Draft MECS_Endoscopy_23Oct2026.docx

Minimum Essential Characteristics (MECS) Enterprise Encounter-Based Endoscopy Video Imaging System (EEVIS)

The contractor shall deliver software and configure it as necessary to establish connectivity throughout the infrastructure. The ultimate service goal is to consolidate site local endoscopy systems to a single enterprise endoscopy solution to provide standardization across the Defense Health Agency (DHA). This task includes but is not limited to:

i. Implementation at government hosted virtual environment not directly associated with any currently deployed Picture Archiving and Communication System (PACS). This virtual environment will be used for the complete implementation of the solution to include training and Risk Management Framework (RMF) (if no current Authority to Operate (ATO)).

ii. Standardize system configurations throughout the DHA Enterprise

Delivery and configuration of software

convert medical images in all standard and emerging imaging formats to ensure compatibility with various medical devices and systems.

Archiving and Communication System (PACS) capability and the Electronic Health Record (EHR).

(CPG) and National Protocol (NP) to ACHIEVE the Standard of Care (SOC).

established by the National Institute of Standards and Technology (NIST).

applications, enabling the effective synchronous and asynchronous sharing and utilization of patient data across the facility.

information among healthcare providers across different specialties and departments within the facility

to verify compliance with specific certification standards to meet the stringent requirements of specific regulations, [e.g., HIPAA] and applicable regulatory mandates.

standardization and interoperability.

(NARA) DHA approved disposition schedules to ensure the responsible legal management of records

specific report types (e.g., trend reports, anomaly reports) for business use case (e.g., predictive maintenance, customer segmentation).

peer assessment, equipment audit functions, etc.).

Non-Functional Requirements

13. The contractor shall provide a detailed topology document to include how the enterprise system will be configured and deployed with submission. The document will be updated to reflect any changes during implementation within 7 days prior to Go-Live (Deliverable #1).

14. Must offer/implement the most commercially available software version which has a DHA Enterprise level ATO. The entire solution must be commercially available at time of submission that meets or exceeds the MECs outlined in this document, no future features and functionality of the solution will be considered.

15. The contractor shall include maintenance support for the enterprise software solution over the contract period of 5 years.

16. The contractor must include software updates/upgrades, to include any professional services required. The application version deployed is the current commercially available software version.

17. The contractor shall not make software updates/upgrades without written approval from the PACS Program Management Office (PMO).

18. Training shall be conducted virtually once per PACS Hub with connected sites. One virtual session shall be recorded and saved for future training purposes.

Initial IDIQ sites:

- Ft. Eustis

- Yokota

- Ft. Belvoir

- USAFA

- Guam

- Hickam

- WPAFB

- Elmendorf

- Travis

- Langley

- Yokosuka

19. The contractor shall assign a Project Manager (PM) and have initial kick-off meeting with PACS PMO within 30 calendar days of base contract award. Meeting minutes must be provided by the contractor (Deliverable #2).

20. Kick off meeting with PACS PMO, PACS hubs, connected sites, and network hosting team between 60-90 calendar days of award. (Deliverable #3).

21. The contractor shall deliver a draft project plan at proposal submission and a final project plan within 30 calendar days after award of the base contract; and every 30 calendar days until project completion. The contractor shall provide a detailed implementation plan with specific tasks and timeline for all sites at time of submission. (Deliverable #4).

Project plan shall include the following:

i. The project plan shall include the start of delivery of software within 60 calendar days of award of the contract and installation shall begin within 90 calendar days of award. All sites must Go-live (clinically in use) within 12-months of contract award.

ii. The detailed implementation plan shall highlight the key deliverables, timelines, and expectations of each party responsible for delivery, configuration, and final acceptance of the systems Comprehensive implementation plan to install all systems, including total number of project managers and implementation team(s) involved.

iii. Detailed steps and task owners for implementation as well as expected completion time for each task.

iv. Proposed timeline for production Go-live for all implementations. “Go-live” date is met by full clinical usage of the system with fulfillment of migration requirements related to Go-live with no reliance on the legacy system.

22. The contractor shall host weekly status meetings with the Government representatives; contractor shall provide meeting agenda 24 hours prior to meeting and provide meeting minutes within 48 hours of the meeting conclusion. Meeting minutes will be provided in PDF format. (Deliverable #5).

23. The contractor can propose a Virtual Environment Host for testing if desired.

24. The contractor shall validate functionality of software in accordance with RMF accreditation documentation. RMF/ATO must continually be updated to meet the requirement of MEC number 4.

25. The contractor shall validate RMF Security Technical Implementation Guides (STIG) requirements and scan for vulnerabilities with DoD provided Nessus vulnerability scan software monthly.

26. The contractor shall resolve or mitigate any Category 1 or High Category 2 vulnerabilities.

27. The contractor shall, upon site installation, validate configuration is fully operational. Once contractor confirms, official notification must be submitted to the Contracting Officer Representative (COR). Within 45 calendar days of configuration validation, DHA will perform acceptance testing (AT). If the solution has zero discrepancies during AT, warranty will start on the day the official notification was made to the COR. If discrepancies are noted, warranty will start once the items are addressed by the vendor and confirmed by the government.

28. The contractor shall maintain an ATO on all product versions owned by the DHA and originally purchased through the awarded contract. If a contractor cannot support the ATO for all DHA owned versions of the product, the contractor can meet this requirement by offering to provide all upgrades to the product that are required to maintain the ATO for 5-years in accordance with the contractual period of performance or as long as mutually agreed to by both parties. Contractors who cannot support all versions of the product and cannot offer upgrades required to maintain the ATO for 5 years shall not be considered. Maintaining the RMF ATO shall be included as part of the contractor’s warranty period. (Deliverable #6).

29. If the patches are separate from updates as required by the service agreement, the contractor shall offer the cybersecurity patches under a maintenance offering on their contract that provides for all required cybersecurity patches/updates needed to maintain the ATO.

30. The contractor shall agree to the DHA Cybersecurity requirements for all upgrades. Although there is an exception to cybersecurity policy process for upgrades similar to maintenance, the DHA does not envision granting exceptions to cybersecurity policy and would instead replace the software in lieu of approving upgrades that do not comply with cybersecurity policy.

31. The contractor shall ensure that personnel accessing information systems have the proper and current Information Assurance (IA) certification to perform IA functions at contract award in accordance with DoD 8140.03–M, IA Workforce Improvement Program. The contractor shall meet the applicable IA certification requirements as outlined in DFARS 252.239-7001.

32. The contractor shall have DoD-approved IA workforce certifications appropriate for each category and level as listed in the current version of DoD 8140.03–M.

33. The contractor shall have appropriate operating system certification for IA technical positions as required by DoD 8140.03–M.

34. Upon request by the Government, the contractor shall provide documentation supporting the IA certification status of personnel performing IA functions. Contractor personnel who do not have proper and current certifications shall be denied access to DOW Information Systems for the purpose of performing IA functions.

35. All contractor employees that require access to DHA Information Technology (IT) must comply with the requirements of the DHA-Procedural Instruction 8140.01, Acceptable Use of the DHA IT, to include those contract employees with privileged access.

36. The contractor shall provide vulnerability scan and Security Content Automation Protocol (SCAP) scan results to Government monthly. Contractor shall provide raw scan results and administrative reports no later than the 10th calendar day of each month. (Deliverable #7).

37. The contractor shall submit drawing for/from RMF/ATO package to clearly demonstrate any 3rd party vendors being quoted are within the vendors boundary with submission. (Deliverable #8).

38. Business-to-Business (B2B) remote connection cannot be guaranteed. At times the B2B may not be available due to a variety of issues. If this happens, the contractor is still responsible to implement, and to maintain the up time of the system. If needed, the contractor shall send someone to the site to address any issue if progress is not shown within 48 hours. Contractor shall include costs for onsite installation and maintenance in the event B2B connection is not available or is not approved for a connection. The absence or lack of remote connectivity shall not delay implementation of system or configuration.

39. The DHA will determine the need to perform AT at a single PACS hub or multiple hubs as the implementation progresses. AT will be performed by Subject Matter Experts from the DHA PMO.

Functional Requirements

1. The capability MUST capture, record, manipulate, and allow viewing of high-definition video (live or recorded) and still images. Video and images shall come from stand-alone endoscopic equipment of multiple different brands and specialties, readily available in the healthcare facilities. (Scopes, cameras, light sources, and microscopes are examples of such stand-alone equipment, and therefore, excluded from this procurement.)

2. The capture device SHOULD be able to record and play video in high definition.

3. The capture device MUST be able to take and display pictures in high definition.

4. The capture device MUST be FDA approved and must comply with NFPA99 and Joint Commission rules for electronic/electrical medical devices.

5. The capability MUST be able to integrate products from multiple vendors if they can be certified for operating within the required networks. In this case, the lead vendor would assume responsibility for the operation of the entire system, training, warranty, compliance, and information systems security.

6. The capability MUST allow clinical providers to manipulate video and images, create or modify patient reports, and store reports with attached images/video from both, the point of care (patient treatment area) and government computers.

7. The capability MUST provide enough local storage space for five years worth of examinations and reports for the facility’s clinics. The capability MUST contain image capture and management devices for use at the point of care which receive input directly from existing camera and scope systems from multiple manufacturers.

8. The capability SHOULD be able to receive live and recorded video feed from the facilities’ existing endoscopy equipment.

9. The capability SHOULD provide tools for viewing, zooming, panning, and measuring medical images.

10. The capability SHOULD enable comparison of multiple images/videos side-by-side.

11. The capability SHOULD provide tools for measuring distances, angles, areas, and volumes within medical images.

12. The capability SHOULD allow for automated or manual segmentation of anatomical structures or regions of interest.

13. The capability SHOULD allow for the alignment of multiple images for comparison and analysis (current and archival)

14. The capability SHOULD enable the combination of images from different modalities into a single view.

15. The capability SHOULD provide tools for extracting quantitative data from images (e.g., density, texture, shape).

16. The capability SHOULD support basic statistical analysis of image data (e.g., mean, standard deviation, correlation).

17. The capability SHOULD enable the discovery of patterns and relationships within large image datasets.

18. The Capability MUST provide peripherals (i.e. keyboard, handsfree activation devices (i.e., foot-pedal, additional activation capturing device (buttons), and all connections necessary for operations of the device.

19. The capability MUST have the capability to read and store all patient reports and be able to find and retrieve all patient reports using system query functionality.

20. The capability MUST provide reports which can be generated at the time of the exam or later.

20. The capability MUST allow for scheduled report generation and distribution (i.e. audits).

21. The capability SHOULD generate reports in various formats (PDF, CSV, Excel) based on defined templates or ad-hoc queries.

22. The capability SHOULD provide options for report distribution, including email, secure messaging, printing, and secure file transfer.

23. The capability SHOULD provide tools for data visualization within reports, such as charts, graphs, and tables.

24. The capability MUST allow users to export report data for further analysis or integration with external systems.

25. The capability MUST allow users to define custom report templates based on specific criteria (e.g., patient demographics, image type, exam date, department, ordering provider, specialty, etc.).

26. The capability MUST provide reports which can be generated from the originating workstation or remotely.

27. The capability MUST be capable of saving generated reports.

28. The capability MUST be capable of printing stills of a video.

29. The capability MUST allow for the creation, editing, and searching of metadata associated with medical images and videos

30. The capability MUST include software for managing, viewing, and editing endoscopic images and accompanying reports.

31. The capability software MUST be approved for use in government networks operated by the Department of Defense (DoD).

32. The capability MUST be able to print to multiple formats (printer models) an image.

33. The capability SHOULD be able to transfer images/videos to various universal digital formats.

34. The capability MUST allow providers to annotate images with markers, text, and drawing tools.

35. The capability MUST encompass specific needs for data retention, formatting, access, performance, and disaster recovery, ensuring that data is stored, accessed, and protected in a manner that aligns with organizational policies and operational requirements.

36. The capability MUST provide secure storage for medical images/videos, patient data, and associated metadata.

37. The capability MUST be able to integrate and archive to the enterprise vendor neutral archive.

38. The capability MUST maintain a detailed audit trail of all user activities, including image access, sharing, and modifications.

39. The capability MUST provide a secure web-based system for use by authorized personnel capable of securely transmitting and storing endoscopic video and still images electronically.

40. The capability MUST allow authorized users to share images with other providers/activities/departments within the Enterprise.

41. The capability MUST support real-time collaboration features, such as chat, video conferencing, and screen sharing.

42. The capability MUST provide a platform for virtual case conferences, including image sharing, discussion, and decision-making.

43. The capability SHOULD incorporate AI algorithms capable of analyzing medical images across various formats to extract relevant clinical information.

43. The capability SHOULD have the ability to contain and capacity to continuously learn and improve its AI algorithms.

44. The capability SHOULD provide an interface for integrating AI powered image analysis algorithms.

45. The capability SHOULD contain algorithms that would create and display a 3D model/view.

46. The capability SHOULD contain algorithms which assist the provider with the control of robotic arms that assist you in endoscopy procedures.

47. The capability SHOULD contain image fusion algorithm to comprehensively combine anatomical imagery for medical diagnosis and treatment.

48. The capability SHOULD be able to capture and analyze large sets of data and utilize the data to assist in endoscopy procedures and diagnoses.

49. The capability SHOULD provide navigation and guidance algorithms for the specialty endoscopies in accordance with the Food and Drug Administration (FDA).

50. The capability SHOULD provide Artificial Intelligence (AI)-driven decision support tools to assist providers with the diagnosis process (ex. blood flow visualization in ophthalmology).

51. The capability SHOULD assist the provider/operator in the detections of object abnormalities utilizing AI analysis.

52. The capability SHOULD assist the provider/operator in the classification of object abnormalities utilizing AI analysis.

53. The capability MUST meet specified Department of Defense (DoD) Information Assurance (IA) and Network Security Requirements (i.e., secure platform, completed security documentation & testing, etc.).

54. The capability MUST maintain HIPAA regulation compliance.

55. The capability MUST identify and classify all data elements containing Protected Health Information (PHI) as defined by HIPAA regulations.

56. The capability MUST implement appropriate administrative safeguards to protect PHI, including policies, procedures, and training for personnel regarding HIPAA compliance.

57. The capability MUST undergo regular internal and external compliance assessments/audits to identify and address potential HIPAA compliance gaps.

58. The capability MUST include the ability to conduct quality assurance testing using a combination of unit, integration, system, and acceptance testing to ensure its reliability, functionality, and performance.

59. The capability MUST provide smooth and efficient playback of video and images, even for large files.

60. The capability MUST allow users to zoom in and out on video and images to examine details.

61. The capability MUST provide intuitive playback controls, such as play, pause, rewind, and fast forward.

62. The capability MUST be compatible with a variety of display devices, including monitors, projectors, and mobile devices.

63. The capability MUST provide local access to studies within a medical facility for clinical review.

64. The capability MUST monitor and provide quality indicators which highlight the effectiveness and efficiency of the endoscopy activities (image capture, measurements, etc.).

65. The capability MUST have the ability to allow for regular reporting and analysis of endoscopic data to identify trends, improve outcomes, and address quality issues.

DoD Cybersecurity/Risk Management Framework (RMF):

The DoD Cybersecurity/Risk Management Framework critical requirements for cybersecurity and supply chain risk management shall be included in all applicable solicitations and contracts for Information or Communication Technology (ICT), including medical devices. The language below addresses both the prohibition of components from foreign adversaries and the assurance of secure software development and vulnerability management practices.

Compliance with the requirements herein is a material contract requirement. The Contractor acknowledges that effective Information and Communications Technology Supply Chain (ICTS) management, including all constituent software, firmware, and hardware, is critical to DHA’s mission and security and integrity of the DoD Information Network.

· Vendors shall only offer items, including third-party vendor items, which already have an Authorization or Approval to Operate (ATO), or items for which the vendor, and third-party vendor if applicable, agrees to go through the RMF approval process and obtain an RMF ATO.

· Vendors, and any third-party vendor items, must meet all cybersecurity requirements listed in the MDE PMO Cybersecurity_RMF Requirements in Attachment 1. These cybersecurity requirements are listed as minimum requirements 01-19.

· Any offered system must meet DoD Cybersecurity/Risk Management Framework (RMF) and the attached DHA MDE Cybersecurity/Risk Management Framework document; Attachment 2 – DHA MDE Cybersecurity-RMF Contracting Requirements V3.0). Vendors must provide a statement with its offer that they, and any third-party vendors, agree to the Cybersecurity/RMF Requirements, HIPAA requirements, and B2B requirements.

· Vendors are required to provide a completed CyberLOG-MDE PMO ICS Medical Device and Equipment Risk Assessment (MDERA) Questionnaire (Attachment 3 –MDE MDERA v7.0 27 May 2026) for the offered system along with its offer. This includes any third-party vendor items.

· RMF shall be evaluated as part of the System Capability Factor. Vendors must meet all the below RMF minimum requirements. Vendors may be assigned strengths if they exceed any minimum requirement and/or meet any objective. Additionally, weaknesses may be assigned based on the vendors’ responses in the Joint Medical Device Risk Assessment Questionnaire. RMF weaknesses may include, but are not limited to, deficiencies in architecture or software versions, having cancelled RMF efforts due to vendor non-responses or inability to get an RMF (to include RMF actions conducted by any organization within the DoD), system having received a Denial of Authorization To Operate (DATO) from any service, and deficiencies that cannot be mitigated/accepted.

· Submitting an offer for any requirement under this initiative constitutes full agreement to all specific RMF requirements listed in this RFO and Attachment 2 (DHA MDE Cybersecurity-RMF Contracting Requirements V3.0). This includes:

· For all MDE identified by the Government as requiring a full Assess and Authorize (A&A) approval, including IV&V test, the vendor shall not make any delivery and shall not receive payment until the Authorizing Official (AO) approves the medical device and equipment to be installed at the site and connected to the MedCOI network. Delivery of all system components, including any 3rd party items, may take place prior to this milestone (AO approval) only if written permission is provided by the Contracting Officer.

· For all MDE identified by the Government as requiring an Assess and Incorporate (A&I) approval, the vendor shall not make any delivery and shall not receive payment until the PMO has completed a review of submitted RMF documentation and technical results, And the Authorizing Official (AO) approves the medical device and equipment to be installed at the site and connected to the MedCOI network. Delivery of all system components including any 3rd party items, may take place prior to this milestone only if written permission is provided by the Contracting Officer.

· For all MDE identified by the Government as requiring an Assess and Use (A&U) approval, the vendor must receive written confirmation from the MDE PMO or Contracting Officer that the Authorizing Official (AO) approves the medical device and equipment to be installed at the site and connected to the MedCOI network, then the vendor may proceed with delivery.

· Prior to final acceptance and installation, as a part of acceptance testing, the vendor shall provide procedures for the accepting sites to ensure the delivered device matches the DHA authorized configuration. The vendor shall coordinate running Nessus and SCAP scans with the site and the assigned DHA Cybersecurity Analyst to verify compliance. Any deviations from the approved configuration will require the vendor to bring the system into compliance before final acceptance and payment.

· The vendor shall maintain an DHA RMF ATO on all equipment/product versions, owned or operated by the DHA, and covered under this contract/order. If the vendor cannot support the DHA RMF ATO for all DHA contract/ordered versions of the equipment/product, the vendor can meet this requirement by offering to provide all upgrades to the equipment/product that are required to maintain the DHA RMF ATO, either at no cost to the Government or at a fixed price that is included in a subsequent SMA offering under the vendor’s contract/order. During the period of time the vendor’s product is installed on the DHA network, the vendor shall provide all required cybersecurity patches/updates/upgrades, including Operating System and application upgrades where necessary. Maintaining the DHA RMF ATO shall be included as part of the vendor’s warranty. For updates/patches, executable files shall be distributed by the vendor accordingly, or implemented by the manufacturer’s technical staff, dependent on the contract/order processes.

· Maintaining DHA RMF ATO shall be included as part of the vendor’s warranty period.

· All RMF costs related to the initial purchase of the equipment must be added to the vendor’s long-term contract prior to award.

· Vendors must clearly state in their offer if there are any costs associated with RMF support for any support term, including life of the system.

RMF support is defined as the support required to maintain the DHA RMF ATO by providing all required cybersecurity patches/updates/upgrades, including Operating System and application upgrades where necessary.

· All RMF support costs must be on contract prior to the end of the warranty year. All RMF part numbers offered below that are not on contract prior to the end of the warranty year will be considered $0.00 for as long as the system is on the DHA network.

· Vendors must provide all part numbers and/or detailed description of the offered system's RMF support costs to support DHA cybersecurity requirements after the warranty period expires for post warranty years (i.e., Year 2 through Year 6).

· Failure to agree to the attached DHA Cybersecurity Requirements document, disclose third-party vendor items requiring DHA RMF ATO provide a completed Attachment 3 –MDE MDERA v 7.0 questionnaire, and provide or state any RMF related costs, may result in rejection of the vendor’s offer. Failing to disclose that a system has third-party components requiring RMF Approval, the system cannot meet RMF requirements, failure to meet certification timeframes or failure to receive DHA RMF ATO, including third-party items, may result in termination for cause in accordance with FAR 52.212-4(m).

NOTE: Any weaknesses may be mitigated through other RMF requirements and vendor must indicate how any issue can be mitigated. Unmitigated weakness could be severe as to lead to a vendor being unable to receive an ATO.

The following shall be provided as part of the vendor’s technical proposal. The completeness and quality of these submissions will be used to assess the offeror's security maturity and will be a key factor in the Government's evaluation of competing proposals.

1. Prohibition on Foreign Adversary Sourcing and Certain Telecommunications and Video Surveillance Services and Equipment:

The Vendor represents and warrants that the ‘company’ and its subcontractors or suppliers thereof do not incorporate hardware (including components), software, or firmware to be supplied under a contract that is manufactured, assembled, or otherwise sourced, in whole or in part, consisting of the product types or services contained in the ‘Covered List’ at https://www.fcc.gov/supplychain/coveredlist, or from any supplier who is an affiliate or otherwise controlled by a ‘Foreign Adversary Country’. "Foreign Adversary Country" is defined as the Peoples Republic of China, the Russian Federation, North Korea, Iran, and Venezuela (Madura Regime), and any other actor identified by the Secretary of War or Office or the Director of National Intelligence. With regard specifically to the supply of classes of equipment only, these prohibitions do not apply to equipment or components that “cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.” Representations and declarations shall be made consistent with FAR 52.204-24 and DFARS 252.204-7017, which are not limited to covered equipment or their components except as described in the “Covered List”.

2. Bills of Material (HBOM/SBOM)

The Vendor shall provide a comprehensive Hardware and Software Bill of Materials (HBOM/SBOM) for all products to be provided in response to this solicitation or to be provided under this contract. Reference the CISA Hardware Bill of Material Framework for Supply Chain Risk Management and the CISA 2025 Minimum Essential Requirements for Software Bills of Material. The resultant BOMs must include:

· The supplier and/or manufacturer, and country of origin for each electronic component.

· Identification of any components sourced (in whole or in part) from a Foreign Adversary Country, Prohibited Source of Supply, or any non-TAA Compliant Country.

· Other information as is required under the representation provided in compliance to FAR 52.204-24 and DFARS 252.204-7017.

The SBOM and HBOM submitted and accepted by the Government at the time of award shall be considered the baseline for the delivered system and or equipment.

3. Secure Development Practices and ICT Supply Chain Risk Management (SCRM)

· Using NIST SP 800-218 as a reference, and as applicable to the vendors’ product(s) to be delivered under the contract, the vendor must demonstrate, based on its own documented procedures, a commitment to secure software development practices.

· The vendor must also demonstrate that it has processes and procedures in-place for vetting third-party components (hardware and software), managing open-source software and related supplier and supply chain risks, managing changes to system and component configuration, and discovering and responding to vulnerabilities.

4. HBOM and SBOM Change Management The vendor shall be responsible for change management and notification to the Government in cases where there have been changes to the baseline HBOM and SBOM post award. Notification of the COR will be required under the following conditions:

· Upon any Software/Firmware Update: An updated SBOM shall be delivered within 15 business days of the release of any software or firmware update which would impact the product or component baseline for subsequent deliveries under the contract.

· Upon Hardware Component Revision: An updated HBOM shall be delivered if any hardware component of the system undergoes a revision or part substitution which would impact the configuration of devices delivered under the contract.

· Upon Government Request: The Contractor shall provide the most current SBOM and HBOM within 30 days of a request from the COR.

5. Vulnerability Management, Continuous Monitoring and Notification of Non-Compliance Post award, and every 90 days thereafter, the vendor shall monitor the list of prohibited equipment and or services at https://www.fcc.gov/supplychain/coveredlist, or otherwise posted to SAM.gov. Should the vendor based on these Government sources or through any other source including any subcontractor or supplier, determine that any equipment or component violates these requirements relative to prohibited sources of supply, the Vendor shall:

· Notify the Contracting Officer within 3 business days of discovery and follow the other reporting procedures under FAR 52.204-25 and DFARS 252.204-7018.

· Within 30 days of discovery, provide a detailed mitigation strategy to address any potential security risks, including required configuration changes and/or upgrades that would remediate the potential risks.

· If the component is deemed critical to the operation of the system relative to the system functional requirements or specifications, and cannot otherwise be mitigated or remediated, provide an alternative sourcing plan for the affected component within 30 days of notification.

In addition, the vendor shall proactively monitor all components in the baseline SBOM/HBOM for new vulnerabilities. For any ‘High’ or ‘Critical’ severity vulnerability (CVSS v3.x score of 7.0 or higher), the Contractor shall notify the COR and the DHA Cyber Operations Center within 72 hours of discovery using secure mail or by contacting the DHA Cyber Operations Watch Desk at (866)-786-4432. This notification must include the CVE, a description of vulnerability, the affected components, potential impact, and immediate mitigation instructions. A formal remediation plan and timeline for corrective action shall be delivered within 30 days of notification.

6. Government Review, Validation and Approval All mitigation strategies, remediation plans, and alternative sourcing plans are subject to the Defense Health Agency's (DHA) review and written approval. The Vendor's ability to adequately address ICT supply chain risks to DHA's satisfaction will be a critical factor in the assessment of contract performance. Independent review and verification can include, but is not limited to, analysis of the delivered SBOM/HBOM and sources of supply, physical inspection of components, vulnerability scanning of the system or components to validate hardware, software and firmware configuration. In case of non-compliance with these requirements, or misrepresentations, the Agency may implement whatever remedies under the contract that it deems appropriate or necessary. Current policy and regulations state that in some cases, non-compliance with these requirements will render the vendor, company, or a supplier ineligible for subsequent awards.

7. Support for Risk Management Framework (RMF) The Vendor shall provide all necessary cooperation and required artifacts for the Government to obtain and maintain the necessary approvals under the Risk Management Framework (RMF) as required to operate the system. A system or device which cannot attain the necessary approvals cannot reside on the DHA information network. Prior to first unit delivery, and not later than 30 days from the date of award, the vendor shall provide the following artifacts to the COR and Project Management Office’s designated Information Systems Security Manager:

· System Architecture Diagram (required in all cases except where the configuration consists of a single stand-alone device)

· Completed DHA Security Questionnaire

· Hardware and Software Bills of Material (provided as part of the Solicitation or updated at time of Award)

· Comprehensive discovery, configuration, and vulnerability scans (all system components and devices), using Tenable Nessus And within 60 days:

· Completed Controls Selection Worksheet (as provided by the Government for the system, component(s), or device(s) No system components or devices are to be delivered, nor will the Government be responsible for payment for any system component or device, subject to the RMF process, until the minimum required artifacts are delivered and accepted by the Government. If the complexity of the system, component, or device requires configuration or integration, such that validation of the security configuration cannot be done independently, the vendor may propose a vendor site inspection and validation to occur not later than 90 days from award. The vendor will still be responsible for the 30 and 60 deliverables listed above excluding the comprehensive discovery, configuration, and vulnerability scans which would be done at the vendor site. The vendor site must be located in the continental United States (lower 48 States). Final artifacts will be due 30 days after the inspection and pending approval and acceptance by the Government.

8. Flow-down Requirements Relative to the requirements for prohibited sources of supply under FAR Subpart 4.21 and associated clauses, the Vendor (Contractor) shall insert the substance of these requirements as well as the clause at DFARS 252.204-7018 in all subcontracts and other contractual instruments for the acquisition of commercial products or commercial services under the prime contract.

MILESTONE PERFORMANCE SCHEDULE

Enterprise Encounter-Based Endoscopy Video Imaging System

Month Kick Off Meeting with DHA PMO and vendor, project plan presented and agreed to by Govt and vendor.

Month 2 - 3 Kick Off meeting with PACS hubs, Network hosting team and software/licenses delivered

Month 4-9 Implementation and configuration of software PACS desktop integration configuration

Month Configuration and integration testing with Super Users and DHA PMO

Month System Administrator and User applications training

Month System Go-live and DHA AT and validation

Deliverables Schedule

Deliverable #2:

Contractor shall assign a Project Manager (PM)

Deliverable #3:

Kick off meeting with PACS PMO, PACS hubs, connected sites, and network hosting team

Deliverable #5:

weekly status meetings

Deliverable #6:

Maintaining ATO

Deliverable #7:

vulnerability and SCAP scan

Deliverable #8:

Artifacts and Documentation required for RMF Certification and Accreditation