shall ensure personnel it assigns or utilizes in the performance of this contract meet the requirements of the roles to which they are assigned, including at a minimum, the experience, educational, certification, and other requirements set forth in Exhibit 1 GSP Labor Categories of this PWS and are fully capable of performing in an efficient, reliable, and professional manner.

1.11.6 The Contractor shall ensure that all Contractor personnel shall be required to complete and sign a DHA or site Contractor Non-Disclosure Agreement (NDA) (DHA Form 49) during in processing or prior to access to the Government’s system. The Contractor shall maintain originally signed NDAs of individual employees and provide copies to the COR.

The Contractor shall report any violations to the terms in the NDA to both the Government COR and Government CO within 1 day of the violation.

1.11.7 Emergency Services: The Contractor shall provide support in the event that local site or DHA requires support during an activation or exercise of contingency plans outside the normal duty hours.

Emergency situations defined under this PWS will include but will not be limited to:

Natural or man-made disaster resulting in threat to loss of life or limb National emergency as defined by the Government.

Weather events that prevent personnel from free access to DHA sites.

Outage or degrade of any DHA IT or Facilities Management system or service including power outages Terrorist (or similar) attack (foreign or domestic, active shooter, bomb threat, etc.).

Pandemic outbreak as defined by the Government.

Any other emergency situation as defined by the Government or Government Office of Personnel Management

Contingency operation plans shall be activated immediately after being notified of or determining that an emergency situation has exists. The Contractor personnel shall be operational within four (4) hours of activation. The Contractor personnel shall be sustainable until the emergency situation is resolved and normal conditions are restored or the contract is terminated, whichever comes first. In case of a life threatening emergency, the COR will immediately make contact with the Contractor Program Manager (CPM) to ascertain the status of any Contractor personnel who were located in Government controlled space affected by the emergency. When any disruption of normal, daily operations occur, CPM and CORs shall promptly open an effective means of communication and verify:

Key points of contact (Government and Contractor).

Temporary work locations (alternate office spaces, telework, virtual offices, etc.).

Means of communication available under the circumstances (e.g. email, webmail, telephone, FAX, courier, etc.).

Essential work products expected to continue production by priority.

The CPM, in coordination with the COR, shall make use of all available resources and tools in order to continue DHA contracted functions to the maximum extent possible under emergency circumstances. Regardless of contract type, and of work location, Contractors performing work in support of authorized tasks within the scope of their contract shall charge those hours accurately in accordance with the terms of this contract.

1.11.8 Health Requirements: The Contractor shall provide documentation certifying health requirements such as immunizations, annual vaccinations, medical testing, and physical examination when required prior to new employee orientation and annually thereafter, as required by the site. The expense for all health requirements, to include monitoring and tracking annual requirements, shall be borne by the Contractor at no additional cost to the Government.

1.11.8.1 Annual Immunizations: The Contractor shall ensure Contractor Personnel are immunized annually with the seasonal influenza vaccine (when the current seasonal influenza vaccine is available) and any other vaccine recommended by the Advisory Committee on Immunization Practices (ACIP) of the Centers for Disease Control (CDC) per site requirements.

1.11.8.2 Immunization Tracking: The Contractor shall maintain its own process and system of tracking the currency of health immunizations and shall not rely on the Government for ensuring their employees are in compliance.

1.11.8.3 Tuberculosis: In those areas where there is a higher risk of transmission of tuberculosis, local site policy may direct Contractor Personnel be tested more frequently at no cost to the Government.

1.11.9 Removal of Contractor Personnel from the site and/or contract performance: The Contractor shall remove Contractor Personnel if the Government directs the removal of any worker, from their assigned site, who demonstrates a health, safety, Health Insurance Portability and Accountability Act (HIPAA) violation, mission risk, or site policy violation. In the event the Government directs the removal, from the assigned site, of a Contractor Personnel, the TO CO may direct the submission of a corrective action plan and issue a stop work order while the Contractor's response, Contractor's implementation of the plan, and/or any Government investigation is pending.

1.11.9.1 If the need for a removal occurs, the COR will contact the Contract Company Representative and direct the Contractor to remove the individual from the site. The Contractor shall not use individuals removed under such circumstances to perform any services under the TO unless authorized by the CO. The Contractor shall formally meet with the CO to discuss further action. A review of the basis for removal will be made by the CO within 3 business days after the COR directed the removal.

1.11.9.3 Access Removal for Deficient Certification: The Contractor shall ensure that all Contractor Personnel have proper and current certifications for their roles and responsibilities in providing Contractor services, and deny access to DoD information systems to personnel without such training and certifications.

1.11.10 Continuity of Operations: The Government has identified all or a portion of the contractor services to be performed under this contract as emergency contractor services in support of mission functions. The COOP addresses the requirements in Department of Defense Directive (DoDD) 3020.26, the “National Continuity Policy Implementation Plan,” February 2018.

1.11.11 Organizational Conflict of Interest (OCI): The Contractor and Contractor Personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analysis, specifications or work statements) or perform evaluation services which may create a potential or actual OCI as defined in FAR Subpart 9.5. The Contractor shall notify the CO immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid, neutralize or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be acceptable solely at the discretion of the Contracting Officer and in the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided, neutralized or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

1.11.12 Physical Security: The Contractor shall be responsible for safeguarding all Government equipment, information and property provided for use by Contractor personnel. Contractor shall comply with safeguarding IAW DHA-Administrative Instruction (AI) 003 Physical Security Program, all applicable FAR/DFARS clauses in the contract or TOs, and local site Standard Operating Procedures (SOPs).

1.11.12.1 The Contractor shall comply with the local installation and MTF/OLB physical security, personnel identification (including identification badges), and access requirements.

1.11.12.2 Lock combinations: The Contractor shall establish and implement methods of ensuring that lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations. These procedures shall be included in the Contractor’s

QCP.

1.12 Contractor Program Manager (CPM): The Contractor shall assign a single CPM as the primary point of contact for all GSP performance, i.e., responsible for both the IDIQ contract and all awarded TOs. The CPM is a senior level manager and responsible for and able to take action on behalf of the company regarding to all GSP related TOs. The CPM does not have to be the Contractor’s Contracts Manager and the CPM will not have to sign contracts. Individual TOs may require assignment of TO Key Personnel.

1.12.1 The Contractor shall assign a back-up CPM in the event the primary is unavailable.

1.12.2 The Contractor shall provide the Government with the resume of the incoming CPM if the incumbent CPM will no longer be assigned GSP responsibilities. The Contractor shall not assign a new CPM without Government’s approval.

1.12.3 The Government may designate Key Personnel at the TO level. Details will be provided in the Exhibit 1 GSP Labor Categories or as specified in individual TOs.

Substitutions of proposed Key Personnel should not be allowed for a period of six (6) months after TO award, except under extreme circumstances. For temporary and/or permanent replacement of Key Personnel, the Contractor should provide a resume for each individual to the COR. Resumes should be provided at least two weeks prior to making any Key Personnel changes. The Government reserves the right to validate qualifications any replacement or substitution of Key Personnel.

1.12.4 Post Award Conference: The Contractor, to include CPM, shall attend a contract post award conference established by the CO within 20 days of contract award. The Contractor also agrees to attend any post award conference or progress meeting convened by the contracting activity or contract administration office IAW FAR Subpart 42.500, Post-award Orientation.

Post award conference(s) for TOs will be specified in the TOs’ PWS.

1.12.5 Periodic Progress Meetings: The CPM shall attend all periodic progress meetings, as needed. At these meetings, the CO and/or the COR will apprise the Contractor of how the Government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced as well as any identified risks. These meetings shall be at no additional cost to the Government.

1.12.6 The CPM shall attend annual in-person meetings held in the National Capital Region or San Antonio, TX for no more than 2 days in length, or held virtually.

1.13 Data rights: Except as may be provided in individual TOs, all documents and materials produced and delivered under this contract shall be Government owned and are the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. The Contractor shall also deliver to the Government the source code of all software developed and funded under this contract (including noncommercial modifications to commercial software), for which the Government will have unlimited rights. Documents and materials delivered to the Government under this contract may not be otherwise used or sold by the Contractor without written permission from the Contracting Officer. These rights do not abrogate any other Government rights. The Government’s rights in any technical data, non-commercial computer software (including noncommercial modifications to commercial software), or noncommercial software documentation under this contract are in accordance with the Defense Federal Regulations Supplement (DFARS) clauses contained in the contract. The Government’s rights in any commercial computer software under this contract shall be specified by separate commercial supplier/licensing agreements, which shall be made a part of this contract so long as preapproved, and executed, by the Contracting Officer.

1.14 Reporting: The Contractor shall track the status of all deliverables, including required submission timeframes, approvals, rejections, revisions, plans, and all other actions related to successful completion of deliverables in the Monthly Performance Report. The Contractor shall submit the Monthly Performance Report in accordance with (IAW) the defined deliverable, see Part 7 Deliverable List (Deliverable 5).

1.14.1 Deliverables Schedule: The Contractor shall adhere to the schedule of deliverables as identified in both the IDIQ PWS and the TO PWS(s).

1.14.2 Deliverable Review Statement: The Government will provide the Contractor a written statement indicating Acceptance or Rejection of the Deliverable.

Acceptance will occur only through a written statement provided to the Contractor by the CO or COR. In no event will a Deliverable be deemed to be accepted by Government, even where payment is made for the Deliverable, or the Deliverable is used in production, or any other basis, where there has been no issuance of a written acceptance statement.

1.14.3 Rejection of Deliverables: If the Contractor receives a written statement indicating Rejection of a Deliverable, the Contractor shall within five (5) calendar days provide a proposed resolution, which could include repairing, replacing, or performing the nonconforming items or services or else a request that the Government formally accept the nonconforming items/services in exchange for an equitable price reduction or other adequate consideration.

1.14.4 Revision after Acceptance: In the event of a discovery of a defect in a previously Accepted Deliverable, where such defect would have qualified as a Non-Conformity at the time of Acceptance, upon notification by Government or the applicable Customer, the Contractor shall, at no additional charge, repair or replace or otherwise correct the Non-Conformity to the level of performance specified in the TO.

1.14.5 Deliverable Format: Unless specified otherwise in a TO, the Contractor shall submit deliverables in the form of a Microsoft Office Products and or a PDF, using the version in use by the Government at the time of submission, where such deliverables, reports, and other documents are delivered to the Government outside of a system by the Contractor as part of Contractor services. Deliverable formats and templates may be further specified in TOs.

1.14.5.1 The Contractor shall provide deliverables in 12-point font, Times New Roman, and 1-inch margins.

1.14.6 Non-Proprietary: In no event, shall the Contractor submit any document or other deliverable for performance of Contractor services marked “Proprietary.”

1.15 Contractor identification: All Contractor personnel shall identify themselves as Contractor personnel in all forms of communication.

1.15.1 Contractor personnel shall be required to attend meetings or otherwise communicate with Government and/or other contract representatives. Contractor personnel shall make their Contractor status known during introductions.

1.15.2 Contractor personnel, while performing in a Contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16 RESERVED

1.17 Personnel Compliance: The Contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce Improvement Program, CH4” November 10, 2015 as amended; DoDI 8500.01, “Cybersecurity”, dated October 7, 2019; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM 5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. These publications are available here: https://www.esd.whs.mil/DD/DoD-Issuances/. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.17.1 Personnel Conduct: Contractor personnel shall adhere to standards of conduct as established by the DHA Director generally and any site-specific standards or rules established by Status of Forces Agreements (SOFAs) and local or installation commanders at sites where services are performed.

PART 2

2.0 Definitions, Acronyms, and applicable Publications

2.1 DHA Acronyms and Definitions: See Exhibit 4

2.2 Applicable Publications, policies, and Administrative Instructions (AI): The Contractor shall comply with all DHA and site policies, procedures, AIs, and practices throughout the life of the contract. The Government may identify relevant statues and policies in the TOs but lists in the contract are not intended to be fully inclusive of all DHA and local sites’ policies and instructions, which will also change over time. The Contractor may request the Government provide information on policies based on the work site for Contractor Personnel; however, the Contractor shall remain ultimately responsible for identifying and complying with all relevant or new policies and procedures as they are issued by the DHA or local site.

2.3 Applicable Statutes

• Privacy Act of 1974, (5 U.S.C. 552a eq. seq)

• Health Insurance Portability and Accountability Act (HIPAA) of 1996 and subsequent legislation https://www.hhs.gov/regulations/index.html

• Health Insurance Portability and Accountability Act of 1996 (Privacy Rule) effective October 15, 2002

• Health Insurance Portability and Accountability Act of 1996 (Security Rule) effective April 21, 2003

2.4 Department of Defense publications and instructions

• DHA Contractor Training Instructions

• DHA Administrative Instructions (DHA-AI)

• DHA-AI 074 Workforce Training Pursuant to the Requirements of the Privacy Act and the Health Insurance Portability and Accountability Act https://info.health.mil/cos/admin/pubs/DHA%20Administrative%20Instructions%20Signed/DH A-AI%20074.pdf

• DHA-AI 003, Physical Security Program https://info.health.mil/cos/admin/pubs/DHA%20Administrative%20Instructions%20Sig ned/DHA-AI%20003.pdf

• DHA- Procedural Instruction (PI) 8140.01 Acceptable use of DHA Information Technology

(IT)

https://info.health.mil/cos/admin/pubs/DHA%20Publications%20Signed/Acceptable%20Use%2 0of%20DHA%20Information%20Technology%20(IT).pdf

• DHA-PI 8160.01 Defense Health Program (DHP) System Inventory Management and Reporting https://info.health.mil/cos/admin/pubs/DHA%20Publications%20Signed/Defense%20Health%20 Program%20(DHP)%20System%20Inventory%20Management%20and%20Reporting.pdf

• DHA-PI 8000.01 Information Technology Infrastructure Service Delivery Management Program https://info.health.mil/cos/admin/pubs/DHA%20Publications%20Signed/Information%20Techno logy%20Infrastructure%20Service%20Delivery%20Management%20Program.pdf

• DHA-Procedural Instruction (PI) Cybersecurity Program Management (Updated)

(EXTENDED)

• DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT) https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/851001p.pdf?ver=2019-02- 26-101520-300

• DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/852002p.pdf

• DoDI 8520.03, Identity Authentication for Information Systems https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/852003p.pdf?ver=2019-02- 26-101529-723

• DoDI 8551.01, Ports, Protocols, and Services Management (PPSM) https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/855101p.pdf?ver=2019-02- 26-101525-833

• DoDD 8140.01, Cyberspace Workforce Management (2020) https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodd/814001p.PDF?ver=si7QmZ ONMCW2tStUt4ws3Q%3d%3d • DoD 8570.01-M, Information Assurance Workforce Improvement Program https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/857001m.pdf

• Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B, Cyber Incident Handling Program https://www.jcs.mil/Portals/36/Documents/Library/Manuals/m651001.pdf?ver=2016 02 05-175710-897

NOTE: The DHA documents (info.health.mil) are only available from within the Government network and will be accessible after award.

2.5 Other Publications

• Information Technology Infrastructure Library (ITIL) 4 https://www.axelos.com/certifications/itil-service-management/what-is-itil

• ITIL 4 Glossary https://www.axelos.com/glossaries-of-terms

• Committee on National Security Systems Instruction (CNSSI) 1253

• National Institute of Standards and Technology (NIST) Special Publications (SP)

• NIST SP 800-53 Rev 5 Security and Privacy Controls for Information Systems and Organizations https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

• NIST SP 800-53A Rev 5 Assessing Security and Privacy Controls in Information Systems and Organizations https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar5.pdf

• NIST SP 800-37 Rev 2 Risk Management Framework for Information Systems and Organizations https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf

• NIST SP 800-137 Information Security Continuous Monitoring (ISCM) for Federal

Information Systems and Organizations https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-137.pdf

• NIST SP 800-171 Rev 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r2.pdf

2.6 The Contractor shall coordinate with the DHA and local site to receive publications and procedures.

PART 3

3.0 Government Furnished Property (GFP), Equipment, and Services

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government will provide Government Furnished Services required in support of this contract/TOs.

3.2 Facilities: The Government will provide Facilities in support of this contract/TOs. The Government will provide the necessary facilities for the Contractor staff to provide the support identified in this PWS and any TO PWSs.

3.3 Utilities: For work performed within Government Facilities, the Government will provide access to any utilities reasonably required in the performance of this contract. The Contractor shall instruct employees in utilities conservation practices, and shall be responsible for operating under conditions that preclude the waste of utilities.

3.4 Equipment: The Government will provide equipment in support of this contract/TOs. The Government provided equipment is described below:

The Government will provide at the Government site, workstations to include telephones, facsimile machines, copiers and computer equipment to include laptops for use in performance under this TOs. This equipment is authorized for transaction of official Government business only and shall not be used for personal business.

The Government will provide software licenses for the Contractor’s use in delivering the Contractor Services.

Telephones, facsimile machines and computer equipment to include laptops are subject to communications security monitoring at all times. Personal long distance calls are not authorized.

The Contractor and may be issued keys signed for at scheduled and unscheduled key control inspections. The Contractor shall reimburse the Government for lost keys, or lockset (if lockset is required to be replaced) as a result of lost keys. The cost of replacement of keys/locksets may be deducted from payments to the Contractor.

Items issued will remain the property of the Government and the Contractor will maintain proper accountability of issued equipment.

Equipment shall not be removed from the site unless otherwise specified in the PWS. They are to be used, turned in and/or disposed of as directed by the COR or CO.

Upon the completion of Contractor Services, or as directed by the Government, the Contractor shall return to Government (or applicable Customer), any equipment or other property of Government (or applicable Customer) if not previously returned, in condition at least as good as the condition when made available to Contractor, ordinary wear and tear excepted.

3.4.1 Procurement Integrated Enterprise Environment (PIEE): The Contractor shall be responsible for obtaining and maintaining access, training and successful operation within the PIEE application for the entirety of the contract.

3.5 Materials: The Government will provide materials in support of this contract/TOs. The Government provided materials may be described in the TO or by staff at the site.

PART 4

4.0 Contractor Furnished Items and Services

4.1 The Contractor shall provide Services required in support of this contract and subsequently awarded TOs.

4.2 General: Not Applicable

4.4 Materials: The Contractor shall furnish materials, supplies, and equipment necessary to meet the requirements under this PWS and subsequent TO PWSs, except as provided in PWS part 3.

4.5 Equipment: Not Applicable

4.6 Facilities: Not Applicable

PART 5

5.0 The Contractor shall provide IT services to MTFs and OLBs while following all available standardized enterprise procedures as provided in GSP and subsequent TOs. The Contractor shall provide the following types of services as required by each Task Order.

5.1 Contract Management: The Contractor shall provide a CPM with cradle-to-grave project management services for all awarded TOs, including project coordination, transition-in, transition-out, monitoring, documentation, reporting, vendor communication, and review.

The CPM shall ensure that all Contractor Personnel support the Government management staff with deliverables, briefings, and updates as required or requested by the Government.

5.2 Scope Area 1: IT Service Desk:

The Contractor shall provide IT Service Desk Support Services in collaboration with the DHA GSC IAW the approved DHA standards. These include but are not limited to:

Manage ticket (incidents, cases, and requests) that have been assigned to the site (e.g. routed from the DHA GSC via the MHS Service Helpdesk Information Technology Service Management (ITSM) application).

Answer IT support calls and responding to questions Local site knowledge bases in ServiceNow Training of IT service desk staff Management of service catalog entries Direct calls that do not belong to the site back to tier 1 (i.e. GSC) Manage the IT Service Desk queue and complete work orders within the applicable SLAs for

MTFs/OLBs.

Mobile Device support for local wireless handheld devices (cell phones, smart phones, tablets, pagers and mobile hotspots).

Support local assets, new technology acquisition, and life cycle management for desktops, laptops, tablets, printers and other IT hardware through DHA Life-Cycle-Management (LCM).

Supports inventory management, and Defense Reutilization Marketing Office (DRMO) disposal IAW established guidance of site.

Support installation, changes, and removal of supported software. Provide troubleshooting of all approved DoD/DHA software, Operating Systems, and other DHA commercial off the shelf (COTS) and Government off the shelf (GOTS) applications as required.

Follow established DHA procedures to request and obtain software licenses.

For sites managing local call queues, such as with an Automated Call Distribution (ACD):

o Support of the Call Center telephony o New system installs and upgrades, including necessary IT security assistance o Script creation

5.3 Scope Area 2: Database, Application, and Web Development:

5.3.1 Database and Application Management: The Contractor shall implement and monitor database architectures, manage databases, and provide documentation. These include but are not limited to:

Support and develop using programming languages used by the site.

Support efficient use of database resources by reviewing system and programming designs.

Installation, maintenance, configuration and integrity of computer software.

Implement enhancements that will improve the reliability and performance Provide logical and physical database backup, verification and restoral.

Support application development and application support Provide technical guidance for how to analyze and derive metrics from large complex data sets using industry best practices.

Plan for changes in the size of Databases that result from business growth and project implementation based on information supplied by the site, and review plans with sites on a periodic basis.

Correct out-of-capacity situations caused by unusual activities in a timely manner (e.g., dataset or table space capacity events, full log files.)

Proactively monitor and prevent out-of-capacity situations (e.g., dataset or table space capacity events, full log files.)

Develop, document, and maintain Physical Database Support and management standards and Procedures based on industry best practices and business needs.

Define Database creation, Configuration, Upgrade, Patching and Refresh requirements Install, Configure, maintain, and monitor Database management systems.

Create Databases and Database system instances.

Create scheduled and on-demand Database snapshots and clones.

Perform Database snapshots and clones at request of authorized site staff.

Provide Databases with High Availability as defined by business requirements.

Assist sites with Database management system version upgrades and migrations.

Assist sites with determining which Database Service best meets the business requirements.

Assist sites with determining the feasibility and implementation of high Availability Databases.

Provide data dictionary expertise, data assistance, data warehouse metadata definition, data mapping functions and creation of data cubes for application developers.

Maintain Databases to meet the Service Levels Agreements or Operational Level Agreements and other performance…