DRAFT_PWS_DeploymentSolutions_2026.03.03.pdf

Program Executive Office - Defense Healthcare Management Systems 1

(PEO DHMS) 2

Deployment Solutions 3

Performance Work Statement (PWS) 4

1. Background 5

The Program Executive Office - Defense Healthcare Management Systems (PEO DHMS) 6 is responsible for delivering advanced health IT solutions to the Department of War 7 (DoW), the Department of Veterans Affairs (VA), the United States Coast Guard 8 (USCG) and other federal partners including efforts coordinated through the Federal 9 Electronic Health Record Modernization (FEHRM) office. Within its portfolio, PEO 10 DHMS oversees three critical programs: Defense Healthcare Management System 11 Modernization (DHMSM), Joint Operational Medicine Information System (JOMIS) and 12 Enterprise Intelligence and Data Solutions (EIDS). These programs collectively enhance 13 healthcare delivery, operational medicine capabilities, and medical readiness across 14 diverse environments. 15

DHMSM was established to acquire and field a configurable and scalable modernized 16 Electronic Health Record (EHR) system to replace DoW legacy healthcare systems. In 17 support of this mission, DHMSM acquired an integrated inpatient/outpatient Commercial 18 EHR solution known as MHS GENESIS. The DHMSM portfolio extends beyond MHS 19 GENESIS, incorporating a broader set of solutions to create a single, unified EHR for the 20 federal health community. Through a suite of clinical applications and products, 21 DHMSM provides comprehensive health management, advanced data applications, and 22 improved usability, supporting priorities such as telehealth, population health analytics, 23 and a user-facing patient portal. The DHMSM Program Management Office (PMO) 24 manages the integration of these business processes and clinical workflows to ensure user 25 adoption and a seamless experience throughout the full continuum of care. 26

JOMIS provides warfighters with technologies to make life-saving and critical mission 27 decisions in operational medicine (OpMed) environments. In support of this mission, 28 JOMIS develops, deploys, and manages OpMed products that allow for documentation of 29 patient care, transmission of patient care data through all roles of care, medical readiness 30 tracking and aggregation of medical Command and Control Situation Awareness (C2SA) 31 data. The JOMIS products are meant to be used as an integrated suite of products that 32 work together with DHMSM and EIDS products to inform the longitudinal health record 33 and conduct aggregated medical reporting and simulations to support C2SA. The suite 34 includes but is not limited to OpMed Care Delivery Platform (CDP), Battlefield Assisted 35 Trauma Distributed Observation Kit - Joint (BATDOK-J), Medical Hub (MedHUB), and 36 Theater Blood-Mobile (TBLD-M). As new capabilities are identified, new products or 37 capabilities may need to be deployed, once developed. JOMIS users are deployed forces 38 across the globe supporting all roles of care in connected and disconnected operational, 39 austere, and forward-deployed locations. To deploy and train OpMed products to the 40 field, JOMIS collaborates with their Service partners to provide a variety of different 41 deployment and training methods based on each individual site or unit, to include low-to-42 no touch deployment and training. 43

Due to the growing demand for its product portfolio, PEO DHMS has expanded its focus 44 to include the deployment to operational locations, and additional federal partners, as 45 well as specialized environments where standard network connectivity is limited or 46 unavailable. 47

2. Purpose & Scope 48

This is a non-personal services contract to provide all services and materials necessary to 49 support and execute the on-demand deployment of DHMS products, and related or 50 supporting components. This includes program management, deployment planning and 51 execution, hardware delivery and connectivity, product connectivity and interface 52 validation, user enablement services, and data management and migration 53

Services are applicable to Continental United States (CONUS) and Outside Continental 54 United States (OCONUS) locations, covering various roles of care and facility types as 55 specified in individual task orders1. 56

3. Desired Outcomes/Tasks/Objectives 57

This section outlines the desired outcomes, high-level tasks, and core objectives for the 58 successful deployment of products and integrated systems to hospital (fixed facility) and 59 field unit (expeditionary) environments under this Indefinite Delivery, Indefinite Quantity 60 (IDIQ) contract. The contractor shall be responsible for all activities necessary to ensure a 61 seamless transition from project initiation to full operational capability at each 62 deployment site with minimal disruption to ongoing operations. The overarching goal is 63 to deliver a fully functional and adopted solution that ensures the seamless and accurate 64 transmission of data through all roles of care and meets the mission needs of each 65 location. This is critical for updating patient health records and aggregating data for 66 C2SA reporting. 67

Each task order will specify the exact scope, schedule, and performance criteria for a 68 given deployment. The objectives listed herein describe the full range of capabilities that 69 may be required across the full range of military operations. 70

1 The Department anticipates that the user base, supported organizations, and operational footprint may expand over the period of performance. While the scope and timing of any such expansion cannot be precisely defined at this time, offerors should be aware that future requirements may include support for periods of increased operational tempo and additional participating entities consistent with evolving mission needs.

3.1 Program Management 71

As part of the Deployment Approach (A003) and the Implementation Plan (A010), the 72 contractor shall provide a program management framework to ensure deployment efforts 73 are governed by consistent standards of quality, risk management, and fiscal discipline. 74 This framework shall provide the Government with full transparency into project 75 performance and ensure the contractor is accountable for all outcomes. The contractor 76 shall successfully execute all work under this contract, including the necessary processes 77 and tools to effectively manage cost, schedule, and performance/resources. Specific 78 requirements, deliverables, and reporting frequencies for each activity will be defined 79 within individual task orders. 80

The contractor shall designate a Program Manager (PM) who will serve as the 81 Government's primary point of contact. The PM must be authorized to act on behalf of 82 the contractor for all matters related to this contract and its subsequent task orders. The 83 PM is responsible for the overall management of contract performance, including 84 resource allocation, risk mitigation, and ensuring clear communication with the 85 Government's Contracting Officer's Representative (COR). 86

Core Management Functions: 87

• Support for Governance and Stakeholder Engagement: The contractor shall 88 provide dedicated support for all Government-led governance bodies (e.g., 89 Informatics Steering Committee or OpMed IT Steering Committee). The 90 contractor's role is to facilitate informed decision-making by: 91 o Preparing and Facilitating Materials: Developing meeting agendas, 92 presentation materials (D001), data-driven analyses, and expert 93 recommendations on deployment strategies for Government review and 94 consideration. 95 o Documenting and Tracking Outcomes: Recording meeting minutes 96 (D002) and tracking action items and key decisions made by the 97 Government-led committees. 98 o Executing a Stakeholder Communications Plan: Developing and 99 executing a comprehensive communications plan that identifies all key 100 stakeholder groups and defines the contractor's strategy for disseminating 101 information about project status, risks, and changes as directed by 102 Government leadership. 103

• Risk and Issue Management: The contractor shall develop and actively maintain 104 a risk register. This includes creating a comprehensive Contingency Plan to 105 mitigate identified risks, such as data loss, network failures, or schedule delays, 106 ensuring mission-critical operations are protected for the task order. 107

• Quality and Change Management: The contractor shall implement a robust 108 Quality Management process to ensure all deliverables meet or exceed contract 109 standards. The contractor shall develop and maintain an effective Quality Control 110 Plan (QCP) (CDRL A001), which outlines quality procedures and includes a self-111 inspection and internal coordination plan. The QCP shall establish a formal 112 Change Control process to manage, document, and validate any modifications to 113 the system or its configuration post-deployment. Required revisions must be made 114 within 5 working days. 115

• Staffing Plan: The contractor shall develop, maintain, and deliver a Staffing Plan 116 (D003) that details the roles and labor categories required to successfully execute 117 all tasks specified in the task order. 118

• Contract Reporting and Administration: The contractor shall manage the 119 timely development and submission of all contract deliverables as delineated in 120 the PWS and Sections 33-36. 121

• Financial and Contract Reporting: The contractor shall provide a Monthly 122 Progress Report (D00) detailing performance against schedule, budget, and 123 objectives. 124

• Kick-Off Meeting: The contractor shall conduct a kick-off meeting with the 125 Government for each awarded task order. The purpose of this meeting is to ensure 126 a shared understanding of the task order requirements, establish lines of 127 communication, and review the contractor's planned approach. 128

3.2 Deployment Planning and Execution 129

The contractor shall employ an adaptable framework for planning and executing all 130 deployments. This framework ensures that each project, regardless of scale or location, 131 moves from concept to sustained operation in a deliberate and controlled manner. 132

3.2.1 Initiation and Planning 133

During initiation and planning, the focus shall be on discovery and creating the blueprint 134 for successful deployment. 135

• The Deployment Approach (CDRL A003) is the foundation for the 136 Implementation Plan (CDRL A010). The contractor shall provide the overall 137 approach and methodology for deployment, training, user adoption, change 138 management, and communications across multiple environments/networks, 139 fixed/expeditionary facilities for multiple products, and with different federal 140 partners (DoW and non-DoW). The contractor shall include any potential 141 opportunities, risks, issues, and dependencies for each area, and mitigation plans. 142

• Deployment Readiness Assessment (D008): The contractor shall provide a 143 Deployment Readiness Assessment, which is a formal and systematic evaluation 144 used to determine if an organization, its users, and the technology itself are fully 145 prepared for a successful "go-live" event. This assessment is a comprehensive 146 review that measures preparedness against a predefined set of criteria, moving 147 beyond just technical functionality to include people, processes, and support 148 systems. The contractor shall identify risks, gaps, and potential points of failure 149 that could jeopardize the deployment's success, disrupt operations, or hinder user 150 adoption. 151

• Implementation Plan (CDRL A010): Based on the Readiness Assessment, the 152 contractor shall develop, maintain, and actively manage an implementation plan, 153 to include a detailed Integrated Master Schedule (IMS) (CDRL A011). The 154 Implementation Plan is the detailed tactical execution plan that operationalizes the 155 approach outlined in the Deployment Approach. 156

3.2.2 Configuration, Validation, and Implementation 157

As specified in the task order, the contractor shall perform configuration, validation, and 158 implementation activities required for deployment, culminating in the formal cutover 159 event. 160

• Data Collection: As specified by the task order, the contractor shall facilitate the 161 timely and accurate collection of all required product configuration data (Product 162 Configuration Data (D009)). 163

• Product(s) Configuration: The contractor shall execute the configuration 164 activities as specified in the task order. DHMS products may include hardware 165 and/or component installation and configuration across various networks. This 166 may include user role assignment, security permissions, and system-level 167 parameters. 168

• Cutover: The contractor shall manage the cutover to the new product(s). Specific 169 activities will be specified in individual task orders. 170

3.2.3 Stabilization and Transition 172

The contractor shall stabilize the new environment and ensure a seamless hand-off to 173 sustainment teams. 174

• Post-Deployment Stabilization Support: The contractor shall implement and 175 manage a multi-tiered user support structure to provide rapid and effective 176 assistance, including on-site "at-the-elbow" and remote support as defined in the 177 task order. 178

• Post-Deployment Stabilization Report (D010): The contractor shall provide a 179 daily report during the Post-Deployment Support period as defined in the task 180 order. This report will include status of tickets, devices, user support, and other 181 key indicators of a successful transition. 182

• Transition to Sustainment: The contractor shall execute a formal transition plan 183 to hand off the fully deployed and stabilized product(s) to the Government 184 sustainment and operations teams. 185

3.3 Hardware Delivery and Connectivity 186

The contractor shall manage the procurement, end-to-end logistics using DD Form 1149 187 (D011), installation, and network integration of all required hardware as delineated in the 188 task order. The desired outcome is that all physical components are identified, delivered, 189 installed, connected, and functioning as intended in their designated operational 190 environment based on Government requirements. 191

3.3.1 Network Integration and Configuration 192

The contractor shall ensure seamless integration with existing network infrastructure, 193 validating bandwidth requirements and testing all network configurations and firewall 194 rules. As applicable, the contractor shall deploy and configure products to operate 195 autonomously in Disconnected, Intermittent, and Limited (DIL) environments, 196 encompassing the full range of operational platforms from server-based theater hospital 197 products to mobile, point-of-injury data capture solutions running on handheld devices 198 and wearable sensors. Configure all hardware to comply with applicable DoW 199 cybersecurity requirements. 200

3.4 Product Connectivity and Interface Validation 201

The contractor shall test and validate that data from one product is correctly mapped to 202 the corresponding fields in the receiving product. 203

3.4.1 Medical Device Connectivity and Validation 204

The contractor shall ensure that all required medical devices can securely and reliably 205 connect to and interoperate with the newly deployed product. The outcome is a fully 206 validated, integrated environment where data flows accurately and securely between 207 medical devices and the central system, ensuring patient safety and quality of care. 208

3.4.2 Product Validation 209

The contractor shall develop and execute a Product Validation Plan (D012) for all 210 products configured as specified in the task order. 211

• Validate the product(s) functionality, which may include integration with external 212 systems and interfaces, to ensure it operates as intended under expected 213 conditions. 214

• Validate interfaces where applicable with financial and administrative systems as 215 specified in the task order. 216

3.5 User Enablement Services 217

The contractor shall provide all necessary personnel, supervision, and materials required 218 to perform a full range of training and user adoption services in support of the 219 deployment of DHMS products. The contractor must possess the capability to perform 220 the services described in the sections below. 221

3.5.1 Human Systems Integration (HSI) Alignment 222

The contractor shall ensure that all training, adoption, and support services are aligned 223 with the principles of Human Systems Integration (HSI) as outlined in DoDI 5000.95. 224 The objective is to ensure that the contractor's services contribute to a total system that is 225 effective, suitable, and safe for human use. The contractor shall maintain a working 226 knowledge of HSI principles and processes, and leverage HSI principles to identify and 227 help mitigate barriers to user performance and acceptance. 228

3.5.2 Consideration of Operational Environments 229

The contractor shall possess the capability to provide training, adoption, and user support 230 services to users in operational environments, including theaters of war and other 231 locations with DIL network connectivity. The specific requirements for such support will 232 be detailed in individual task orders. When providing services for these environments, the 233 contractor shall ensure all resources, methods, and support models are operationally 234 suitable to achieve optimal staff efficiency at the lowest possible barrier to adoption. The 235 focus shall be on user self-sufficiency and mission effectiveness in a contested or austere 236 environment. 237

3.5.3 Consideration of Global User Community 238

All services described herein shall be available to a global user base. The contractor shall 239 deliver consistent, prompt, and effective support to personnel regardless of their 240 geographic location or time zone. All planning, staffing, and execution strategies must 241 account for the complexities of worldwide operations, including but not limited to, 242 varying network conditions, local command structures, and cultural considerations. 243

3.5.4 Training 244

As part of the Deployment Approach (CDRL A003) and Implementation Plan (CDRL 245 A010), the contractor shall design, develop, and execute a comprehensive training 246 program to ensure users are familiar with the product deployed in the task order. For the 247 Federal EHR, proficiency is achieved when a user can consistently and confidently 248 complete role-specific workflows and pass course-specific competency assessments. For 249 JOMIS products, the training shall be intuitive, user-centric, and outline a joint approach 250 for collaborative execution with the Services. The training program should also provide 251 schedules, risk assessments, and mitigation plans for each product and site in a timely 252 manner. The Government will specify the required materials and target audiences in each 253 task order. The desired outcome is a confident and competent user base capable of 254 leveraging the product(s) full capabilities effectively and efficiently. 255

3.5.4.1 Training Program Development 256

• Develop a formal training and orientation plan that identifies all relevant user 257 groups, personas, and their specific learning needs. 258

• Deliver a blended, role-based Training Curriculum (CDRL A002) for all impacted 259 functional and technical/sys admin users that combines various methods like 260 instructor-led training (both virtual and in-person), self-paced e-learning, and 261 hands-on simulations. Content must be tailored to the specific workflows and 262 responsibilities of the user. 263

• Create a full suite of training materials, including instructor guides, user manuals, 264 quick reference guides (tip sheets), computer-based training, micro-learning, and 265 in-application guidance such as tooltips and contextual help directly within the 266 tool. 267

• Identify and train designated "super users" from experienced staff who will 268 participate in testing and provide peer support. 269

• Establish a dedicated training environment that mirrors production and mimics 270 real-world configuration, workflows, and product interactions to allow hands-on 271 practice. 272

3.5.4.2 Training Delivery 273

• The contractor shall provide qualified instructors to deliver and manage end-to-274 end training for a diverse and geographically dispersed user base. Instruction must 275 be tailored to the specific task order and operational environment, accommodating 276 all echelons of care. To build user confidence in newly deployed products, the 277 training shall incorporate role-based simulations and "day-in-the-life" scenarios 278 for users throughout the full continuum of care. 279

• The contractor shall manage all end-to-end logistics for training delivery as 280 specified in the task order, including user assignment, scheduling, and tracking. A 281 key component will be conducting "train-the-trainer" sessions to enable 282 government personnel to provide ongoing sustainment training. 283

• Training shall be delivered via multiple methods, including Instructor-Led 284 Training (ILT), Virtual Instructor-Led Training (VILT), Computer-Based 285 Training (CBT), in person support, and self-guided learning. To ensure a smooth 286 transition, the contractor will identify critical user groups to maintain key 287 functions during cutover and provide on-site or virtual support for end-users 288 during and after deployment. 289

• The contractor must identify a method for tracking user proficiency. As specified 290 in the task order, they will deliver a User Training Completion Report (D007) to 291 measure progress. A final report on all training activities is also required, which 292 will include attendance records, a roster of untrained users, a summary of user 293 feedback, and lessons learned. 294

3.5.5 Adoption and Change Management 295

The contractor shall provide and execute robust user adoption and change management 296 support to facilitate a smooth transition and foster buy-in. The overarching goal is to 297 prepare the organization for change, drive user acceptance and adoption, and demonstrate 298 the realization of measurable value from the newly deployed product(s). The contractor is 299 responsible for the execution of all change management activities to ensure the successful 300 integration of the new product(s) into the organization's daily workflows and culture, 301 leading to high levels of user satisfaction and the realization of the product's intended 302 benefits. 303

3.5.5.1 Change Management and Leadership Engagement 304

• As part of the Deployment Approach (CDRL A003) and Implementation Plan 305 (CDRL A010), develop and execute a comprehensive Change Management and 306 Adoption Plan that outlines the approach for managing the human side of the 307 transition. The contractor shall be responsible for managing all activities outlined 308 in the plan, leveraging proven industry best practices and models for both its 309 development and execution. 310

• Conduct a thorough stakeholder and change impact analysis and use its findings 311 to actively manage stakeholder engagement, mitigate resistance, and adapt to 312 evolving organizational needs throughout the transition. Use readiness surveys to 313 gauge organizational preparedness. 314

• Actively engage Government leadership to secure strong executive and clinical 315 buy-in. The contractors shall lead the effort to empower and equip identified 316 physicians and staff champions to take a leadership role in the transition. 317

• Implement and manage a dedicated communication and engagement strategy, as 318 applicable, ensuring consistent and effective communication throughout the task 319 order. 320

3.5.5.2 Communication and End-User Engagement 321

• Design and execute a tailored communication and engagement plan to keep all 322 stakeholders informed, build awareness, and address concerns. 323

• Create, disseminate, and maintain communication products that build awareness 324 of the "why" behind the change, broadcast key project milestones, and celebrate 325 successes to build momentum and positive sentiment. The contractor is 326 responsible for the full lifecycle of these materials. 327

• Actively and continuously manage the engagement of end-users throughout the 328 design, planning, and implementation process, ensuring their feedback is 329 documented and incorporated to create effective workflows. 330

• Design, schedule, and conduct dedicated engagement sessions for supervisors and 331 organizational leaders. The contractor shall develop and deliver leader-specific 332 talking points, FAQs, and coaching materials to equip leaders to champion the 333 change and manage resistance. 334

• Establish, manage, and host regularly scheduled, informal "Office Hours" and 335 open forum sessions (both virtual and in-person) as required by the task order. 336 The contractor is responsible for staffing these sessions and providing immediate, 337 transparent answers. 338

• Facilitate engagement activities (e.g., focus groups, user interviews, direct 339 observation) to assess organizational readiness and identify potential barriers to 340 user acceptance. The contractor shall then analyze these findings to develop and 341 implement targeted interventions (e.g., additional demos, specialized 342 communication) to address identified barriers and ensure all user groups are 343 successfully supported. 344

3.5.5.3 Adoption Measurement and Reinforcement 345

• Implement and manage the tools and processes to monitor product usage and user 347 proficiency post-cutover. The contractor shall define, track, analyze, and report 348 on metrics demonstrating measurable value, user satisfaction, and user 349 acceptance. 350

• The contractor shall be responsible for delivering regular performance reports that 351 analyze Key Performance Indicators (KPIs) tied to operational efficiency (e.g., 352 reduced patient documentation time, improved clinical workflow compliance) and 353 user sentiment. These reports will serve as the primary evidence of a successful 354 change initiative for the task order. 355

• The contractor shall design and conduct user satisfaction surveys and lead after-356 action reviews. The contractor shall then analyze the findings to produce detailed 357 reports with actionable recommendations and lessons learned to guide future 358 deployments and continuous improvement efforts. 359

3.6 Data Management and Migration 360

As part of the Deployment Approach (CDRL A003) and Implementation Plan (CDRL 361 A010), the contractor shall be responsible for the secure and accurate management, 362 migration, and validation of all clinical and administrative data as specified in the task 363 order. The outcome is that all necessary data is correctly and securely transferred to the 364 new product with its integrity intact, ensuring continuity of care. 365

3.6.1 Data Migration Execution 366

• For fixed facilities, execute the Extract, Transform, and Load (ETL) process, 367 potentially by replicating data to a parallel data center prior to a planned cutover. 368

• For field units, perform "Data Seeding" as a critical pre-deployment task. This 369 involves pre-loading the ship's or unit's local server with essential data such as 370 patient demographics, formularies, and clinical templates to enable autonomous 371 operation. 372

• Utilize secure data migration methods, such as encrypted transfer protocols or the 373 physical transport of encrypted backup media. 374

3.6.2 Data Validation and Reconciliation 375

The contractor shall complete data validation and reconciliation as designated in the task 376 order. 377

4. Period of Performance (PoP) 378

The PoP shall be for one (1) Base Year of 12 months and four (4) 12-month option years. 379

5. Transition Period 380

5.1 Transition-in Period 381

The Transition-in period is 30 days from task order award date. Transition-in 382 performance is defined as the period for the contractor to integrate and provide 383 onboarding activities. During the transition-in period, the contractor shall develop a 384 Transition-in Plan (CDRL A004) and a Staffing Plan (D003) to demonstrate how all 385 contract requirements will be met and ensure incoming personnel are functionally trained 386 and qualified on the full performance start date. Personnel shall be trained and qualified 387 within 30 days. 388

5.2 Transition-out Period 389

The contractor shall provide information and cooperation to affect an orderly and 390 efficient transition to a successor. The contractor shall develop a Transition-out Plan 391 (CDRL A005) supporting outgoing transition support and provide the plan 60 days prior 392 to the end of the contract or task order. Upon approval of the Transition Plan, the 393 contractor shall commence transition out activities working with the incoming contractor 394 or Government entity. Additionally, the contractor shall provide formal coordination with 395 Government staff and successor staff and management. The Transition Plan shall specify 396 a training program and a date for transferring responsibilities for each division of work 397 described in the plan, including the delivery of all final documentation. The contractor 398 shall provide an adequate number of experienced personnel during the phase-in, phase-399 out period to ensure that the services called for by this contract are maintained at the 400 required level of proficiency. The Transition Plan shall include, but is not limited to: 401

1. Coordination with Government representatives 402

2. Review, evaluation, and transition of current support services 403

3. Turn-in of all Government keys, ID/access cards, and security codes. The 404 contractor shall comply with transition-out requirements of the DHA for 405 contractors who have been issued a CAC or who generate “records”, as defined 406 by DoW (records manual), including DoW-directed disposition of records, and 407 others displayed on the In/Out (I/O) Processing Portal. 408

6. Place of Performance 409

Specific places of performance will be identified in individual Task Orders issued under 410 the contract. The contractor shall comply with host nation agreements for performance of 411 any work in OCONUS locations and as specified in individual Task Orders. 412

7. Hours of Operation 413

The contractor must maintain an adequate workforce for the uninterrupted performance 414 of all tasks to be defined within each task order. 415

8. Recognized Federal Holidays 416

Unless otherwise defined in the task order, contractors are not required to perform 417 services on the following holidays: 418

New Year’s Day 419

Martin Luther King Jr.’s Birthday 420

President’s Day 421

Memorial Day 422

Juneteenth Day 423

Independence Day 424

Labor Day 425

Columbus Day 426

Veteran’s Day 427

Thanksgiving Day 428

Christmas Day 429

9. Travel 430

Contractor travel requirements will be defined within each task order. 431

10. Other Direct Costs (ODC) 432

The contractor shall be authorized to bill ODCs as established within the task order. These costs 433 must be preapproved by the COR and include costs applied to the contract, except for the cost of 434 material or labor. The cumulative reimbursable ODC amount shall not exceed the relevant 435 Contract Line Item Number (CLIN) obligated amount. 436

11. Status of Forces Agreements (SOFA) 437

It is possible for some contract activity to occur at OCONUS locations. In the event such 438 support is required, if the country in which contractor support will occur has a SOFA 439 with the United States, it is critical for those designated for travel to receive authority to 440 operate as a contractor for the U.S. Military in those countries. The Government will 441 identify SOFA points of contact (POCs) for any OCONUS location where the contractor 442 will be required to travel. The contractor shall coordinate to understand fully and to 443 complete and submit necessary documents to the SOFA authority for each country where 444 such support is to be scheduled. The contractor shall perform this task not later than 90 445 calendar days prior to any scheduled travel. 446

12. Government Furnished Property (GFP), Equipment, and Services 447

The Requiring Activity Authority has assessed the need for Government Furnished Property, 448 Equipment, and Services and determined: 449

12.1 Services 450

In general, the Government will not provide Services unless specified in the task order. 451

12.2 Facilities 452

In general, the Government will not provide Facilities unless specified in the task order. 453

12.3 Materials 454

In general, the Government will not provide Materials unless specified in the task order. 455

12.4 Equipment 456

In general, the Government will not provide Equipment unless specified in the task order. 457

12.4.1 Procurement Integrated Enterprise Environment (PIEE), GFP Module 458 Application 459

The contractor shall be responsible for obtaining and maintaining access, training, and 460 successful operation of the PIEE/GFP Module application for the entirety of the task 461 order PoP. The PIEE GFP Module application is located at the following website: 462 https://wawf.eb.mil/piee-landing/. Access to PIEE/GFP Module application training 463 materials and in-depth information applicable to the contractor’s responsibilities 464 regarding GFP can be found at the following website: 465 https://dodprocurementtoolbox.com. 466 Contracting Office Responsibilities: 468

The Contracting Office shall ensure close coordination and validation of the GFP items 469 with the COR and DHA Accountable Property Officer prior to uploading the GFP 470 Attachment into the PIEE/GFP Module. At the time GFP is anticipated and identified, 471 the Government will upload the GFP Attachment into the PIEE/GFP Module. It is the 472 https://wawf.eb.mil/piee-landing/ https://dodprocurementtoolbox.com/

Contracting Office’s responsibility to prepare, upload, and maintain the GFP Attachment 473 in the PIEE/GFP Module in accordance with the GFP Attachment instructions provided 474 at the DoD Procurement Toolbox. The Contracting Officer and COR shall manage and 475 keep an inventory of any GFP associated with contract/task orders awarded through 476 DHA, in accordance with applicable FAR Part 45, Revolutionary FAR Overhaul (RFO) 477 Part 45, DoD FAR Supplement (DFARS) 245 with respective clauses, DHA 478 Administrative Instruction (AI) 094 and PD 45-01 following the change in disposition of 479 items listed on that PIEE/GFP Module Attachment. 480 The Contracting Office will also review, acknowledge, reject, and/or approve shipment 482 orders provided by the contractor as appropriate. Functional roles can be determined 483 within the Contracting Office and requested within the PIEE/GFP Module system. 484 Contractor Responsibilities: 486

A key contractor responsibility is to work with the Contracting Officer and COR to 487 ensure the PIEE/GFP Module data, to include the PIEE/GFP Attachment, provides a 488 timely, complete, and accurate accounting of the GFP applicable to the contract/task 489 order. Contractors are required to report the receipt of any GFP shipped to them, 490 regardless of whether it is listed on the GFP Attachment for their contract. Similarly, 491 contractors are required to utilize the GFP Module application in conjunction with the 492 shipment of GFP to the Government, or in reporting Property Loss of GFP issued (such 493 as destruction or loss). Discrepancies or disputes regarding property shipped to or 494 shipped from the contractor must be reported via the GFP Module application, with the 495 Contracting Officer having authority over final designation of status. 496

13. Contractor Furnished Items and Services 497

The contractor shall furnish all supplies, materials, equipment, facilities, and services required to 498 perform work listed in Section 3, Desired Outcomes/Tasks/Objectives of this PWS as specified in 499 the task order. 500

14. Manpower Reporting 501

Contractors shall report “contractor manpower” (including subcontractor manpower) via 502 the internet at www.sam.gov. The contractor shall report annually by October 31, for 503 services performed during the preceding Government fiscal year (October 1 – September 504 30), the amount invoiced for services, the number of hours of contract employees, and 505 any relevant subcontract numbers and hours. 506

15. Data Rights 507

In accordance with the Defense Federal Acquisition Regulation Supplement (DFARS) 508 clauses pertaining to data rights included in this contract (ref. DFARS RFO Class 509 Deviation 2026-O0036 Part 227.4), the Government shall have unlimited rights to all 510 data, documents, and materials produced or delivered in the performance of this contract. 511

These deliverables include, but are not limited to, all analyses, evaluations, models, 512 reports, documents, studies, computer programs, and services developed with 513 Government funding. 514

All materials developed and delivered under this contract are the sole property of the 515 Government. The Contractor shall not use, sell, or otherwise distribute these materials for 516 any purpose without the express written permission of the Contracting Officer. 517 Government ownership includes the right to copyright, patent, register, and transfer these 518 rights. This provision does not abrogate any other rights of the Government. 519

For any deliverables that contain or incorporate pre-existing materials not first produced 520 under this contract, the contractor shall grant the Government a nonexclusive, worldwide, 521 royalty-free, irrevocable license to use, reproduce, distribute, prepare derivative works, 522 publicly perform, and publicly display such materials. The contractor warrants that it 523 possesses all necessary intellectual property rights, permissions, and licenses to grant this 524 to the Government. 525

The contractor shall provide prompt written notification to the Contracting Officer of any 526 notice or claim of copyright or patent infringement received by the contractor with 527 respect to any materials delivered or used in the performance of this contract. 528

16. Information Technology and Security 529

Work under this contract may include classified work. Any additional security 530 requirements will be specified under individual task orders. 531

Unless specified in the task order, the Automated Data Processing/Information 532 Technology (ADP/IT) levels and position sensitivity designation for positions under this 533 contract is ADP/IT-II Level (Limited Privileged): Positions in which the contractor is 534 responsible for the direction, planning, design, operation, or maintenance of a computer 535 system, and whose work is technically reviewed at the IT-II Position level by a higher 536 authority to ensure the integrity of the system. Personnel whose duties meet the criteria 537 for an IT-II Position require a FAVORABLY ADJUDICATED TIER III (T3) 538 Background Investigation for Suitability Determination. ADP/IT-II Level positions will 539 not be granted eligibility for SECRET access. 540

16.1 Training 541

Contractor employees performing cybersecurity/cyberspace functions shall comply with 542 the following requirements: 543

Training: All contractor and associated subcontractor employees working Cybersecurity 544 Information Assurance (IA)/Cyberspace functions must comply with DoW training 545 requirements in Department of Defense Directive (DoDD) 8140.01 and DoD 8570.01-M. 546 Contractors shall identify, document, track, and report qualifications of contractor 547 support personnel who perform cyberspace roles. 548

Certification: The contractor shall ensure that personnel accessing Information Systems 549 (IS) have the proper and current IA certification to perform IA functions at task order 550 award in accordance with the most current version of DoD Manual (DoDM) 8140.03, 551

“Cyberspace Workforce Qualification and Management Program.” The contractor shall 552 meet the applicable IA certification requirements as outlined in DFARS 252.239-2001, 553 including: 554

• DoW-approved IA workforce certifications appropriate for each category and 555 level as listed in the current version of DoDM 8140.03, “Cyberspace Workforce 556 Qualification and Management Program.” 557

• Appropriate operating system and/or product certification for IA technical 558 positions as required by the most current version of DoDM 8140.03, “Cyberspace 559 Workforce Qualification and Management Program.” 560

Upon request by the Government, the contractor shall provide documentation supporting 561 the IA certification status of personnel performing IA functions. 562

Contractor personnel who do not have proper and current certifications shall be denied 563 access to DoW IS for the purpose of performing IA functions. 564

16.2 Access to Defense Health Agency (DHA) IT 565

All contractor employees that require access to DHA IT must comply with the 566 requirements of DHA-Procedural Instruction 8140.01, Acceptable Use of DHA IT, to 567 include those contract employees with privileged access. 568

16.3 System Authorization Access Request (SAAR), Defense Department (DD) 569 Form 2875 570

The contractor shall submit the most current version of DD Form 2875, “System 571 Authorization Access Request (SAAR), in accordance with the Contracting Officer 572 guidance for all contractors that use the DoW Gateways to access Government IT 573 systems and/or DoW applications. DD Form 2875 shall clearly specify the system and/or 574 application name and justification for access to that system, and/or application. 575

The contractor shall submit the completed DD Form 2875 to DHA IT Security for 576 verification of Tier I or Tier II Designation. The DHA Personnel Security will verify that 577 the contractor employee has completed the appropriate background investigation or a 578 request for background investigation has been submitted to the Office of Personnel 579 Management (OPM). Acknowledgement from OPM that the request for a background 580 investigation has been received and that an investigation has been scheduled will be 581 verified by the DHA Personnel Security prior to access being approved. 582

Upon approval, DHA will notify the user of the ID and password via secure/encrypted e-583 mail upon the establishment of a user account. User accounts will be established for 584 individual use and may not be shared by multiple users or for system generated access to 585 any DoW application. Misuse of user accounts by individuals or contractor entities will 586 result in termination of system access for the individual user account. 587

The contractor shall conduct a monthly review of all contractor employees who have 588 been granted access to DoW IS’/networks to verify that continued access is required. 589

The contractor shall provide the DHA Privacy and Civil Liberties Office (DPCLO) with a 590 report of the findings of their review by the 10th day of each month following the review. 591

Reports identifying changes to contractor employee access requirements shall include the 592 name, DoW ID number from CAC, Company, IS/network for which access is no longer 593 required and the date access will be terminated. 594

16.4 Cybersecurity Requirements for Non-DoW IT or Covered Contractor 595 Information Systems (IS) 596

The contractor shall, at time of award, have implemented the security requirements 597 prescribed in the National Institute of Standards and Technology (NIST) Special 598 Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal 599 Information Systems and Organizations” (available via the internet at 600 http://dx.doi.org/10.6028/NIST.SP.800-171), in accordance with DFARS clause 252.204-601 7012. 602

NIST SP 800-171 DoD Assessment Methodology. The DFARS provision 252.204-7019 603 introduces the “NIST SP 800-171 DoD Assessment Methodology” requirement. This 604 requirement enables a strategic assessment of a contractor’s implementation of the NIST 605 SP 800-171 requirements as required in DFARS clause 252.204-7012. The DoD 606 Assessment Methodology requirement flows down to subcontractors. The contractor shall 607 consider the recommendations for enhanced security requirements prescribed in the NIST 608 SP 800-172, “Enhanced Security Requirements for Protecting Controlled Unclassified 609 Information” (available via the internet at https://doi.org/10.6028/NIST.SP.800-172). 610

Basic Assessment. 611

The contractor shall perform a Basic Assessment, using the NIST SP 800-171 DoD 612 Assessment Scoring Template, and provide the results for each covered contractor 613 information system that is relevant to an offer, call, contract, task order, or delivery order. 614

The contractor shall ensure that applicable subcontractors also have their results of a 615 current assessment posted in the designated government system prior to awarding a 616 subcontract or other contractual instrument in accordance with DFARS clause 252.204-617 7020. 618

The contractor shall provide the Government with access to its facilities, systems, and 619 personnel when necessary to conduct or renew a higher-level (i.e., Medium or High) 620 assessment in accordance with DFARS clause 252.204-7020. 621

Cybersecurity Maturity Model Certification. The CMMC (DFARS clause 252.204-7021) 622 builds upon the NIST SP 800-171 DoD Assessment Methodology by adding a 623 comprehensive and scalable certification element to verify the implementation of 624 processes and practices associated with the achievement of a cybersecurity maturity level. 625 The CMMC is designed to increase assurance to the DoW that federal contract 626 information (FCI) and DoW CUI is protected at a level commensurate with the risk. The 627 CMMC requirement flows down to subcontractors. 628

The contractor shall align with the most current CMMC program milestones and prepare 629 to attain an accredited CMMC Third Party Assessment Organization (3PAO) at the 630 required CMMC level. Once CMMC 2.0 is fully implemented, DoW will only accept 631 CMMC assessments provided by the Government or an authorized and accredited 632 C3PAO or certified CMMC Assessor. In the final phases of the transition to CMMC 2.0 633 assessments will be retroactive, and contractors will need to demonstrate compliance. 634 Additional information on CMMC is available at https://dodcio.defense.gov/CMMC and 635 https://www.cyberab.org/. 636

The contractor shall submit requests to vary from NIST SP 800-171 in writing to the 637 Contracting Officer or COR, for consideration by the DoW Chief Information Officer 638 (CIO). The contractor need not implement any security requirement adjudicated by an 639 authorized representative of the DoW CIO to be non-applicable or to have an alternative, 640 but equally effective, security measure that may be implemented in its place. 641

If the DoW CIO has previously adjudicated the contractor’s requests indicating that a 642 requirement is not applicable or that an alternative security measure is equally effective, a 643 copy of that approval shall be provided to the Contracting Officer or COR when 644 requesting its recognition under task orders issued under this contract. 645

16.4.1 Cloud Computing 646

If the contractor intends to use an external cloud service provider, on their behalf, to 647 store, process, or transmit any DoW CUI in performance of task orders under this 648 contract, the contractor shall require the cloud service provider meets security 649 requirements equivalent to those established by the Government for the Federal Risk and 650 Authorization Management Program (FedRAMP) Moderate baseline 651 (https://www.fedramp.gov/) and that the cloud service provider complies with 652 requirements outlined below for cyber incident reporting, malicious software, media 653 preservation and protection, access to additional information and equipment necessary for 654 forensic analysis, and cyber incident damage assessment. 655

If the information is DoW CUI-specific (e.g., PII/PHI), then the Contractor shall ensure 656 the external cloud service provider meets security requirements equivalent to FedRAMP 657 High baseline. 658

16.4.2 Cyber Incident Reporting Requirement 659

When the contractor discovers a cyber incident that affects a covered contractor 660 information system or the covered defense information residing therein, or that affects the 661 contractor’s ability to perform the requirements of any task orders under this contract that 662 are designated as operationally-critical support and identified in the task order, the 663 contractor shall: 664

• Conduct a review for evidence of compromise of covered defense information, 665 including, but not limited to, identifying compromised computers, servers, 666 specific data, and user accounts. This review shall also include analyzing covered 667 contractor information system(s) that were part of the cyber incident, as well as 668 other IS on the contractor’s network(s), that may have been accessed as a result of 669 the incident in order to identify compromised covered defense information, or that 670 affect the contractor’s ability to provide operationally critical support; and 671

• In accordance with DFARS clause 252.204-7012, rapidly report (within 72 hours) 672 cyber incidents involving DoW CUI to DoD Cyber Crime Center (DC3) via 673 https://dibnet.dod.mil. In the event of a cybersecurity incident involving a CUI-674 Specific breach (i.e., PII/PHI), the contractor, in addition to reporting to the DC3, 675 shall follow the incident reporting guidance prescribed in the TRICARE 676 Operations Manual, Chapter 1, Section 5, “Compliance with Federal Statutes” at 677 https://manuals.health.mil/ 678

The cyber incident report shall be treated as information created by or for DoW and shall 679 include, at a…