DRAFT DHA Performance Work Statement - 05-Mar-2025 Draft.pdf

DHA PWS Template V13 November 16, 2021

Department of Defense Defense Health Agency

Performance Work Statement

J-6 System Engineering and Integration Support (SE&I)

Program Executive Officer (PEO) Medical Systems/Chief Information Officer (CIO) J-6

Solicitation Number: TBD

Version: 3

Date: 05 March 2025

DRAFT

November 16, 2021

PART 1

1.0 GENERAL INFORMATION

1.1. This is a non-personal services contract to provide: Systems, Engineering, and Integration Support (SE&I).

1.2. Description of services/introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Engineering and Integration Support (SE&I) as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The Contractor shall perform to the standards in this PWS.

1.3. Background: The Defense Health Agency is a joint, integrated Combat Support Agency that enables the Army, Navy and Air Force medical services to provide a medically ready force and ready medical force to Combatant commands in both peacetime and wartime. The DHA uses the principles of Ready Reliable Care to advance high reliability practices across the Military Health system by improving our system operations, driving innovative solutions, and cultivating a culture of safety.

PEO Medical Systems/J-6 CIO supports the DHA goals by overseeing 240,000 Windows Endpoints, 3.1 Petabytes of Global Operational Data, over 60 Enterprise systems, over 400 support Agreement, offers 38 Service Catalog IT services, accredits over 780 programs/systems in Risk Management Framework, and partners with other federal agencies (e.g., Veteran’s Affairs (VA), Coast Guard) as an IT liaison.

Furthermore, PEO Medical Systems/J-6 CIO provides support for delivery of critical medical treatment Information Technology (IT) solutions to all Military Health System (MHS) beneficiaries. The combinations of programs advance efforts to document seamlessly, and electronically, the health care provided by authorized providers to Department of Defense beneficiaries, and other populations as authorized or directed by proper authority. PEO Medical Systems/CIO J-6 is committed to delivering clinical IT solutions that enable quality continuity of care and timely administration of benefits. PEO Medical Systems/CIO J-6’s primary focus is on enhancing usability of the military’s Electronic Health Record (EHR) by improving system speed, reliability, data quality, and usability of the product to better meet the needs of the military’s medical community.

In support of the DHA Strategic Plan for Fiscal Years 2024-2028, PEO Medical Systems/J-6 CIO has aligned its mission, vision, goals, and priorities (Exhibit 1) to focus on innovative and modern solutions that stabilize the MHS:

November 16, 2021

Exhibit 1

PEO Medical Systems/CIO J-6 priorities to align with DHA Strategic Plan in support of the mission and vision are (see Exhibit 1):

1. Protect and secure the network, meet DoD Cyber Security requirements.

2. Ensure there are no breaks in clinical care.

3. Alignment of resources with DHA, DoD CIO, and Fourth Estate modernization/reform goals.

4. Financial auditability compliance

1.4. Objectives: The objective is for The Contractor to provide acquisition, technical, operational, and management guidance to fulfill the Information Operations (J-6) strategic objectives and goals of the implementation and evolution of Defense Health Agency’s (DHA) modernization programs; to include the Electronic Health Record (EHR) system consistent with DHA strategy and vision for the future. The DHA places specific emphasis on delivering timely, measurable improvements to medical capabilities at an affordable cost while implementing the guidance from the 2017 and 2019 National Defense Authorization Acts (NDAA).

The Strategic Objectives:

a) Rationalize, Optimize, Capitalize, Secure, and Modernize IT processes, programs, services, and systems across Military Health System (MHS) and corresponding

November 16, 2021 stakeholders, while realizing Ready Reliable Care (RRC) objectives, improved IT performance, and reduced costs.

b) Advise on J-6’s Business Analytics, Development Security and Operations

(DevSecOps) Platform, Cybersecurity, and Cloud Broker Service support.

c) Provide technical advisory support to DHA for the operation and enhancement of

IT Modernization initiatives including standardization and transformation through the Enterprise IT Services (EITS) program.

d) Supply systems engineering and technical analysis and recommendations on MHS

IT legacy systems.

1.5. Scope: Support PEO Medical Systems/J-6 CIO by strengthening its hardware and software acquisition processes, systems engineering and integration posture. In addition, The Contractor shall provide complex enterprise acquisitions and analytics, technical support, guidance, performance management, governance, change management, and monitoring of the development, integration, implementation, and Operation & Maintenance (O&M) of integrated solutions that support longitudinal health record process from the time the service member transitions from DoD to VA and beyond through a unified EHR system. The EHR Genesis initiative has a phased multi-year approach. While transitioning the MTFs to DHA authority, direction, and control, these multiple initiatives are dependent on a partnership with J-6 support.

PEO Medical Systems/J-6 CIO through Engineering, Solutions Architecture & IT Business Analytics Division (ESA-BAD) will focus on establishing standards, implementation guidelines, software engineering baselines, enterprise architecture, network and computer recommendations, support for enterprise IT modernization, enterprise shared services, cybersecurity risk management framework, data management and IT capital planning in support of the DHA missions and vision.

The PEO Medical Systems/J-6 CIO will utilize the Contractor’s expertise in advanced enterprise engineering in management, technical support to DHA’s modernization activities and Enterprise Integrated IT Services. The Contractor’s subject matter experts (SMEs) will advise on, strengthening organizational cybersecurity, applications and tools rationalization, establishing standards, implementation planning to operationalize the global service center, software engineering baselines, enterprise architecture, network and computer recommendations, support for enterprise IT modernization, enterprise shared services, data management, digital workspace, and cloud transformation.

The Contractor shall perform the following tasks:

• Strategic Management Support

• Procurement (Support and Evaluation)

• Program and Project Management

• Technical Management Support

• Evaluation and Audit

• Research and Development

November 16, 2021

1.6. Period of Performance (PoP): The PoP for this requirement is one 12-month base period, total period of performance shall not exceed 12 months.

Base Period:

CLIN 0001 - “CIO Support 12 months” CLIN 0004 - “SDD Support 6 months”

Optional Period 1:

CLIN 0005 - “SDD Support 6 months”

1.7. Administrative specifications

1.7.1. Place of Performance. The work shall be performed at the contractor’s facility within the Falls Church, VA area. The Contractor shall perform site visits to San Antonio, TX and those locations deemed necessary by the government. The address for Defense Health Headquarter (DHHQ) is located at 7700 Arlington Blvd, Falls Church, VA. The Government will provide access to Government controlled facilities and equipment, as required. The Contractor will be provided keys or codes for access to the Government facility. These keys and codes shall be controlled, tracked, and protected. Upon termination of the period of performance, all keys and/or access badges to the Government facility shall be turned into the COR.

1.7.2. Regular/Reoccurring Telework. Regular/reoccurring telework for contractor staff may be authorized if determined by the Government. Situational telework may be authorized in certain temporary situations where the designated workplace has no Government oversight due to emergency, operational, or weather closures.

1.7.2.1. Situational Telework arrangements may be considered on a case-by-case basis. The Contractor shall provide adequate oversight of tasks and deliverables to ensure contract adherence during regular/reoccurring and situational telework. The Contractor shall have formal telework policies in place if situational telework is employed. Regular/re-occurring and situational telework arrangements shall have final Government approval under the following:

Regular/Reoccurring and Situational Teleworking shall not result in an increase in contract price;

The Contractor is responsible for continuity of performance in accordance with the terms of the contract; Any equipment provided by the Government for regular/reoccurring and situational telework purposes will be treated as Government Furnished Equipment.

1.7.2.2. Contractors are authorized to work from an Alternate duty/remote location within their approved area of operations with the approval of the Contracting Officer’s Representative and Contracting Officer. The Government does not authorize the use of off-site rates to accomplish alternate duty/remote location work and will not be responsible for any associated costs. Personal or company issued equipment may not be used to access the Government network infrastructure unless pre-approved; examples include using VPN or a corporate network. However, inability to access the Government network infrastructure using authorized devices does not necessarily prohibit the contractor from performing off-site, whenever the work could be performed without such access.

1.7.3. Recognized Federal Holidays. The Contractor is not required to perform services on holidays:

November 16, 2021

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Juneteenth Day Christmas Day Independence Day

1.7.4. Hours of Operation. The Contractor is responsible for conducting business Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.7.4. Emergency Services. On occasion, services may be required to support an activation or exercise of contingency plans outside the normal duty hours.

1.8. Contractor Travel: The Contractor shall be required to travel Continental United States (CONUS) and within the National Capitol Region (NCR) to attend meetings, conferences, and training. The Contractor may be required to travel to off-site training locations and to ship training aids to these locations in support of this PWS.

The Contractor shall be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation and the limitation of funds specified in this contract.

All travel requires Government approval/authorization and notification to the Contracting Officer Representative (COR).

Arrangements for and costs of all travel, transportation, meals, lodging, and incidentals are the responsibility of the contractor. Travel costs shall be incurred and billed in accordance with FAR Part 31. Costs for these expenses will be reviewed, certified, and approved by the COR.

All Travel requests must be submitted 5 business days prior travel for COR approval.

Travel estimates for airfare, car rental, lodging, etc. shall accompany the request. The Contractor invoices (along with associated receipts) shall support all travel reimbursement requests. A trip report (CDRL A010) and actual costs will be reported to the COR by person, by trip within 5 business days of completion of travel. All travel and transportation shall utilize commercial sources and carriers provided the method used for the appropriate geographical area results in reasonable charges to the government.

The Government will not pay for business class or first-class travel.

Lodging and meals shall be reimbursed in accordance with regulations defined in FAR Part 31.

Any modification(s) during the trip must be approved by the COR before the change(s) can be made.

November 16, 2021

The Contractor will be authorized travel expenses consistent with the substantive provisions of the Joint Travel Regulation and the limitation of funds specified in this contract. Cost will not exceed $13,250.00.

Estimated travel:

Travel Description Duration Est.

Cost/Trip

No. (#) of Travelers

No. (#) of Trips Planned

Total

Washington, DC to Dallas TX (DHITS)

3 Days $2120 5 1 $10,600.00

Washington DC to San Antonio, TX

5 Days $2650 1 1 $2,650.00

Total Travel Expense:

$13,250.00

1.9. Other Direct Costs (ODC): Costs are defined as the purchase price of materials or service plus General and Administrative charges (G&A) or material and handling charges (M&H). All ODCs shall be fully supported in compliance with all competition requirements of the FAR.

All ODCs shall be reported as stated in the Monthly Progress Report. These costs must be preapproved by the contracting officer (CO) and includes costs applied to the contract except the cost of material or labor. Cost will not exceed $2,120.00

1.10. Quality

1.10.1. Reserved

1.10.2. Quality assurance (QA): The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP) – Attachment 3. This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.11. Contractor personnel

1.11.1. CAC requirements: For all contractors who will work on this contract, the Facilities Security Officer (FSO)/Company's Security point of contact (POC) will provide the Government all the required information per the DHA CAC request process current version 2.1, July 2024, or more recent when updated (Exhibit A DHA CAC Request Process) within 30 calendar days of award. A CAC is the standard identification for eligible DoD contractor personnel.

1.11.1.1. The Contractor shall return all CACs to the COR upon the departure of the contractor personnel.

1.11.2. Contractor onboarding and training. Contractor personnel shall complete all requirements, training, and forms as prescribed in the following requirements:

DRAFT

mriley Sticky Note Completed set by mriley

November 16, 2021

1.11.2.1. The DHA’s “Onboarding Checklist for Contractor Employees” is located at the DHA Onboarding and Offboarding Portal at https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx

1.11.2.2. Reserved.

1.11.2.3. The Contractor shall comply with onboarding requirements of the DHA for contractors needing to be issued CAC identification, including DoD- and DHA-directed training and forms submission, prior to network access, as displayed in the In/Out-Processing Portal at:

https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx (note: Public Key Infrastructure (PKI)-restricted, printed versions available).

1.11.3 PHYSICAL Security: The Contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.11.4. Reserved

1.11.5. Reserved

1.12. Key-personnel (Contractor): The Contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the CO.

The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 7:00 a.m. to 5:30 p.m., Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons.

1.13 Data rights: The Government will retain rights to all data produced in the course of developing, deploying, training, using and supporting DHA or other federal agencies that utilize this order.

1.14. Reporting

1.14.1. Contractor Manpower Reporting (CMR): RESERVED.

1.14.2. Non-Disclosure Agreement (NDA): All contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA contractor NDA (DHA Form 49) prior to beginning work on the subject contract. The Contractor shall execute an NDA on behalf of the company and shall ensure that all staff assigned to, including all subcontractors and consultants, or other personnel performing on contract/Task order execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other contractors. The NDA shall be executed not later than first day of employment and to be renewed upon exercising a contract option period. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the contractor. The Contractor shall maintain originally signed NDAs of individual employees and provide copy to the COR.

DRAFT

https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx

1.14.3. Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that The Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with The Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.14.4. Post Award Conferences/Periodic Progress Meetings. The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance.

At these meetings the CO will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.15. Contractor Identification

1.15.1. Contractor personnel performing services in a contractor capacity in a government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Support (ADS)/Head of the Contracting Activity (HCA) has business dealings. The Contractor shall answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the ADS understands that the person is contractor support personnel. Include a title block in all emails that states the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/ADS/HCA understands that the person is contractor support personnel.

1.15.2. Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order.

Contractor personnel shall make their contractor status known during introductions.

1.15.3. Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16. Contractor Access to Health Affairs (HA)/DHA Network(s)

November 16, 2021

1.16.1. FSO/Company's Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system. Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and the security awareness training. The Contractor shall be prepared for this process as it could take two (2) or more weeks. The FSO/Security POC shall submit a Standard Form (SF) 85/86 to DHA's Personnel Security Office for a background investigation.

1.16.2. Company's FSO/Security POC must notify the Personnel Security Office when the contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the DHA Personnel Security Office in writing of a contractor's termination from the contract, including the termination date.

1.17. Personnel Security

1.17.1. The Contractor shall comply with DoD Manual (DoDM) 8140.03, “Cyberspace Workforce Qualification and Management Program; 8500.01, “Cybersecurity”, dated March 14, 2014, incorporating change 1 effective October 7, 2019; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM 5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 1, effective October 29, 2020. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.17.1.1. Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at dha.ncr.security.mbx.personnel-security-office@health.mil.

1.17.1.2. Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.17.1.3. DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel

Security Office not signing off on any access request.

November 16, 2021

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE

PUBLICATIONS/INSTRUCTIONS

2.1. Definitions

2.1.1. Category D: Information Technology (IT) and Telecommunications Services (called D- Services)

2.1.2. Category R: Support (Professional/Administrative/Management) Services (called R- Services)

2.1.3. Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4. Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5. Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6. Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.1.7. Program Manager (PM): An individual who is responsible for the cost, schedule, and performance of a specific project. The PM must understand and manage multiple discipline areas in order the successfully execute a project. This individual does NOT have authority to change the terms and conditions of the contract.

2.2. Acronyms:

AIS Automated Information System APL Approved Products List APL AQL Acceptable Quality Level ARRT Acquisition Requirements Roadmap Tool ATO Authority to Operate B2B Business-2-Business CAC Common Access Card CAP Cloud Access Point CCEVS Common Criteria Cybersecurity Evaluation and Validation Scheme

November 16, 2021

CDI Covered Defense Information CE Computer Environment CDRL Contract Data Requirement List CIO Chief Information Officer CJCSM Chairman of the Joint Chiefs of Staff Manual CMMC Cybersecurity Maturity Model Certification CMR Contractor Manpower Reporting CNSSI Committee on National Security Systems Instruction CO Contracting Officer(s) CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative CSP Cloud Service Provider CSSP Cyber Security Service Provider CUI Controlled Unclassified Information D2D Desktop to Datacenter DAD-A Deputy Assistant Director for Acquisition DC3 DoD Cyber Crime Center DD Form 254 Department of Defense Contract Security Requirement List (if applicable) DB Design-Build DBB Design-Bid-Build DevSecOps Development Security and Operations DFARS Defense Federal Acquisition Regulation Supplement DHA Defense Health Agency DISA Defense Information System Agency DoD Department of Defense DoDD Department of Defense Directive DoDI Department of Defense Instruction DSAs Data Sharing Agreements DSAA Data Sharing Agreement Application DMZ Demilitarized Zone DoDM Department of Defense Manual DPCLO DHA Privacy and Civil Liberties Office DUA Data Use Agreement HER Electronic Health Record eMSM Enhanced Multi-Service Markets EULA End User License Agreement EVM Earned Value Management FAR Federal Acquisition Regulation FCI Federal contract information FE Facilities Enterprise FedRAMP Federal Risk Authorization and Management Program FISMA Federal Information Security Modernization Act FRCS Facility Related Control Systems FSO Facilities Security Officer HA Health Affairs HIPAA Health Insurance Portability and Accountability Act HCA Head of the Contracting Activity

November 16, 2021

HIT Health Information Technology IGCE Independent Government Cost Estimate IA Information Assurance IO Initial Outfitting I/O In/Out Processing Portal IPv Internet Protocol Version IS Information System ISP Internet Service Provider IT Information Technology ITIL Information Technology Infrastructure Library ISCM Information Security Continuous Monitoring IV&V Independent Verification & Validation MedCOI Medical Community of Interest MHS Military Health System MILDEPS Service Military Departments MIL-STD Military Standard MTFs Military Treatment Facilities NCR National Capitol Region NDA Non-Disclosure Agreement NDAA National Defense Authorization Act NIAP National Information Assurance Partnership NIST National Institute of Standards and Technology O&M Operation & Maintenance OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs OPM Office of Personal Management OSD Office of the Secretary of Defense P-ATO Personal Authorization to Operate P&R Personnel and Readiness PGI Procedures, Guidance and Information PDT Project Delivery Team PHI Protected Health Information PII Personally Identifiable Information PIT Platform Information Technology PK Public Key PKI Public Key Infrastructure POA&M Plan of Action and Milestones POC Point of Contact PMO Program Management Office PoP Period of Performance PP Personal Property PPSM Ports, Protocols, and Services Management PRS Performance Requirements Summary PSP Personnel Security Program PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan

November 16, 2021

QC Quality Control QCP Quality Control Plan RFP Request for Proposal RFQ Request for Quotation RMF Risk Management Framework RRC Ready Reliable Care SDD Solution Delivery Division SP Special Publication SPRS Supplier Performance Risk System SRM Sustainment, Restoration and Modernization SRG Security Requirements Guides STIG Security Technical Implementation Guides TOS Terms of Service US United States UFC Unified Facilities Criteria VA Veteran’s Affairs VPN Virtual Private Network XML Extensible Markup Language

2.3. Applicable Publications, DHA Administrative Instructions (AI), etc.

I. Cybersecurity (DoDI 8500.01) II. Defense Federal Acquisition Regulation Supplement (DFARS)

III. Defense Acquisition System (DoD Directive 5000.01) IV. Defense Acquisition of Services (DoD 5000.74) V. DoD Financial Management Regulation (DoD 7000.14-R)

VI. DoD Health Information Privacy Regulation (DoD 6025.18-R) VII. DoD Information Security Program: Controlled Unclassified Information (CUI) (DoD

5200.01, Vol 4) VIII. DoD Privacy Program (DoD Directive 5400.11)

IX. Federal Acquisition Regulation (FAR) X. Health Insurance Portability and Accountability Act (HIPAA) (DoD Manual (DoDM)

6025.18) XI. HIPAA Privacy Rule Compliance in DoD Health Care Programs (DoDI 6025.18)

XII. Identify Authentication for Information Systems (DoDI 8520.03) XIII. Information Assurance Workforce Improvement Program (DoD 8570.01-M) XIV. Personnel Security Program Requirements (DoD 5200.02-R) XV. Risk Management Framework for DoD Information Technology (DoDI 8510.01)

XVI. GoG Information Security Program: Controlled Unclassified Information (CUI) (DoD5200.01, Vol 4)

November 16, 2021

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The requiring activity authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1. Services: The Government will provide Government Furnished Services required in support of this contract/task orders. These services are described below: access to business telephones, for business purposes only, and access to other equipment and systems will Government approval as necessary to perform the tasks specified in this PWS. The government will provide IT services necessary to maintain government issued equipment on the network.

3.2. Facilities: The Government will provide facilities in support of this contract/task orders.

The Government provided facilities are described below: For work performed within Government facilities, the Government will provide the necessary workspace for the contractor staff to provide the support outlined in the PWS to include desk space, telephones, computers, and other items necessary to maintain an office environment.

3.3. Utilities: The Government will provide utilities in support of this contract/task orders. The Government provided utilities are described below: For work performed within Government facilities, the Government will provide access to any utilities required in the performance of this contract. The Contractor shall instruct employees in utilities conservation practices and shall be responsible for operating under conditions that preclude the waste of utilities.

3.4. Equipment: The Government will provide equipment in support of this contract/task orders. The Government provided equipment is described below:

The Government will provide within government facilities telephones, facsimile machines, copiers, and computer equipment to include laptops for use in performance under this contract/task order. This equipment is authorized for transaction of official Government business only and shall not be used for personal business. Personal long-distance calls are not authorized, and the cost of all personal long-distance calls made by contractor or subcontractor employees may be deducted from the contractor/s invoice payments. Telephones, facsimile machines, and computer equipment to include laptops are subject to communications security monitoring at all times.

Contractor and subcontract employees may be issued keys signed for at scheduled and unscheduled key control inspections. The Contractor shall be required to reimburse the Government for lost keys, or lockset (if lockset is required to be replaced) as a result of lost keys.

The cost of replacement of keys/locksets may be deducted from payments to the contractor.

Items issued will remain the property of the Government and the contractor will maintain proper accountability of issued equipment. Equipment shall not be removed from the facilities shown in paragraph 3.2 above, unless otherwise specified in the Performance Work Statement.

They are to be used, turned in and/or disposed of as directed by the Contracting Officer Representative or Contracting Officer.

November 16, 2021

The Government will provide laptop computers, monitors, and other equipment necessary to perform the tasks specified in this PWS. For work performed within government facilities, the government will provide access to printers, scanners, shredders, and telephones for business purposes only. Laptops may be transported if telework is approved.

3.4.1. Procurement Integrated Enterprise (PIEE), GFP Module Application

The Contractor shall be responsible for obtaining and maintaining access, training, and successful operation of the PIEE/GFP Module application for the entirety of the contract/task order PoP. The PIEE GFP Module application is located at the following website:

https://wawf.eb.mil/piee-landing/. Access to PIEE/GFP Module application training materials and in-depth information applicable to the contractor’s responsibilities regarding GFP can be found at the following website: https://dodprocurementtoolbox.com/.

Contracting Office Responsibilities:

The Contracting Office shall ensure close coordination and validation of the GFP items with the COR and DHA Accountable Property Officer prior to uploading the GFP Attachment into the PIEE/GFP Module. At the time GFP is anticipated and identified, the Government will upload the GFP Attachment into the PIEE/GFP Module. It is the Contracting Office’s responsibility to prepare, upload and maintain the GFP Attachment in the PIEE/GFP Module in accordance with the GFP Attachment instructions provided at the DoD Procurement Toolbox.

The CO and COR shall manage and keep an inventory of any GFP associated with contract/task orders awarded through DHA, in accordance with applicable FAR Part 45, DoD FAR Supplement (DFARS) 245 with respective clauses, DHA AI 095 and PD 45-01 following the change in disposition of items listed on that PIEE/GFP Module Attachment.

The contracting office will also review, acknowledge, reject and/or approve shipment orders provided by the contractor as appropriate. Functional roles can be determined within the Contracting Office and requested within the PIEE/GFP Module system.

Contractor Responsibilities:

A key contractor responsibility is to work with the CO and COR to ensure the PIEE/GFP Module data, to include the PIEE/GFP Attachment, provides a timely, complete, and accurate accounting of the GFP applicable to the contract/task order. Contractors are required to report the receipt of any GFP shipped to them, regardless of whether it is listed on the GFP Attachment for their contract. Similarly, contractors are required to utilize the GFP Module application in conjunction with the shipment of GFP to the Government, or in reporting Property Loss of GFP issued (such as destruction or loss). Discrepancies or disputes regarding property shipped to or shipped from the contractor must be reported via the GFP Module application, with the CO having authority over final designation of status.

The Contractor shall report semi-annually 100% inventories, reconciliations, and final disposition of GFP provided by the government. Final invoices will not be paid pending GFP reconciliation. Contractors shall be aware of and ensure compliance with applicable FAR Part 45, DFARS 245 and 252.245, Defense Pricing and Contracting Policies, Procurement Integrated Enterprise Environment Standards, DHA Administrative Instruction 094 and DHA Guidance. (If

DRAFT

https://wawf.eb.mil/piee-landing/ https://dodprocurementtoolbox.com/

November 16, 2021 this option is used, a semi-annual GFP inventory CDRL will need to be added to the PWS Technical Exhibit 1.)

3.5. Materials: The Government will provide materials in support of this contract/task orders.

The Government-provided materials are described below:

The Government will provide standard office supplies, Standard Operating Procedures and Policies as necessary to perform the tasks specified in this PWS.

November 16, 2021

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1. Services: The Contractor will provide Contractor Furnished Services required in support of this contract/task orders. These Services are described below:

The Government will provide access to required Government systems and data as defined by the Government to the contractor staff to provide the support outlined in the PWS.

4.2. General: The Contractor shall furnish all supplies, equipment, facilities, and services required to perform work listed under Section 5 of this PWS.

4.3. Secret Facility Clearance: Reserved.

4.4. Materials: The Contractor shall furnish materials, supplies, and equipment necessary to meet the requirements under the PWS.

4.5. Equipment: The Contractor shall furnish materials, supplies, and equipment necessary to meet the requirements under the PWS.

4.6. Facilities: Except as expressly provided in Part 3 of this PWS, the contractor is responsible for providing the facilities and facilities-related support it needs to provide the contractor Services. The Contractor shall perform at contractor or other facilities when Government space is not available or during emergency/contingency situations. During emergency/contingency situations the contractor shall ensure necessary workspace for the contractor staff is available to provide the support outlined in the PWS to include desk space, telephones, computers, and other items necessary to maintain an office environment.

November 16, 2021

PART 5

5.0 SPECIFIC TASKS

5.0. System Engineering and Integration Support task

5.1. Strategic Management Support

5.1.1. The Contractor shall provide Strategic Planning support to executive level decision makers involving mission strategy, plans, pilots, and operations. The Contractor shall actively participate in strategy development and implementation by the Government and review, assist, advise, and make recommendations to Government executives and other senior staff.

5.1.2. The Contractor will assist the Government with advice and guidance for the implementation or revision of initiatives in response to legislative requirements and will serve as a liaison for Government agencies charged with complimentary missions under statute and presidential directives. The Contractor will also serve as a liaison for academic sector initiatives where such efforts help the Government meet its missions.

5.1.3. PEO Medical Systems/J-6 CIO requires strategic management support services to ensure program coherence and consistency, as well as alignment with related external strategic goals.

The Contractor shall provide all strategic planning support and resulting documentation to enable the Government to make proactive business decisions regarding program planning. The Contractor shall conduct research regarding various aspects of proposed strategies and alternatives and deliver summaries of findings. The Contractor shall identify and recommend a variety of process analysis approaches to determine impact of complex issues.

5.1.4. Informal Briefing Materials (CDRL A001). The Contractor shall provide to the PM and COR on a weekly basis, informal briefing material on Strategic Management Support findings and recommendations via written reports, written briefings, or in an oral presentation.

5.2 Procurement (Support and Evaluation)

5.2.1. The Contractor shall work with the Government to identify capability gaps and assess the agency’s need to enhance or acquire mission critical capabilities in support of the SOO Objectives. The Contractor shall assist the Government in gaining a thorough understanding of the environment in which the acquisition will be planned and executed (i.e. specific politics, policies, procedures, stakeholders, culture, constraints, risks inherent in the agency), a clear understanding of objectives of the acquisition, and support and/or provide analysis of alternatives, business case analysis, cost benefit analysis, financial audits and analysis, acquisition lifecycle, advice and assistance for requirements management, design, development methodologies, validation and quality assurance, release and configuration management process, sustainment and operations, technology refresh, and licensing and decommissioning of systems for PEO Medical Systems/J-6 CIO. of findings. The Contractor shall identify and recommend a variety of process analysis approaches to determine impact of complex issues.

5.2.2. Informal Briefing Materials (CDRL A002). The Contractor shall provide to the PM and COR monthly, informal briefing materials on Procurement (Support and Evaluation) findings and recommendations via written reports, written briefings, or in an oral presentation.

5.3 Program and Project Management

5.3.1. The Contractor shall provide subject matter expertise, advice, and assistance in support of program efforts and project management of individual projects, including interfacing with program management work plan and monthly status reports. The program management personnel must understand the unique requirements and challenges of PEO Medical Systems/J-6 CIO operations. The Contractor shall support program lifecycle phases consistent with DoD Program Management practices including initiating, planning, executing, monitoring, controlling, and closing. The Contractor shall provide PEO Medical Systems/J-6 CIO and its divisions in performing program management functions including serving as programmatic liaison to the Government by preparing and coordinating acquisition lifecycle materials and briefs, attending program-related meetings including acquisition/milestone events, progress reviews, design reviews, and senior leadership briefings. The Contractor shall coordinate and assist with monitoring program cost, schedule, and performance against the baseline and actuals, to include providing independent analysis and assessments of issues impacting cost, schedule, and performance. The Contractor shall identify corrective actions and areas for increased monitoring of critical path events as well as alternatives to preclude or offset negative variances in order to sustain adherence.

5.3.2. Formal Work Plan and Monthly Status Report (CDRL A003). The Contractor shall provide to the PM and COR monthly a formal work plan and monthly status report due on the 15th calendar day of the month.

5.4 Technical Management Support

5.4.1. Enterprise-Engineering Advice and Recommendations. The Contractor shall conduct assessments and analysis, and provide advice to the DHA focused activities (software, network, and compute) as follows:

5.4.1.1. Enhance systems modernization by providing recommendations on DHA systems and services.

5.4.1.2. Enhance enterprise architecture for various capabilities across PEO Medical Systems/J-6 CIO that includes existing landscape and a roadmap for modernization of DHA systems by providing technical advice and recommendations to key stakeholders across the DHA and contractors supporting these efforts.

5.4.1.3. Enhance cybersecurity posture of DHA networks, medical devises, and the ecosystem by providing recommendations, analysis, and expertise in the field of cybersecurity by employing threat informed defense. Review and evaluate types of security risks, to provide knowledge of the different types of security risks in the ecosystem allowing for proactive protection against such risk.

5.4.1.4. Analyze and evaluate business analytics and decision support tools, provide guidance and defining conditions for a prototype and identification of potential sustainment paths, model development or sustainment, testing and assessment of model performance based on analysis.

5.4.1.5. Providing guidance on business case development, business process reengineering, alternative analysis, requirements engineering, and system definition activities.

5.4.1.6. Providing technical advice and guidance to assess and monitor contractor performance including technical reviews of contractor-developed documents, proposals, and artifacts.

5.4.1.7. Participating in an advisory role and providing guidance in joint DHA contractor Integrated Product Teams (IPTs) and including red team assessments, independent technical assessments, and agile design reviews.

5.4.1.8. Providing assessments related to contractor-proposed life cycle related to analysis of alternatives, business case analysis, cost benefit analysis, financial audits and analysis, acquisition lifecycle, requirements management, design, development methodologies, validation and quality assurance, release and configuration management process, sustainment and operations, technology refresh, and licensing and decommissioning of systems for PEO Medical Systems/J-6 CIO.

5.4.1.9. Providing technical guidance to evaluate contractor-developed system and software design recommendations, including non-functional and information security requirements.

5.4.1.10. Developing strategies and providing expertise to migrate the DHA to lower cost data storage options through recommendations for incorporating an automated tiered-storage strategy in the cloud.

5.4.1.11. Providing technical guidance and advice to DHA program leadership in the preparation and execution of Design Reviews, Code Reviews, Test Readiness Reviews, Quality Reviews, Security Reviews, Deployment, Operations and Sustainment reviews. This includes providing recommendations, support, and expertise in systems integration and acceptance testing activities.

Providing solutions and recommendations for Independent Verification and Validation (IV&V) of contractor developed systems/sub systems for DHA’s use against a baseline set of requirements as required.

5.4.1.12. Informal Briefing Materials (CDRL A004). The Contractor shall provide to the PM and COR on a weekly basis informal briefing material on Advice and Recommendation for Engineering and Architecture Development findings and recommendations via written reports, written briefings, or in an oral presentation.

5.4.2. DHA Cloud Strategy, DevSecOps and Platform as a Service. The Contractor shall provide technical guidance and expertise to enhance DHA Cloud Strategy, DevSecOps and Platform as a Service and decision criteria to deploy systems within the multi-cloud options by providing technical expertise and analysis.

5.4.2.1. Informal Briefing Materials (CDRL A005). The Contractor shall provide to the PM and COR on a weekly basis informal briefing material on DHA Could Strategy, DevSecOps and Platform as a Service findings and recommendations via written reports, written briefings, or in an oral presentation.

November 16, 2021

5.4.3. Business Process Re-engineering, Engineering Assessment and Analysis for Solution Delivery Division (SDD). The Contractor shall provide technical advice and recommendations with Business Process Re-engineering, engineering assessment and analysis on focused activities (software and computer) for SDD:

5.4.3.1. Support Business Process Re-engineering for: Acquisition Management, Support Agreement, Requirements Management, Spend Optimization, Commercial off the Shelf (COTS) Utilization Guidance, Test and Evaluation, Measurement & Analysis, Organizational Training, and Information Technology Infrastructure Library (ILIT) process adoption.

5.4.3.2. Support Engineering Assessment and Analysis of Focused Activities:

5.4.3.2.1. Provide guidance and recommendations on business case development, business process reengineering, alternative analysis, requirement engineering, and system definition activities.

5.4.3.2.2. Provide recommendation, analysis, and expertise in the transition of SDD systems, from legacy SharePoint to Salesforce. The Contractor will provide advice and expertise to verify capability transition to the new platform is met.

5.4.3.3. Informal Briefing Materials (CDRL A006). The Contractor shall provide to the PM and COR on a weekly basis informal…