DRAFT - DHA_PWS_Cost Comparison_20250812.docx

Department of Defense Defense Health Agency Performance Work Statement

Cost Comparison Study TRICARE Health Plan

Program Management Office

Solicitation Number: HT001125R00XX Version: 1 Date:

PART 1 –

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide Rate Study Methodology Development and Health Plan Comparison Analysis Support for TRICARE Health Plan products.

1.2 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Rate Study Methodology Development and Health Plan Comparison Analysis Support for TRICARE Health Plan products as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this PWS.

1.3 Background: The Defense Health Agency (DHA) requires specialized actuarial and analytical services to understand prior rate study methodologies and develop a standardized method that allows comprehensive comparison between Uniformed Services Family Health Plan (USFHP) and other TRICARE Health Plan products and initiatives. This analysis will include applying critical risk adjustment factors based on population health and will enable DHA to make data-driven decisions on the value and strategic direction of various TRICARE products currently in operations today. This effort builds upon the previously awarded Health Plan Innovative Support (HPIS) Blanket Purchase Agreement (BPA) Task 1, which established the foundational rate study methodologies and health plan comparison analyses.

1.4 Objectives:

· Offer actuarial support and analysis for core analytical, strategic financial management, and performance integration objectives.

· The contractor's efforts shall focus on achieving the following outcomes that align with the T-5 contract objectives (Readiness, Experience of Care, Manage Per-Capita Costs, and Population Health) and support DHA's strategic financial management goals.

1.4.1 Core Analytical Objectives:

· Compare USFHP and other TRICARE Health Plan products using standardized metrics and data points

· Enable data-driven decisions on the value and strategic direction of various TRICARE products currently in operations

· Develop a methodology to calculate total cost of care (TCoC) for each specific TRICARE health plan product (Prime, Select, Competitive Plans Demonstration (CPD), TFL, Extended Care Health Option (ECHO), TYA, USFHP)

· Create a defensible methodology for complex benchmarking and comparison

· Implement risk scoring and adjustments based on the enrolled population

· Reprice encounters to the same fee schedules across TRICARE health plan products to neutralize provider reimbursement differences

1.4.2 Strategic Financial Management Objectives:

· Achieve competitive advantage by modernizing assumptions in the rate-setting process through implementation of contemporary actuarial methodologies and industry best practices that enhance DHA's analytical capabilities relative to commercial health plan standards

· Enable rate stability by developing predictive modeling capabilities that reduce volatility in cost projections and support consistent, defendable rate recommendations across TRICARE products

· Maximize cost recovery through improved accuracy in cost allocation methodologies and enhanced identification of recoverable expenses across all TRICARE health plan products

· Contribute to financial stability by providing accurate financial reporting mechanisms and analytical frameworks that improve cash flow predictability and support strategic financial planning

· Enhance compliance and audit readiness by establishing well-documented, actuarially sound methodologies that comply with all applicable regulations and guidelines, with clear justifications for all adjustments and recommendations

1.4.3 Performance Integration Requirements: All objectives shall be executed using actuarially sound methodologies that support the cost comparison evaluation process and maintain data accuracy standards of 98% or higher, with comprehensive documentation that meets DHA requirements for timeliness, accuracy, and regulatory compliance.

1.5 Scope: The Contractor shall provide actuarial expertise and analytical services for core analytical, strategic financial management, and performance integration objectives. This includes, but is not limited to:

· Comprehensive rate study analysis and TRICARE product comparison methodologies.

· Ingest and Assess Data for Feasible Standardization and Incomplete Data.

· Determine comparison group by either Cost of Care (COC) or Total Cost of Care (TCOC).

· Price normalization/Repricing, as necessary.

· Develop and complete Actuarial Data Set (ADS).

· Ingest, standardize, and normalize comparison Group.

· Apply fee schedule for provider reimbursement across comparison groups with adjustments and compare TRICARE health plan products.

1.6 Period of Performance (PoP):

Base Period: October 1, 2025 – June 30, 2026 FAR 52.217-8 Ext: July 1, 2026 – September 30, 2026

1.7 Administrative specifications

1.7.1 Place of performance: The work shall be performed at the Contractor’s off-site locations or at the Defense Health Headquarters in Falls Church, Virginia.

Remote work is authorized.

1.7.2 Recognized Federal holidays: The contractor is not required to perform services on Federal holidays.

Independence Day

NOTE: Any of the above holidays falling on a Saturday will be observed on the preceding Friday; holidays falling on a Sunday will be observed on the following Monday. Any holidays that are declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above. If the area in which a contract employee is scheduled to work is closed due to the holiday declared by an Executive Order and the employee is not required to report in, payment will not be made for those hours. Closures of the installation due to inclement weather or other such acts of God shall be handled in the same manner.

1.7.3 Hours of operation: The contractor is responsible for conducting business Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. Core hours are 0900 to 1500 while tours of duty will fall between the hours of 0700 and 1730. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.8 Contractor travel: The contractor shall be required to travel within the Continental United States (CONUS) and within the National Capitol Region (NCR) to attend meetings, conferences, and training. The contractor may be required to travel to off-site training locations and to ship training aids to these locations in support of this PWS. Contractor shall be authorized travel expenses consistent with the cost principles and procedures in Federal Acquisition Regulation (FAR) Part 31.2, Travel Costs and the limitations of funds specified in this contract. All travel requires Government approval/authorization and notification to the Contracting Officer Representative (COR). Travel within fifty (50) miles, one-way, of the contractor’s daily work location shall not be authorized reimbursement for any travel expenses.

The Government is providing a Firm Fixed Price (FFP) Travel Contract Line Item Number (CLIN) for each period of performance. Each period of performance Travel CLIN will not exceed $10,000.00 annually.

Estimated Travel:

Arrangements for all travel, transportation, meals, lodging, and incidentals are the responsibility of the Contractor. All travel and transportation shall utilize commercial sources and carriers provided the method used for appropriate geographical area results in reasonable charges to the Government. The Government shall not pay for business class or first-class travel.

1.10 Quality

1.10.1 Quality Control (QC): The contractor shall develop and maintain an effective QC program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The contractor’s QC program is the means by which the work complies with stated requirements. The QCP shall be submitted within 30 days after contract award. A comprehensive written QCP shall be submitted to the CO and COR within 5 working days when changes are made thereafter. After acceptance of the Quality Control Plan (QCP) the contractor shall receive the CO’s acceptance in writing of any proposed change to his QC system. See Part 7, Technical Exhibit 1 - CDRL A001.

1.10.2 Quality assurance (QA): The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.11 Contractor personnel

1.11.1 CAC requirements: For all contractors who will work in Government facilities, the Facilities Security Officer (FSO)/Company's Security point of contact (POC) will provide the Government all the required information per the DHA CAC request process current version 2.1, January 2018, or more recent when updated. See process attached at Part 7 Section 7.1.1 of the PWS. A CAC is the standard identification for eligible DoD contractor personnel.

1.11.1.1 The contractor shall return all CACs to the COR upon the departure of the contractor(s).

1.11.2 Contractor onboarding and training. The contractor shall complete all requirements, training, and forms as prescribed in the following requirements:

1.11.2.1 The DHA’s “Onboarding Checklist for Contractor Employees” is located at the DHA Onboarding and Offboarding Portal at https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx

1.11.2.2 The DHA’s contractor training instructions embedded at Part 7 Section 7.1.2.

1.11.2.3 The contractor shall comply with onboarding requirements of the DHA for contractors needing to be issued CAC identification, including DoD- and DHA-directed training and forms submission, prior to network access, as displayed in the In/Out-Processing Portal at: https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx (note: Public Key Infrastructure (PKI)-restricted, printed versions available).

1.11.3 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use.

1.11.4 Key control: RESERVED.

1.11.5 Lock combinations: RESERVED.

1.12 Key personnel (Contractor): The contractor shall provide a contract/program manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the CO. The contract/program manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 8:00 a.m. to 4:30 p.m., Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons. Qualifications for all key personnel are listed below:

Program Manager:

· Project Management Professional (PMP) Certification preferred

· Bachelor's Degree (BA or BS) required

1.13 Data rights: RESERVED.

1.14 Reporting

1.14.1 Contractor Manpower Reporting (CMR): RESERVED.

1.14.2 Non-Disclosure Agreement (NDA): All contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA contractor NDA (DHA Form 49) prior to beginning work on the subject contract. The contractor shall execute an NDA on behalf of the company and shall ensure that all staff assigned to, including all subcontractors and consultants, or other personnel performing on contract/Task order execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other contractors. The NDA shall be executed not later than first day of employment and to be renewed upon exercising a contract option period. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the contractor. The contractor shall maintain originally signed NDAs of individual employees and provide copy to the COR.

1.14.3 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.14.4 Post award conference/periodic progress meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance. At these meetings the CO will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings. The contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is contractor support personnel. Include a title block in all emails that states the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is contractor support personnel.

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order. Contractor personnel shall make their contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16 Contractor Access to Health Affairs (HA)/DHA Network(s)

1.16.1 FSO/Company's Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system (If applicable, if not delete 1.16.1 and 1.16.2 and replace to 1.16 Reserved). Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and the security awareness training. The contractor shall be prepared for this process as it could take two (2) or more weeks. The FSO/Security POC shall submit a Standard Form (SF) 85/86 to DHA's Personnel Security Office for a background investigation.

1.16.2 Company's FSO/Security POC must notify the Personnel Security Office when the contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the DHA Personnel Security Office in writing of a contractor's termination from the contract, including the termination date.

1.17 Personnel Security

1.17.1 The contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce Improvement Program, CH4” November 10, 2015 as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM 5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.17.1.1 Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at (703) 275-6038.

1.17.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.17.1.3 DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing off on any access request.

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D-Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R-Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.2 Acronyms:

2.3 Applicable Publications, DHA Administrative Instructions (AI), etc.

TRICARE Operations Manual 6010.62-M, April 2021 TRICARE Systems Manual 6010.63-M, April 2021 TRICARE Policy Manual 6010.64-M, April 2021 TRICARE Reimbursements Manual 7950.4-M. April 2021

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government:

☒ Will NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Government Furnished Services required in support of this contract/task orders. These Services are described below:

3.2 Facilities: The Government:

☐ Will NOT provide Facilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Facilities in support of this contract/task orders. The Government provided Facilities are described below:

The Government will provide laptops for use in performance under this contract/task order. This equipment is authorized for transaction of official Government business only and shall not be used for personal business Computer equipment to include laptops are subject to communications security monitoring at all times. They are to be used, turned in and/or disposed of as directed by the COR or CO.”

3.3 Utilities: The Government:

☒ Will NOT provide Utilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Utilities in support of this contract/task orders. The Government provided Utilities are described below:

3.4 Equipment: The Government:

☒ Will NOT provide Equipment in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Equipment in support of this contract/task orders. The Government provided Equipment is described below:

3.5 Materials: The Government:

☒ Will NOT provide Materials in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ IS providing Materials in support of this contract/task orders. The Government-provided Materials are described below:

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 Services: The Contractor:

☒ Will NOT provide Contractor Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Contractor Furnished Services required in support of this contract/task orders. These Services are described below:

4.2 General: The contractor shall furnish all supplies, equipment, facilities and services required to perform work listed under Section 5 of this PWS.

4.3 Secret Facility Clearance: Not applicable.

4.4 Materials: Not applicable.

4.5 Equipment: Not applicable.

4.6 Facilities: Not applicable.

PART 5

5.0 SPECIFIC TASKS

5.1 Data Management: The contractor shall implement a data management strategy that encompasses a comprehensive, systematic approach to handling all data throughout the contract lifecycle.

5.1.1 Data Collection and Sourcing: The contractor shall obtain and consolidate data from designated sources, including but not limited to: Enterprise Intelligence & Data Solution (EIDS), Defense Healthcare Management Systems (DHMS), Military Health System Data Repository (MDR), Program Assessment Tool (PAT), TRICARE Encounter Data Submission (TEDS), valid historical rate study documentation and methodologies, downloads, imports and control data from designated government systems, Support to Performance Monitors (PMs) in performance evaluation and will explore internal resources for existing data collection.

5.1.2 Data Validation: The contractor shall develop and implement a data validation plan to ensure the accuracy, completeness, and consistency of all collected data. This includes identifying and addressing any data anomalies or inconsistencies as well as a feasibility report on data standardization and accounting for skewed or incomplete USFHP data.

5.1.3 Data Preparation and Standardization: The contractor shall clean, transform, and prepare data into analysis-ready format including standardizing data elements and formats across all TRICARE health plan products, creating necessary data aggregations and summaries, cost category identification, mapping and standardization, determination of comparison group (either by cost of care or total cost of care)and adjustment factor development.

5.2 Analysis and Methodology Development: The contractor shall apply actuarial expertise and analytical methodologies to develop defensible rate study comparisons and support data-driven decision making for TRICARE health plan products.

5.2.1 Rate Study Analysis and Comparison: The contractor shall compile a complete review and catalogue of prior rate studies done in the last 5 years, complete price normalization and/or repricing and patient profiles comparison group data scrubbing. Additional analysis will include:

· Execute rate study including price normalization/repricing,

· Develop actuarial data set (ADS)

· Ingest, standardize and normalize comparison group data

· Reimbursement analysis across comparison groups (CPD, Prime, Select, etc.)

· Apply adjustments, data interpretation, and insights

5.2.2 Stakeholder Engagement and Assessment: The contractor shall conduct stakeholder interviews, summarize findings and map to relevant rate studies, submit client-vendor map, conduct routine assessments and data analysis, and develop quarterly surveys to assess engagement.

5.3 Reporting and Documentation: The contractor shall create, maintain, and deliver standardized reports, assessments, documentation, and presentations required to support rate study analysis.

5.3.1 Report Development and Presentation: The contractor shall draft USFHP Rate Study Report including executive summary, incorporate DHA feedback, develop briefing decks for presentations, participate in and present up to five briefs with DHA, prepare quarterly summaries, create reports, data charts, briefing decks for meeting participation and presentations. All products will summarize findings and provide analytical insights

5.3.2. Documentation: The contractor shall document lessons learned and proposed modifications. Recommendation and methodology must be provided for comparable rate study. The contractor shall ensure all documentation meets DHA requirements for timeliness and accuracy and will support COR review processes for cost data summation and supporting documentation

5.4 Project Management: The contractor shall provide comprehensive oversight, coordination, and specialized expertise required to execute all contract deliverables while maintaining daily operational management of contractor resources, stakeholder relationships, and technical subject matter expertise throughout the contract performance period.

5.4.1 Strategic Project Management: The contractor shall provide strategic advisor support throughout contract performance period, management and direction of subject matter expert (SME) resources, project scope, charter, and budget, as well as general project management oversight. The contractor will host project team meetings (internal and bi-weekly meetings with DHA team), will manage assignment and planning for in-the-moment and SME technical support, provide up-to-date line of effort tracking and budget monitoring, and provide both internal and external meeting facilitation and participation.

5.4.2 Technical Advisory Services: The contractor shall provide technical advisement and management of subject matter expertise, maintain adequate workforce for uninterrupted performance of all tasks, support performance evaluation processes, and ensure comprehensive review processes that meet DHA requirements

Performance Standards: All consolidated tasks shall maintain data accuracy standards and comprehensive documentation meeting DHA requirements for timeliness, accuracy, and regulatory compliance as specified in the contract requirements.

PART 6

6.0 INFORMATION TECHNOLOGY & SECURITY

6.1 All work under this contract is unclassified

6.2 The TIER 1 or TIER 2 levels and position sensitivity designation for positions under this contract is:

6.2.1 TIER II: Non-critical sensitive position

6.3 Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal information requirements:

6.3.1. Data Sharing Agreements (DSAs): Contractors requiring access to PII, which includes PHI, or access to de-identified data, are subject to the DHA Privacy and Civil Liberties Office (DPCLO) (Privacy Office) Data Sharing Program. This program requires DHA to enter into DSAs with parties outside the MHS who use or create MHS data. A DHA contract may use the term Data Use Agreement (DUA) rather than DSA. DSAs assure that outside parties protect MHS data in accordance with the Privacy Act and the HIPAA Rules. To apply for a DSA, the contractor submits a Data Sharing Agreement Application (DSAA) to the DHA DPCLO. The contractor submits the DSAA even if a subcontractor will be the party accessing MHS data. After review and approval of the DSAA, the Privacy Office provides a DSA to the contractor for execution.

6.3.2. Processing Procurement Sensitive Information: All individuals shall seek guidance from the CO regarding the coordination of documents, dissemination, and transmission of procurement sensitive information. Procurement sensitive information shall not be transmitted electronically unless encryption is utilized. Depending on a particular procurement, other restrictions may apply.

6.4 Training

6.4.1 Contractor employees performing cybersecurity/cyberspace functions shall comply with the following requirements:

6.4.1.1 Training: RESERVED

6.4.1.2 Certification: RESERVED

6.4.2 User requirements: All contractor employees that require access to DHA IT must comply with the requirements of DHA-Procedural Instruction 8140.01, Acceptable Use of DHA IT, to include those contract employees with privileged access.

6.5 Cybersecurity Requirements for Non-DoD IT or Covered Contractor IS: RESERVED.

6.5.1 The contractor shall, at time of award, have implemented the security requirements prescribed in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (available via the internet at http://dx.doi.org/10.6028/NIST.SP.800-171), in accordance with DFARS clause 252.204-7012.

6.5.2 NIST SP 800-171 DoD Assessment Methodology. The DFARS provision 252.204-7019 introduces the “NIST SP 800-171 DoD Assessment Methodology” requirement. This requirement enables a strategic assessment of a contractor’s implementation of the NIST SP 800-171 requirements as required in DFARS clause 252.204-7012. The DoD Assessment Methodology requirement flows down to subcontractors.

6.5.2.1 Basic Assessment: The contractor shall obtain and maintain access to the Supplier Performance Risk System (SPRS) via the PIEE, (available via the internet at https://www.sprs.csd.disa.mil/)

6.5.2.1.1 The contractor shall perform a Basic Assessment, using the NIST SP 800-171 DoD Assessment Scoring Template, and enter the results electronically in SPRS for each covered contractor information system that is relevant to an offer, contract, task order, or delivery order. See Attachment 2, Deliverable Schedule Table.

6.5.2.1.2 The contractor shall ensure that applicable subcontractors also have their results of a current assessment posted in SPRS prior to awarding a subcontract or other contractual instrument in accordance with DFARS clause 252.204-7020.

6.5.3 The contractor shall provide the government with access to its facilities, systems, and personnel when necessary to conduct or renew a higher-level (i.e., Medium or High) assessment in accordance with DFARS clause 252.204-7020.

6.5.4 Cybersecurity Maturity Model Certification (CMMC): The CMMC (DFARS clause 252.204-7021) builds upon the NIST SP 800-171 DoD Assessment Methodology by adding a comprehensive and scalable certification element to verify the implementation of processes and practices associated with the achievement of a cybersecurity maturity level. The CMMC is designed to increase assurance to the DoD that federal contract information (FCI) and DoD Controlled Unclassified Information (CUI) is protected at a level commensurate with the risk. The CMMC requirement flows down to subcontractors.

6.5.4.1 The contractor shall have a current (i.e., not more than three years old) CMMC certificate in SPRS issued by an accredited CMMC Third Party Assessment Organization (3PAO) at the required CMMC level. The description of CMMC levels is available at https://www.cmmcab.org/.

6.5.5 The contractor shall submit requests to vary from NIST SP 800-171 in writing to the CO or COR, for consideration by the DoD Chief Information Officer (CIO). The contractor need not implement any security requirement adjudicated by an authorized representative of the DoD CIO to be non-applicable or to have an alternative, but equally effective, security measure that may be implemented in its place.

6.5.6 If the DoD CIO has previously adjudicated the contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the CO or COR when requesting its recognition under this contract.

6.5.7 Cloud Computing: If the contractor intends to use an external cloud service provider, on their behalf, to store, process, or transmit any DoD CUI in performance of this contract, the contractor shall require the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/) and that the cloud service provider complies with requirements in paragraphs 6.5.8 through 6.5.14 for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

6.5.7.1 If the information is DoD CUI-specific (e.g., PII/PHI), then the contractor shall ensure the external cloud service provider meet the security requirements equivalent to FedRAMP High baseline.

6.5.8 Cyber Incident Reporting Requirement

6.5.8.1 When the contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the contractor shall:

6.5.8.1.1 Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident, as well as other IS on the contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the contractor’s ability to provide operationally critical support; and

6.5.8.1.2 In accordance with DFARS clause 252.204-7012, rapidly report (within 72 hours) cyber incidents involving DoD CUI to DoD Cyber Crime Center (DC3) via https://dibnet.dod.mil/portal/intranet/. In the event of a cybersecurity incident involving a CUI-Specific breach (i.e., PII/PHI), the contractor, in addition to reporting to the DC3, shall follow the incident reporting guidance prescribed in the TRICARE Operations Manual, Chapter 1, Section 5, “Compliance with Federal Statutes” at https://manuals.health.mil/

6.5.8.2 Cyber incident report: The cyber incident report shall be treated as information created by or for DoD and shall include, at a minimum, the required elements as prescribed at the https://dibnet.dod.mil/portal/intranet/.

6.5.8.3 Medium assurance certificate requirement: In order to report cyber incidents in accordance with this clause, the contractor or subcontractor shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents. For information on obtaining a DoD-approved medium assurance certificate, see https://public.cyber.mil/

6.5.9 Malicious software: When the contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to DC3 in accordance with instructions provided by DC3 or the Contracting Officer. Do not send the malicious software to the Contracting Officer.

6.5.10 Media preservation and protection: When a contractor discovers a cyber incident has occurred, the contractor shall preserve and protect images of all known affected IS and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DoD to request the media or decline interest.

6.5.11 Access to additional information or equipment necessary for forensic analysis: Upon request by DoD, the contractor shall provide DoD with access to additional information or equipment that is necessary to conduct a forensic analysis.

6.5.12 Cyber incident damage assessment activities: If DoD elects to conduct a damage assessment, the CO will request that the contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of DFARS clause 252.204-7012.

6.5.13 Apply other IS security measures when the contractor reasonably determines that IS security measures may be required to provide adequate security in a dynamic environment or to accommodate special circumstances (e.g., HIPAA) and any individual, isolated, or temporary deficiencies based on an assessed risk or vulnerability. These measures may be addressed in a system security plan.

6.5.14 The contractor shall maintain within the US or US territories all Government data that is not physically located on DoD premises, unless the contractor receives written notification from the CO to use another location, in accordance with DFARS 239.7602-2(a).

6.5.15. The contractor shall mitigate supply chain risk to the government by complying with DFARS 252.239-7018 and only utilizing unified capability equipment identified on the DODIN Unified Capabilities Approved Products List (https://aplits.disa.mil/processAPList), unless granted a waiver in accordance with DODI 8100.04, DOD Unified Capabilities (UC).

6.6 Risk Management Framework (RMF) for DoD IT: All IS, Platform Information Technology (PIT) and IT Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with DoDI 8510.01, Risk Management Framework (RMF) for DoD IT and comply with annual Federal Information Security Modernization Act (FISMA) security control testing. IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the NIST SP 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

6.6.1 All systems subject to RMF must present evidence of authorization in the System Security Plan, Security Assessment Report) a Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has a DoD RMF or equivalent DoD Component PIT system accreditation decision that is current within 3 years within 5 business days of CO request. Evidence of FISMA compliance must be presented in the form of a POA&M. Systems must have and maintain an Authority to Operate (ATO) or Authority to Operate with Conditions (ATO-C) by contract award.

6.6.2 The contractor shall implement security controls in accordance with NIST implementation and validation requirements specified in the NIST SP 800-37 Risk Management Framework (RMF) and DoDI 8510.01, Risk Management Framework (RMF).

6.6.3 The contractor shall configure the information system in accordance with Defense Information Agency (DISA) Security Requirements Guides (SRGs) and security technical implementation guides (STIGs).

6.6.4 The contractor shall ensure that the information system conforms to the requirements of DoDI 8551.01 “Ports, Protocols, and Services Management (PPSM)”.

6.6.5 The contractor shall ensure that the information system shall authenticate all entities as specified in DoDI 8520.03 “Identity Authentication for Information Systems” prior to granting access.

6.6.6 The contractor shall Public Key (PK) enable the information system, implementing digital signature and encryption requirements specified in DoDI 8520.02, “Public Key Infrastructure (PKI) and Public Key (PK) Enabling”.

6.6.7 The contractor will be responsible for compliance with the Joint Force Head Quarters – Department of Defense Information Network issuances and IA Vulnerability Management (IAVM) issuances by ensuring that the issuances are assessed, implemented and maintained throughout development and sustainment in accordance with specified timelines.

6.6.8 The contractor shall support reciprocity, by providing all directed information in NIST security documents to the government.

6.6.9 The contractor shall implement system level protection and detection capabilities that are consistent with their contract for NIST Security requirements that meet DoD and DHA Cybersecurity Architectures.

6.6.10 Cyber Incident Reporting Requirement: The contractor shall comply with the incident management requirements of Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B, “Cyber Incident Handling Program”.

6.6.11 Information security continuous monitoring (ISCM): ISCM is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. ISCM is a critical part of the risk management process to ensure that IS and PIT operations remain within an acceptable level of risk despite any changes that occur. The Contractor shall maintain ongoing monitoring, analysis and incident response procedures for all ARRT and PIT systems under this requirement in accordance with NIST SP 800-137.

6.6.12 The contractor shall mitigate supply chain risk to the government by complying with DFARS 252.239-7018 and only utilizing unified capability equipment identified on the DODIN Unified Capabilities Approved Products List (https://aplits.disa.mil/processAPList), unless granted a waiver in accordance with DODI 8100.04, DOD Unified Capabilities (UC).

6.7. Facility Related Control Systems: RESERVED

6.8. System Communications - RESERVED

6.9 MHS Demilitarized Zone (DMZ) Medical Community of Interest (MedCOI) Business-to-Business (B2B) Gateway

6.9.1 If there is an external system connection to a DoD IS required, then the contractor shall, in accordance with contract requirements, connect to the DHA B2B Gateway via a contractor procured Internet Service Provider (ISP) connection.

6.9.2 The contractor shall assume all responsibilities for establishing and maintaining their connectivity to the B2B Gateway. This shall include acquiring and maintaining the circuit used to connect to the B2B Gateway and the acquisition of a Virtual Private Network (VPN) device maintenance agreement and license compatible with the MHS VPN device. The list of compatible devices are detailed in the DHA B2B/MedCOI Gateway questionnaire.

6.9.3 The contractor shall submit a completed current version of the DHA B2B Gateway questionnaire to their Contracting Officer or COR within 10 calendar days after new requirements have been provided to the contractor.

6.9.4 The contractor shall provide information specific to their connectivity requirements, proposed path for the connection and last mile diagram.

6.10 Contractor Provided IT Infrastructure

6.10.1 Platforms shall support HyperText Transfer (Transport) Protocol (HTTP), HyperText Transfer (Transport) Protocol Secure (HTTPS), web-derived Java Applets, and Secure File Transfer Protocols (SFTPs) (e.g., STFP, Secure Socket Layer/Transport Layer Security), and all software that the contractor proposes to use to interconnect with DoD facilities.

6.10.2 The contractor shall configure their networks to support access to Government systems (e.g., configure ports and protocols for access).

6.10.3 The contractor shall provide full time connections to a TIER 1 or TIER 2 ISP. Dial-up ISP connections are not acceptable. All IP addresses need to be publicly routable. Private address space using Network Address Translation will not be permitted.

6.10.4 The contractor shall maintain a valid maintenance contract and pertinent licenses for all devices connecting to the MHS B2B Gateway.

6.11 System Authorization Acess Request (SAAR), Defense Department (DD) Form 2875

6.11.1 The contractor shall submit the most current version of DD Form 2875, “System Authorization Access Request (SAAR), in accordance with CO guidance for all contractors that use the DoD Gateways to access Government IT systems and/or DoD applications shall. A DD Form 2875 shall be completed for each contractor employee who will access any system and/or application on a DoD network. The DD Form 2875 shall clearly specify the system and/or application name and justification for access to that system and/or application.

6.11.2 The contractor shall submit the completed DD Form 2875 to the DHA IT Security for verification of Tier I or Tier II Designation. The DHA Personnel Security will verify that the contractor employee has the appropriate background investigation completed or a request for background investigation has been submitted to the Office of Personal Management (OPM). Acknowledgment from OPM that the request for a background investigation has been received and that an investigation has been scheduled will be verified by the DHA Personnel Security prior to access being approved.

6.11.3 Upon approval, DHA will notify the user of the ID and password via secure/encrypted e-mail upon the establishment of a user account.