GSP PWS draft 3.29.22.pdf

GSP PWS

Performance Work Statement 3

Geographic Service Providers (GSP) 5

Program Executive Office (PEO) Medical Systems (MS) / CIO J-6 7

Market Technology Integration Office (MTIO) 9

Solicitation Number: Draft 12 Date: 30 March 2022 13

Summary of Changes Section Changed Date

PART 1 19

1.0 General Information: Geographic Service Providers (GSP) Performance Work Statement 21

(PWS) 22

1.1 This is a non-personal services PWS to provide standardized enterprise IT support services to 24 Medical Treatment Facilities (MTF) and Other Lines of Business (OLB). 25

1.2 Description of services/introduction: The Contractor shall provide all personnel, supplies, 27 transportation, supervision, and non-personal services necessary to perform standardized 28 Information Technology (IT) services as defined in this Performance Work Statement (PWS) 29 except for those items specified as Government Furnished Property (GFP) and services in PWS 30 Part 3. The Contractor shall perform the requirements in this PWS and as ordered under IDIQ 31 Task Orders (TOs). Requirements in the GSP PWS are applicable for all Task Order (TO) PWSs 32 that may be issued in the future under the GSP basic contract. 33

1.3 Background: The Defense Health Agency (DHA) is the “centerpiece of the Military 35 Healthcare System (MHS) governance reform” (Deputy Secretary of Defense March 11, 2013, 36 memorandum, Implementation of Military Health System Governance Reform: 37 https://www.health.mil/Reference-Center/Policies/2013/03/11/Implementation-of-Military-38 Health-System-Governance-Reform) with the intention of tighter integration of healthcare 39 delivery systems to achieve medical readiness, improve health of people, enhance experience of 40 care, and lower healthcare costs. As a result, the Department of Defense (DoD) began a multi-41 year transition of MTFs from the military departments to the DHA for the purposes of 42 implementing an integrated system of readiness and health required by sections 702 and 703 of 43 the FY 2017 National Defense Authorization Act (NDAA) and updated in sections 711 and 712 44 of the FY 2019 NDAA. 45 Consistent with NDAA mandates, the DHA established the MHS Enterprise Information 47 Technology Services Program Management Office (EITS PMO) to provide a framework for 48 transforming MHS IT from the current decentralized model to centralized management and 49 coordination with distributed delivery. The MHS EITS strategy includes three major 50 components: EITS Integrator (EITSI), Capability Service Providers (CSPs), and GSPs. 51 Coordination between all three components is expected and essential for successful execution of 52 the DHA mission. 53

• The EITSI Contractor specializes in coordination, integration, and management activities and 54 replaces certain existing enterprise contracts, including the DHA Global Service Center (GSC). 55 The EITSI Contractor will coordinate with both CSPs and GSPs. 56

• CSPs are specialist Contractors that provide a particular IT capability or service to the entire 57 MHS Enterprise. 58

• GSPs are Contractors that perform a wide variety of IT tasks and services for MTFs and OLBs. 59

1.4 Objective: To acquire IT service support throughout the DHA enterprise supporting the 61 Continental United States (CONUS) and Outside the Continental United States (OCONUS) 62 MTFs and OLBs. 63

1.5 Scope: GSPs are Contractors that perform a wide variety of IT tasks and services to 65 standardize and provide robust IT support at MTFs and OLBs. GSP services may augment 66 enterprise capabilities. The Contractor(s) will provide the expertise, technical knowledge, staff 67 support, and other related resources necessary. GSP scope areas include: 68

• Scope Area 1: IT Service Desk 70

• Scope Area 2: Application and Web Development 71

• Scope Area 3: Identity Management and Desktop Support 72

• Scope Area 4: Data Center Operations 73

• Scope Area 5: Information Assurance 74

• Scope Area 6: Network Operations 75

• Scope Area 7: Telecommunications 76

• Scope Area 8: Clinical Informatics 77

• Scope Area 9: Information Technology Business Operations 78

The list of GSP labor categories that will perform the GSP Scope Areas. The Government may 80 add new labor categories, by modifying and publishing Exhibit 1, consistent with the GSP scope. 81

1.6 Ordering Period/Period of Performance (PoP): The ordering period will be 10 years from the 83 date of IDIQ award(s). TO PoP will be specified in the TOs. 84

1.6.1 Transition: Where required by TOs, the Contractor shall create, and obtain Government 86 approval of, a detailed Transition-In Plan and Transition-Out Plan addressing the transition and 87 implementation of Contractor services. Contractor shall submit the Transition-In Plan in 88 accordance with (IAW) the defined deliverable, see Part 7 Deliverable List (Deliverable 1). 89 Contractor shall submit the Transition-Out Plan in accordance with the defined deliverable, see 90 Part 7 Deliverable List (Deliverable 2). 91

1.6.1.1 Transition Reporting: The Contractor shall report on the execution of the Transition-In 93 Plan weekly until contractor services are fully deployed. Similarly, the contractor shall report on 94 the execution of the Transition-Out Plan weekly until the TO is complete. 95

1.6.1.2 Transition-In: The period between the award date and full performance start date of a TO 97 constitutes the Transition-In period. The transition-in period will be identified in the TO. During 98 the Transition-In period, the Contractor shall prepare to meet all TO requirements and ensure 99 incoming personnel are functionally trained and qualified on the full performance start date. 100

1.6.1.2.1 Additional Transition-In procedures may be required at the local site level. 102

1.6.1.2.2 In-Process Work Activities: Upon the full performance start date, as specified in the 104 TO, the Contractor shall assume responsibility for continuing the development, implementation, 105 and support of current projects and requests for services as identified by the Government. 106 During the Transition-In Period, the Contractor shall review current work activities with the 108 Government. 109

1.6.1.2.3 Transition-In Plan: Transition-In plans shall include: 112

• Review, evaluation, and transition of current support services 114

• Government-approved training and certification process 115

• Establish credentials for Contractor Personnel and for the transition of other credentials 116

• Transfer of hardware warranties and software licenses (if applicable) 117

• Transfer of all necessary operations and technical documentation 118

• Transfer of compiled and un-compiled source code, to include all versions, maintenance 119 updates and patches (if applicable) 120

• Orientation phase to introduce Government personnel and users to the Contractor's team, tools, 121 methodologies, and business processes 122

• Transfer of Government Furnished Equipment (GFE) and Government Furnished Information 123 (GFI), and GFE inventory management assistance 124

• Applicable DHA, site, and contract company briefing and Contractor Personnel onboarding 125 procedures 126

• Coordinate with the Government to account for Government keys, ID/access cards, security 127 codes, and alternative tokens 128 When required by the TO, the Contractor shall provide the Government with a written evaluation 130 and assessment of the status of all current projects in accordance with the deliverable, see Part 7 131 Deliverable List (Deliverable 3). 132

1.6.1.3 Transition-Out: The Contractor shall execute transition out based on the approve plan. 134 The Contractor shall complete all transition-out activities IAW individual TOs and the transition-135 out plan. Transition may be to a Government entity, another Contractor under contract, or to the 136 Contractor under a new contract. The Contractor shall assist the Government in planning and 137 implementing a complete transition from this contract and any TOs issued under this contract to 138 a successor. This shall include formal coordination with Government staff and successor staff 139 and management. It shall also include delivery of items such as copies of existing policies and 140 procedures, and delivery of required metrics and statistics. 141

1.6.1.3.1 The Contractor shall not allow performance to degrade during transition-out. Except as 143 approved by the Government, the Contractor shall not make any changes to the transition-out 144 plan. Transition-Out Assistance will include the assistance and obligations, as requested by 145 Government, described in the Transition-Out Plan. 146

1.6.1.3.2 Transition-Out Plan: The Contractor’s transition-Out plans shall include: 148

• Review, evaluation, and transition of current support services 149

• Government-approved training and certification process 150

• Transfer of hardware warranties and software licenses (if applicable) 151

• Transfer of all necessary operational and technical documentation 152

• Transfer of compiled and un-compiled source code, to include all versions maintenance 153 updates and patches (if applicable) 154

• Orientation phase to introduce Government personnel and users to the Contractor's team, tools, 155 methodologies, and business processes 156

• Transfer of Government Furnished Equipment (GFE) and Government Furnished Information 157 (GFI), and GFE inventory management assistance 158

• Applicable DHA, site, and contract company debriefing and Contractor Personnel out-159 processing procedures 160

• Turn-in of all Government keys, ID/access cards, security codes, and alternative tokens. 161

1.7 Administrative specifications 163

1.7.1 Place of performance: The Contractor shall perform IT Services at various locations within 165 the CONUS, OCONUS, and virtually as specified in individual TOs. Individual Locations are 166 listed in Exhibit 2. Multiple geographic locations may be consolidated in individual TOs. 167

1.7.1.1 The Contractor shall identify virtual Contractor Personnel both in the TO proposal as 169 well as in communications with the Government to include the MTFs or OLBs. 170

1.7.1.2 The Contractor shall complete all initial and ongoing telework requirements if telework 172 authorization is provided by the MTF or OLB. The Contractor shall meet all telework 173 responsibilities for teleworking Contractor Personnel. 174

1.7.2 Recognized Federal holidays: 176

New Year’s Day Labor Day 177 Martin Luther King Jr.’s Birthday Columbus Day 178 President’s Day Veteran’s Day 179 Memorial Day Thanksgiving Day 180 Juneteenth Day Christmas Day 181 Independence Day 182

1.7.3 Hours of operation: The Contractor shall conduct business during hours specified in TOs 184 except Federal holidays unless otherwise specified in the TO. 185

1.7.3.1 Non-standard work hours may be required in support of after-hours IT requirements that 187 may not be performed during normal duty hours, as directed by local site Chief Information 188 Officer (CIO) or IT Director. 189

1.7.3.2 Closures: During a planned closure of the facility due to training, holiday or unplanned 191 closure due to unusual and compelling circumstances (e.g., natural disasters, military 192 emergencies, severe weather) the Contractor will only be paid for the actual hours the Contractor 193 Personnel provided services, unless otherwise identified in the TO or by the CO. 194

1.7.4. Hours of Performance: The Contractor shall provide Contractor Personnel for 1880 Hours 196 per year unless TO specifies a different number of hours. The first 12 months of performance are 197 expected to work approximately 1730 Hours due to 30 days of recruiting and security type 198 delays. This is non-billable. 199

1.7.5 Personnel Invoicing: The Contractor shall ensure the stability and continuity of its 201 workforce and at all times maintain an adequate workforce for the uninterrupted performance of 202 associated PWS tasks and performance standards. The Contractor shall provide services IAW its 203 proposed approach and/or staffing plan and all Contractor personnel shall be qualified for the 204 labor category in which they are performing. 205 The Contractor shall not invoice for vacancies based on the Contractor’s proposed approach 207 and/or staffing plan. The Contractor shall make a pro-rated reduction to the monthly invoice 208 based on the number and duration of vacancies compared to the proposed staffing plan. 209

1.7.6 Recording time: The Contractor shall be responsible for recording arrival and departure 211 times, reporting absenteeism, and signing timesheets for Contractor Personnel, unless otherwise 212 identified in the TO. This information shall be provided to the Government upon request by the 213

COR. 214

1.8 Contractor Travel: The Contractor may be required to travel within/between CONUS or 216 OCONUS locations to participate in conferences, meetings, to support mission objectives, or 217 other events. Except for local travel as provided in section 1.8.1, the Contractor will be 218 authorized reimbursement of travel expenses consistent with the substantive provisions of the 219 Joint Travel Regulation (JTR), the cost principles and procedures in Federal Acquisition 220 Regulation (FAR) Part 31.2, Travel Costs, and the limitations of funds for ODCs specified in 221 individual TOs. All travel requires Government approval and authorization by the COR prior to 222 travel. Arrangements for and costs of all travel, transportation, meals, lodging, and incidentals 223 are the responsibility of the Contractor. The Contractor shall ensure good stewardship of travel 224 funds, with all travel complaint with, and adhering to, Government per diem rates whenever 225 possible. Travel costs shall be incurred and billed in accordance with FAR Part 31. Costs for 226 these expenses will be reviewed by the COR, and approved to the extent they are allowable and 227 allocable to this contract. Travel shall be reported in the Monthly Progress Report as described 228 in the Performance Requirements Summary. 229

1.8.1 Local and Non-local Travel: Travel within a 50-mile radius from the individuals' primary 231 place of performance will not be reimbursed (e.g., subsistence, travel time, or other travel related 232 expenses). Travel greater than a 50-mile radius from the individuals' primary place of 233 performance is considered non-local travel and will be reimbursed in accordance with section 1.8 234 above. 235

1.8.2 OCONUS Travel: OCONUS travel requirements will be addressed by specific TOs. The 237 Contractor shall comply with any Status of Forces Agreement (SOFA) and other country specific 238 requirements to travel and work overseas. Prior to OCONUS travel, the Contractor shall 239 coordinate with the COR at least 20 business days prior to travel. The Contractor shall comply 240 with requirements in the DoD Electronic Foreign Clearance Guide for all travel outside the 241 United States. The Contractor shall also obtain information on, and adhere to, any specific 242 country/theater-specific clearances, specialized training, or other requirements necessary for the 243 type of intended travel to that country/theater as early as possible prior to travel so as to meet all 244 lead times. Further guidance for Contractor travel can be found at 245 https://www.defensetravel.dod.mil/site/faqctr.cfm. Additional OCONUS travel requirements 246 https://www.defensetravel.dod.mil/site/faqctr.cfm may be provided as necessary in individual TOs. 247

1.8.3 Approval for Travel: The Contractor shall ensure that travel and travel costs are approved 249 by the CO prior to travel per DHA and/or site requirements. The Contractor shall schedule travel 250 at least two weeks in advance whenever possible to maximize savings to the Government 251 through receiving the best travel rates available. The Contractor shall ensure good stewardship of 252 travel funds, and shall seek rates lower than per diem whenever possible. 253

1.8.4 Trip Reports: The Contractor shall submit a trip report per DHA or site requirements within 255 5 working days after completion of travel. The trip report typically includes: 256

• Personnel traveled 258

• Dates of travel 259

• Destination(s) 260

• Purpose of Trip; contract effort supported; Government Agency supported (if applicable), 261 explain the benefits of the travel to the Government. 262

• Actual Trip Costs 263

• Approval Authority 264

• Summary of events 265

1.9 Other Direct Costs (ODCs): All reimbursable ODCs (including travel) will be identified in 267 individual TOs and must be authorized by the CO or COR prior to purchase and be in 268 conformance with TO requirements and IAW the FAR Subpart 31. 269

1.9.1 The Contractor shall bill TO ODCs on a cost reimbursable, no-fee basis. Contractor will be 271 authorized reimbursement of ODC expenses consistent with the limitation of funds for ODCs 272 specified in the individual TO. All ODCs shall be reported in the Monthly Progress Report as 273 described in the Performance Requirements Summary. 274

1.9.2 The Contractor shall receive prior approval for all ODCs from the CO or COR. The ODC 276 Approval Request shall include a description of the item(s) to be procured, the part number if 277 applicable, identification of the sources and prices found with the recommended source 278 highlighted, the quantity of each item to be procured, a total price prior to the application of 279 Contractor indirect rates, the total indirect costs, a total price, and the delivery date. If the 280 delivery date is expedited, resulting in additional or greater cost, a rationale shall be provided. 281 After Government approval, the Contractor shall be responsible for procuring and ensuring 282 delivery and receipt of the items procured. After items have been procured and received, a 283 detailed invoice with a breakdown of expenses shall be submitted to the COR. 284

1.10 Quality: The Contractor shall develop and maintain an effective quality control (QC) 286 program to ensure services are performed IAW this PWS and any TO PWSs. The Contractor 287 shall develop and implement procedures to identify, prevent, and ensure no recurrence of 288 defective services. The Contractor’s QC program is the means by which the work complies with 289 stated requirements. The QCP shall document how the Contractor will meet and comply with the 290 quality standards established in this PWS. Within 5 days of award, the contractor shall submit its 291 QCP in accordance with the contract deliverable, see Part 7 Deliverable List (Deliverable 4). 292

1.11 Contractor Personnel 294

1.11.1 The Contractor shall comply with the onboarding processes for the site to which they are 296 assigned; details will be included in TOs or provided after award. Onboarding processes may 297 include but are not limited to: mission orientation, background investigation, Common Access 298 Card (CAC) issuance, Joint Knowledge Online (JKO) mandatory/annual training, network 299 access, access to classified information and/or systems (if required), employee emergency 300 notification service registration. 301

1.11.2 Contractor Personnel Security Investigation: The Contractor shall comply with the 303 security background investigation, screening requirements and processes as described in Part 6 304 of this PWS. Additional site specific security requirements may be included in TOs. 305

1.11.3 The Contractor Personnel shall comply with Exhibit 3 DHA New Employee Handbook 307 and/or local site new employee processes. 308

1.11.4 The Contractor Personnel shall complete all DHA or site specific orientation program(s), 310 initial and annual training requirements. 311

1.11.5 Contractor Personnel Qualification: The Contractor shall ensure personnel it assigns or 313 utilizes in the performance of this contract meet the requirements of the roles to which they are 314 assigned, including at a minimum, the experience, educational, certification, and other 315 requirements set forth in Exhibit 1 GSP Labor Categories of this PWS and are fully capable of 316 performing in an efficient, reliable, and professional manner. 317

1.11.6 The Contractor shall ensure that all Contractor personnel shall be required to complete 319 and sign a DHA or site Contractor Non-Disclosure Agreement (NDA) (DHA Form 49) during in 320 processing or prior to access to the Government’s system. The Contractor shall maintain 321 originally signed NDAs of individual employees and provide copies to the COR. 322 The Contractor shall report any violations to the terms in the NDA to both the Government COR 324 and Government CO within 1 day of the violation. 325

1.11.7 Emergency Services: The Contractor shall provide support in the event that local site or 327 DHA requires support during an activation or exercise of contingency plans outside the normal 328 duty hours. 329

1.11.8 Health Requirements: The Contractor shall provide documentation certifying health 331 requirements such as immunizations, annual vaccinations, medical testing and physical 332 examination when required at the time of initial placement and annually thereafter, as required 333 by the site. The expense for all health requirements, to include monitoring and tracking annual 334 requirements, shall be borne by the Contractor at no additional cost to the Government. 335

1.11.8.1 Annual Immunizations: The Contractor shall ensure Contractor Personnel are 337 immunized annually with the seasonal influenza vaccine (when the current seasonal influenza 338 vaccine is available) and any other vaccine recommended by the Advisory Committee on 339 Immunization Practices (ACIP) of the Centers for Disease Control (CDC) per site requirements. 340

1.11.8.2 Immunization Tracking: The Contractor shall maintain its own process and system of 342 tracking the currency of health immunizations and shall not rely on the Government for ensuring 343 their employees are in compliance. 344

1.11.8.3 Tuberculosis: In those areas where there is a higher risk of transmission of tuberculosis, 346 local site policy may direct Contractor Personnel be tested more frequently at no cost to the 347 Government. 348

1.11.9 Removal of Contractor Personnel from the site and/or contract performance: The 350 Contractor shall remove Contractor Personnel if the Government directs the removal of any 351 worker, from their assigned site, who demonstrates a health, safety, Health Insurance Portability 352 and Accountability Act (HIPAA) violation, mission risk, or site policy violation. In the event the 353 Government directs the removal, from the assigned site, of a Contractor Personnel, the TO CO 354 may direct the submission of a corrective action plan and issue a stop work order while the 355 Contractor's response, Contractor's implementation of the plan, and/or any Government 356 investigation is pending. 357

1.11.9.1 If the need for a removal occurs, the COR will contact the Contract Company 359 Representative and direct the Contractor to remove the individual from the site. The Contractor 360 shall not use individuals removed under such circumstances to perform any services under the 361 TO unless authorized by the CO. The Contractor shall formally meet with the CO to discuss 362 further action. A review of the basis for removal will be made by the CO within 3 business days 363 after the COR directed the removal. 364

1.11.9.3 Access Removal for Deficient Certification: The Contractor shall ensure that all 366 Contractor Personnel have proper and current certifications for their roles and responsibilities in 367 providing Contractor services, and deny access to DoD information systems to personnel without 368 such training and certifications. 369

1.11.10 Continuity of Operations: The Government has identified all or a portion of the 371 contractor services to be performed under this contract as essential contractor services in support 372 of mission essential functions. Notwithstanding any other clause of this contract, the 373 Contractor shall be responsible to ensure continued performance of those services and functions 374 identified as essential contractor services during emergency or other crisis situations that disrupt 375 normal operations in accordance with Contractor’s Continuity of Operations Plan (COOP) and 376 DFARS clause 252.237-7023, Notice of Continuation of Essential Contractor Services. 377 Situations include pandemics, natural disasters or other acts of nature, severe weather, and 378 technological and/or attack related emergencies. The COOP addresses the requirements in DoDD 379 3020.26, the “National Continuity Policy Implementation Plan,” August 2007. 380

1.11.11 Organizational Conflict of Interest (OCI): The Contractor and Contractor Personnel 382 performing work under this contract may receive, have access to or participate in the 383 development of proprietary or source selection information (e.g., cost or pricing information, 384 budget information or analysis, specifications or work statements) or perform evaluation services 385 which may create a potential or actual OCI as defined in FAR Subpart 9.5. The Contractor shall 386 notify the CO immediately whenever it becomes aware that such access or participation may 387 result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer 388 to avoid or mitigate any such OCI. The Contractor’s mitigation plan will be determined to be 389 acceptable solely at the discretion of the Contracting Officer and in the event the Contracting 390 Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, 391 the Contracting Officer may affect other remedies as he or she deems necessary, including 392 prohibiting the Contractor from participation in subsequent contracted requirements which may 393 be affected by the OCI. 394

1.11.12 Physical Security: The Contractor shall be responsible for safeguarding all Government 396 equipment, information and property provided for use by Contractor personnel. Contractor shall 397 comply with safeguarding IAW DHA-AI 003 Physical Security Program, all applicable 398 FAR/DFARS clauses in the contract or TOs, and local site Standard Operating Procedures 399 (SOPs). 400

1.11.12.1 The Contractor shall comply with the local installation and MTF/OLB physical 402 security, personnel identification (including identification badges), and access requirements. 403

1.11.12.2 Lock combinations: The Contractor shall establish and implement methods of ensuring 405 that lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that 406 lock combinations are changed when personnel having access to the combinations no longer 407 have a need to know such combinations. These procedures shall be included in the Contractor’s 408

QCP. 409

1.12 Contractor Program Manager (CPM): The Contractor shall assign a single CPM as the 411 primary point of contact for all GSP performance, i.e., responsible for both the IDIQ contract and 412 all awarded TOs. The CPM is a senior level manager and responsible for and able to take action 413 on behalf the company is regards to all GSP related TOs. The CPM does not have to be the 414 Contractor’s Contracts Manager and the CPM will not have to sign contracts. Individual TOs 415 may require assignment of TO Key Personnel. 416

1.12.1 The Contractor shall assign a back-up CPM in the event the primary is unavailable. 418

1.12.2 The Contractor shall provide the Government with the resume of the incoming CPM if the 420 incumbent CPM will no longer be assigned GSP responsibilities. The Contractor shall not assign 421 a new CPM without Government’s approval. 422

1.12.3 The Government may designate Key Personnel at the TO level. Details will be provided 424 in the Exhibit 1 GSP Labor Categories or as specified in individual TOs. 425

1.12.4 Post Award Conference: The Contractor, to include CPM, shall attend a contract post 427 award conference established by the CO within 20 days of contract award. The Contractor also 428 agrees to attend any post award conference or progress meeting convened by the contracting 429 activity or contract administration office IAW FAR Subpart 42.500, Post-award Orientation. 430 Post award conference(s) for TOs will be specified in the TOs’ PWS. 432

1.12.5 Periodic Progress Meetings: The CPM shall attend all periodic progress meetings, as 434 needed. At these meetings, the CO and/or the COR will apprise the Contractor of how the 435 Government views the Contractor's performance and the Contractor will apprise the Government 436 of problems, if any, being experienced as well as any identified risks. These meetings shall be at 437 no additional cost to the Government. 438

1.12.6 The CPM shall attend annual in-person meetings held in the National Capital Region or 440 San Antonio, TX for no more than 2 days in length, or held virtually. 441

1.13 Data rights: Except as may be provided in individual TOs, all documents and materials 443 produced and delivered under this contract shall be Government owned and are the property of 444 the Government with all rights and privileges of ownership/copyright belonging exclusively to 445 the Government. The Contractor shall also deliver to the Government the source code of all 446 software developed and funded under this contract (including noncommercial modifications to 447 commercial software), for which the Government will have unlimited rights. Documents and 448 materials delivered to the Government under this contract may not be otherwise used or sold by 449 the Contractor without written permission from the Contracting Officer. These rights do not 450 abrogate any other Government rights. The Government’s rights in any technical data, non-451 commercial computer software (including noncommercial modifications to commercial 452 software), or noncommercial software documentation under this contract are in accordance with 453 the Defense Federal Regulations Supplement (DFARS) clauses contained in the contract. The 454 Government’s rights in any commercial computer software under this contract shall be specified 455 by separate commercial supplier/licensing agreements, which shall be made a part of this 456 contract so long as preapproved, and executed, by the Contracting Officer. 457

1.14 Reporting: The Contractor shall track the status of all deliverables, including required 459 submission timeframes, approvals, rejections, revisions, plans, and all other actions related to 460 successful completion of deliverables in the Monthly Performance Report. The Contractor shall 461 submit the Monthly Performance Report in accordance with (IAW) the defined deliverable, see 462 Part 7 Deliverable List (Deliverable 5). 463

1.14.1 Deliverables Schedule: The Contractor shall adhere to the schedule of deliverables as 465 identified in both the IDIQ PWS and the TO PWS(s). 466

1.14.2 Deliverable Review Statement: The Government will provide the Contractor a written 468 statement indicating Acceptance or Rejection of the Deliverable. 469 Acceptance will occur only through a written statement provided to the Contractor by the CO or 471 COR. In no event will a Deliverable be deemed to be accepted by Government, even where 472 payment is made for the Deliverable, or the Deliverable is used in production, or any other basis, 473 where there has been no issuance of a written acceptance statement. 474

1.14.3 Rejection of Deliverables: If the Contractor receives a written statement indicating 476 Rejection of a Deliverable, the Contractor shall within five (5) calendar days provide a proposed 477 resolution, which could include repairing, replacing, or reperforming the nonconforming items or 478 services or else a request that the Government formally accept the nonconforming items/services 479 in exchange for an equitable price reduction or other adequate consideration. 480

1.14.4 Revision after Acceptance: In the event of a discovery of a defect in a previously 482 Accepted Deliverable, where such defect would have qualified as a Non-Conformity at the time 483 of Acceptance, upon notification by Government or the applicable Customer, the Contractor 484 shall, at no additional charge, repair or replace or otherwise correct the Non-Conformity to the 485 level of performance specified in the TO. 486

1.14.5 Deliverable Format: Unless specified otherwise in a TO, the Contractor shall submit 488 deliverables in the form of a Microsoft Office document, using the version in use by the 489 Government at the time of submission, where such deliverables, reports, and other documents are 490 delivered to the Government outside of a system by the Contractor as part of Contractor services. 491 Deliverable formats and templates may be further specified in TOs. 492

1.14.6 Non-Proprietary: In no event, shall the Contractor submit any document or other 494 deliverable for performance of Contractor services marked “Proprietary.” 495

1.15 Contractor identification: All Contractor personnel shall identify themselves as Contractor 496 personnel in all forms of communication. 497

1.15.1 Contractor personnel shall be required to attend meetings or otherwise communicate with 498 Government and/or other contract representatives. Contractor personnel shall make their 499 Contractor status known during introductions. 500

1.15.2 Contractor personnel, while performing in a Contractor capacity, are prohibited from 501 using their retired or reserve component military rank or title in any written or verbal 502 communications associated with the contracts in which they provide services. 503

1.16 RESERVED 505

1.17 Personnel Security: The Contractor shall comply with DoD 8570.01-M, “Information 507 Assurance Workforce Improvement Program, CH4” November 10, 2015 as amended; DoDI 508 8500.01, “Cybersecurity”, dated October 7, 2019; DoD Manual (DoDM) 6025.18, 509 “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy 510 Rule Compliance in DoD Health Care Programs” dated March 3, 2019, Department of Defense 511 Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, 512 dated March 13, 2019; and DoDM 5200.02 “Procedures for the DoD Personnel Security 513 Program (PSP),” incorporation change 3, effective September 24, 2020. These publications are 514 available here: https://www.esd.whs.mil/DD/DoD-Issuances/. Contractor responsibilities for 515 ensuring personnel security include, but are not limited to, meeting the following requirements: 516

1.17.1 Personnel Conduct: Contractor personnel shall adhere to standards of conduct as 518 established by the DHA Commander generally and any site-specific standards or rules 519 established by Status of Forces Agreements (SOFAs) and local or installation commanders at 520 sites where services are performed. 521 https://www.esd.whs.mil/DD/DoD-Issuances/

PART 2 528

2.0 Definitions, Acronyms, and applicable Publications 530

2.1 Acronyms and Definitions: See Exhibit 4 532

2.2 Applicable Publications, policies, and Administrative Instructions (AI): The Contractor shall 534 comply with all DHA and site policies, procedures, AIs, and practices throughout the life of the 535 contract. The Government may identify relevant statues and policies in the TOs but lists in the 536 contract are not intended to be fully inclusive of all DHA and local sites’ policies and 537 instructions, which will also change over time. The Contractor may request the Government 538 provide information on policies based on the work site for Contractor Personnel; however, the 539 Contractor shall remain ultimately responsible for identifying and complying with all relevant or 540 new policies and procedures as they are issued by the DHA or local site. 541

2.3 Statutes 542

• Privacy Act of 1974, (5 U.S.C. 552a eq. seq) 543

• Health Insurance Portability and Accountability Act (HIPAA) of 1996 and subsequent 544 legislation https://www.hhs.gov/regulations/index.html 545

• Health Insurance Portability and Accountability Act of 1996 (Privacy Rule) effective October 546 15, 2002 547

• Health Insurance Portability and Accountability Act of 1996 (Security Rule) effective April 548 21, 2003 549

2.4 Department of Defense publications and instructions 550

• DHA Contractor Training Instructions 551

• DHA Administrative Instructions (DHA-AI) 552

• DHA-AI 074 Workforce Training Pursuant to the Requirements of the Privacy Act and the 553 Health Insurance Portability and Accountability Act 554 https://info.health.mil/cos/admin/privacy/Training%20Awareness/Training%20%20Awareness%555 20Library/2014 DHA%20AI%2074_WorkforceTrainingPolicy%20(2).pdf 556

• DHA-AI 003, Physical Security Program 557

• DHA-PI 8140.01 Acceptable use of DHA Information Technology (IT) 558 https://info.health.mil/cos/admin/pubs/DHA%20Publications%20Signed/Acceptable%20Use%2559 0of%20DHA%20Information%20Technology%20(IT).pdf 560

• DHA-PI 8160.01 Defense Health Program (DHP) System Inventory Management and 561 Reporting 562 https://info.health.mil/cos/admin/pubs/DHA%20Publications%20Signed/Defense%20Health%20563 Program%20(DHP)%20System%20Inventory%20Management%20and%20Reporting.pdf 564

• DHA-IPM 18-007 Service Delivery Management Program (EXTENDED) 565 https://info.health.mil/cos/admin/pubs/DHA%20Publications%20Signed/Service%20Delivery%2566 0Management.pdf 567

• DHA-IPM 18-009 Military Health System (MHS Enterprise Architecture- (EXXTENDED) 568 https://info.health.mil/cos/admin/pubs/DHA%20Publications%20Signed/Military%20Health%20569 System%20(MHS)%20Enterprise%20Architecture (EXTENDED).pdf 570 https://www.hhs.gov/regulations/index.html

• DHA-IPM 18-010 Medical Community of Interest Circuits (EXTENDED) 571 https://info.health.mil/cos/admin/pubs/DHA%20Publications%20Signed/Medical%20Communit572 y%20of%20Interest%20Circuits%20(EXTENDED).pdf 573

• DHA-IPM 18-015 Cybersecurity Program Management (Updated) (EXTENDED) 574 https://info.health.mil/cos/admin/pubs/DHA%20Publications%20Signed/Cybersecurity%20Progr575 am%20Management%20(Updated)%20(EXTENDED).pdf 576

• DoDI 8510.01, Risk Management Framework (RMF) 577 https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/851001p.pdf?ver=2019-02-578 26-101520-300 579

• DoDI 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling 580 https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/852002p.pdf 581

• DoDI 8520.03, Identity Authentication for Information Systems 582 https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/852003p.pdf?ver=2019-02-583 26-101529-723 584

• DoDI 8551.01, Ports, Protocols, and Services Management (PPSM) 585 https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/855101p.pdf?ver=2019-02-586 26-101525-833 587

• DoDI 8582.01, Security of Unclassified DoD Information on non-DoD Information Systems 588 https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/858201p.pdf 589

• DoDD 8140.01, Cyber Workforce Management (2015) 590 http://www.dtic.mil/whs/directives/corres/pdf/814001_2015_dodd.pdf 591

• DoDM 8570.01-M, Information Assurance Workforce Improvement Program 592 https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodm/857001m.pdf 593

• Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B, Cyber Incident Handling 594 Program https://www.jcs.mil/Portals/36/Documents/Library/Manuals/m651001.pdf?ver=2016 02 595 05-175710-897 596 NOTE: The DHA documents (info.health.mil) are only available from within the Government 598 network and will be accessible after award. 599

2.5 Other Publications 600

• Information Technology Infrastructure Library (ITIL) 4 601 https://www.axelos.com/itil-4 602

• ITIL 4 Glossary 603 https://www.axelos.com/glossaries-of-terms 604

• Committee on National Security Systems Instruction (CNSSI) 1253 605

• National Institute of Standards and Technology (NIST) Special Publications (SP) 606

• NIST SP 800-53 Rev 4 Security and Privacy Controls for Federal Information Systems and 607 Organizations 608 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf 609

• NIST SP 800-53A Rev 4 Assessing Security and Privacy Controls in Federal Information 610 Systems and Organizations 611 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar4.pdf 612

• NIST SP 800-37 Rev 2 Risk Management Framework for Information Systems and 613 Organizations (RMF) 614 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf 615

• NIST SP 800-137 Information Security Continuous Monitoring (ISCM) for Federal 616 Information Systems and Organizations 617 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-137.pdf 618

• NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Information 619 Systems and Organizations 620 https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r1.pdf 621

2.6 The Contractor shall coordinate with the DHA and local site to receive publications and 623 procedures. 624

PART 3 627

3.0 Government Furnished Property (GFP), Equipment, and Services 629

The Requiring Activity Authority has assessed the need for Government Furnished Property, 631 Equipment, and Services and determined: 632

3.1 Services: The Government: 634

☐ Will NOT provide Government Furnished Services in support of this contract/TO. As a result, 636 this paragraph is Not Applicable. 637 ☒ WILL provide Government Furnished Services required in support of this contract/TOs. 639 These Services are described below: provide 640 The Government will provide services detailed in the PWS and subsequent TOs. 642

3.2 Facilities: The Government: 644

☐ Will NOT provide Facilities in support of this contract/TO. As a result, this paragraph is Not 646 Applicable. 647 ☒ WILL provide Facilities in support of this contract/TOs. The Government provided Facilities 649 are described below: 650

• The Government will provide the necessary facilities for the Contractor staff to provide the 652 support identified in this PWS and any TO PWSs. 653

3.3 Utilities: For work performed within Government Facilities, the Government will provide 655 access to any utilities reasonably required in the performance of this contract. The Contractor 656 shall instruct employees in utilities conservation practices, and shall be responsible for operating 657 under conditions that preclude the waste of utilities. 658

3.4 Equipment: The Government: 660

☐ Will NOT provide Equipment in support of this contract/TO. As a result, this paragraph is Not 662 Applicable. 663 ☒ WILL provide Equipment in support of this contract/TOs. The Government provided 665 Equipment is described below: 666

• The Government will provide at the Government site, workstations to include telephones, 668 facsimile machines, copiers and computer equipment to include laptops for use in performance 669 under this TOs. This equipment is authorized for transaction of official Government business 670 only and shall not be used for personal business. 671

• The Government will provide software licenses for the Contractor’s use in delivering the 672 Contractor Services. 673

• Telephones, facsimile machines and computer equipment to include laptops are subject to 674 communications security monitoring at all times. Personal long distance calls are not authorized. 675

• The Contractor and may be issued keys signed for at scheduled and unscheduled key control 676 inspections. The Contractor shall reimburse the Government for lost keys, or lockset (if lockset is 677 required to be replaced) as a result of lost keys. The cost of replacement of keys/locksets may be 678 deducted from payments to the Contractor. 679

• Items issued will remain the property of the Government and the Contractor will maintain 680 proper accountability of issued equipment. 681

• Equipment shall not be removed from the site unless otherwise specified in the PWS. They are 682 to be used, turned in and/or disposed of as directed by the COR or CO. 683

• Upon the completion of Contractor Services, or as directed by the Government, the Contractor 684 shall return to Government (or applicable Customer), any equipment or other property of 685 Government (or applicable Customer) if not previously returned, in condition at least as good as 686 the condition when made available to Contractor, ordinary wear and tear excepted. 687

3.4.1 Procurement Integrated Enterprise Environment (PIEE): The Contractor shall be 689 responsible for obtaining and maintaining access, training and successful operation within the 690 PIEE application for the entirety of the contract/Government 691

3.5 Materials: The Government: 693

☐ Will NOT provide Materials in support of this contract/TO. As a result, this paragraph is Not 695 Applicable. 696 ☒ IS providing Materials in support of this contract/TOs. The Government-provided Materials 698 are described below: 699 Government provided materials may be described in the TO or by staff at the site. 701

PART 4 704

4.0 Contractor Furnished Items and Services 706

4.1 Services: The Contractor: 708

☐ Will NOT provide Contractor Furnished Services in support of this contract/TO. As a result, 710 this paragraph is Not Applicable. 711 ☒ WILL provide Contractor Furnished Services required in support of this contract/TOs. These 713 Services are described below: 714

4.2 General: The Contractor shall furnish all supplies, equipment, facilities, and services required 716 to perform work listed under Part 5 of this PWS, other than those specified in Part 3. 717

4.4 Materials: The Contractor shall furnish materials, supplies, and equipment necessary to meet 719 the requirements under this PWS, except as provided in PWS part 3. 720

4.5 Equipment: Not Applicable 722

4.6 Facilities: Not Applicable 724

PART 5 727

5.0 The Contractor shall provide IT services to MTFs and OLBs while following all available 729 standardized enterprise procedures as provided in GSP and subsequent TOs. The Contractor shall 730 provide the following types of services. 731

5.1 Contract Management: The Contractor shall provide a CPM with cradle-to-grave project 733 management services for all awarded TOs, including project coordination, transition-in, 734 transition-out, monitoring, documentation, reporting, vendor communication, and review. 735 The CPM shall ensure that all Contractor Personnel support the Government management staff 737 with briefings and updates as required. 738

5.2 IT Help Desk: 740

The Contractor shall provide Help Desk Support Services in collaboration with the DHA Global 742 Service Center (GSC) IAW the approved DHA standards. These include: 743

• Manage ticket (incidents, cases, and requests) that have been assigned to the site (e.g. routed 744 from the DHA Global Service Center (GSC) via the MHS Service Helpdesk ITSM application). 745

• Answer IT support calls and responding to questions 746

• Local site knowledge bases 747

• Training of help desk staff 748

• Management of service catalog entries 749

• Direct calls that do not belong to the site back to tier 1 (i.e. GSC) 750

• Manage the IT Help Desk queue. 751

• Mobile Device support for local wireless handheld devices (cell phones, smart phones, tablets, 752 pagers and mobile hotspots). 753

• Support local assets, new technology acquisition, and life cycle management for desktops, 754 laptops, tablets, printers and other IT hardware through DHA Life-Cycle-Management (LCM). 755 Supports inventory management, and Defense Reutilization Marketing Office (DRMO) disposal 756 IAW established guidance of site. 757

• Support installation, changes, and removal of supported software. Provide troubleshooting of 758 all approved DoD/DHA software, Operating Systems, and other DHA commercial off the shelf 759 (COTS) and Government off the shelf (GOTS) applications as required. 760

• Follow established DHA procedures to request and obtain software licenses. 761

• For sites managing local call queues, such as with an Automated Call Distribution (ACD): 762 o Support of the Call Center telephony 763 o New system installs and upgrades, including necessary IT security assistance 764 o Script creation 765

5.3 Application and Web Development: 767

The Contractor shall provide application(s), database administration, and web development and 769 support services to meet the needs of multiple levels within the organization. The Contractor 770 shall: 771

• Create customer web and scripting applications using platforms including, but not limited to: 773 SharePoint, ASP, .NET, and JAVA platforms IAW local site requirements. 774

• Use COTS and third party-packages IAW DHA or DoD approved Software Development Life 775 Cycle (SDLC). 776

• Use Applications and Web Development process definition, certification, validation and 777 verification, architecture and reengineering, security and configuration management IAW DHA 778 standards. 779

• Apply, implement, document and gain approval for application Security Technical 780 Implantation Guidelines (STIGs). 781

• Create, administer and support custom web and scripting applications using platforms 782 including, but not limited to: SharePoint, .ASP, .NET, and/or JAVA. 783

• Provide Subject Matter Expert (SME) support in the planning, analysis, development, testing 784 and implementation of various COTS and custom web applications, as well as provide 785 recommendations and insight regarding the acquisition and integration of any identified third-786 party packages. 787

• Support the entire SDLC including: process definition, requirements, management, project 788 planning, quality assurance, metrics, testing, certification, validation and verification, 789 architecture and reengineering, security and configuration management. 790

• Have working knowledge of the software development methodologies including the use of 791 Agile, sprints, and stories. 792

5.4 Identity Management and Desktop Support: 794

The Contractor shall provide, architect, design, document, assist, map, and engineer Identity 796 Management and Windows Desktop services. These include: 797

• DHA Active Directory Services and associated products, including structural…