EUS AWACS AOI 1 Appendix B.pdf

End User Services (EUS): Application Workflow Adoption Change Support (AWACS) Area of Interest (AoI) #1 Appendix B

1. CONTRACT REQUIREMENTS

1.1 Place of Performance

Virtual work is strongly encouraged; fixed Government facilities may not be available for day-to-day or collaboration work, and fixed or dedicated contractor facilities for day-to-day work are not required, but the contractor may provide physical collaboration space from time-to-time for shared contractor/Government use.

1.2 Travel

The Government strongly encourages virtual work. If travel is required and agreed upon, the cost for travel is incorporated into the fixed price. No additional funding will be provided for travel.

1.3 Recognized Federal Holidays

Unless otherwise defined in the contract, contractors are not required to perform services on the following holidays:

• New Year’s Day

• Martin Luther King Jr.’s Birthday

• President’s Day

• Memorial Day

• Juneteenth Day

• Independence Day

• Labor Day

• Columbus Day

• Veteran’s Day

• Thanksgiving Day

• Christmas Day

1.4 Hours of Operation

The contractor must maintain an adequate workforce for the uninterrupted performance of all tasks defined within the contract (e.g., business hours support for a global operating healthcare system, including weekends)

1.5 Key Personnel

The contractor shall provide a list of two points of contact that delineate responsibility by function and assure that this staff is available during the Government’s normal working hours and within 1-hour after hours or on holidays.

1.6 Personal Conduct

Contractors shall adhere to the same or better standards of conduct required of government employees per direction of the DHA.

1.7 Other Direct Costs (ODC)

If ODCs are required and agreed upon, the cost for ODCs will be incorporated into the fixed price. No additional funding will be provided for ODCs.

1.8 Status of Forces Agreements (SOFA)

It is possible for some contract activity to occur at OCONUS locations. In the event such support is required, if the country in which contractor support will occur has a SOFA with the United States, it is critical for those designated for travel to receive authority to operate as a contractor for the U.S. Military in those countries. The Government will identify SOFA points of contact (POCs) for any OCONUS location where the contractor will be required to travel. The contractor shall coordinate to understand fully and to complete and submit necessary documents to the SOFA authority for each country where such support is to be scheduled. The contractor shall perform this task not later than 90 calendar days prior to any scheduled travel.

1.9 Government Furnished Property (GFP), Equipment, and Services The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services. In general, the Government will not furnish property, equipment, services, or materials unless specified in the contract. The contractor shall furnish all supplies, materials, equipment, facilities, and services required to meet the outcomes in Section 3.

Procurement Integrated Enterprise Environment (PIEE), GFP Module Application:

The contractor shall be responsible for obtaining and maintaining access, training, and successful operation of the PIEE/GFP Module application for the entirety of the contract PoP. The PIEE GFP Module application is located at the following website:

https://wawf.eb.mil/piee-landing/. Access to PIEE/GFP Module application training materials and in-depth information applicable to the contractor’s responsibilities regarding GFP can be found at the following website:

https://dodprocurementtoolbox.com/.

https://wawf.eb.mil/piee-landing/ https://dodprocurementtoolbox.com/

Contracting Office Responsibilities: The Contracting Office shall ensure close coordination and validation of the GFP items with the COR and DHA Accountable Property Officer prior to uploading the GFP Attachment into the PIEE/GFP Module. At the time GFP is anticipated and identified, the Government will upload the GFP Attachment into the PIEE/GFP Module. It is the Contracting Office’s responsibility to prepare, upload, and maintain the GFP Attachment in the PIEE/GFP Module in accordance with the GFP Attachment instructions provided at the DoD Procurement Toolbox. The Contracting Officer and COR shall manage and keep an inventory of any GFP associated with the contract awarded through DHA, in accordance with applicable Federal Acquisition Regulation (FAR) Part 45, Revolutionary FAR Overhaul (RFO) Part 45, DoD FAR Supplement (DFARS) 245 with respective clauses, DHA Administrative Instruction (AI) 094 and PD 45-01 following the change in disposition of items listed on that PIEE/GFP Module Attachment. The Contracting Office will also review, acknowledge, reject, and/or approve shipment orders provided by the contractor as appropriate. Functional roles can be determined within the Contracting Office and requested within the PIEE/GFP Module system.

Contractor Responsibilities: A key contractor responsibility is to work with the Contracting Officer and COR to ensure the PIEE/GFP Module data, to include the PIEE/GFP Attachment, provides a timely, complete, and accurate accounting of the GFP applicable to the contract. Contractors are required to report the receipt of any GFP shipped to them, regardless of whether it is listed on the GFP Attachment for their contract. Similarly, contractors are required to utilize the GFP Module application in conjunction with the shipment of GFP to the Government, or in reporting Property Loss of GFP issued (such as destruction or loss). Discrepancies or disputes regarding property shipped to or shipped from the contractor must be reported via the GFP Module application, with the Contracting Officer having authority over final designation of status.

The Contractor shall report semi-annually 100% inventories, reconciliations, and final dispositions of GFP provided by the Government. Final invoices pending GFP reconciliation will not be paid until reconciliation is complete. Contractors shall be aware of and ensure compliance with applicable FAR Part 45, DFARS 245, and 252.245, Defense Pricing and Contracting Policies, Procurement Integrated Enterprise Environment Standards, DHA AI 094, and DHA Guidance.

1.10 Manpower Reporting

Contractors shall report “contractor manpower” (including subcontractor manpower) via the internet at www.sam.gov. The contractor shall report annually by October 31, for services performed during the preceding Government fiscal year (October 1 – September 30), the amount invoiced for services, the number of hours of contract employees, and any relevant subcontract numbers and hours.

http://www.sam.gov/

1.11 Information Technology and Security

Work under this contract may include classified work. Any additional security requirements will be specified in the contract. Unless specified otherwise, the Automated Data Processing/Information Technology (ADP/IT) levels and position sensitivity designation for positions under this contract is ADP/IT-II Level (Limited Privileged):

Positions in which the contractor is responsible for the direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed at the IT-II Position level by a higher authority to ensure the integrity of the system.

Personnel whose duties meet the criteria for an IT-II Position require a FAVORABLY ADJUDICATED TIER III (T3) Background Investigation for Suitability Determination.

ADP/IT-II Level positions will not be granted eligibility for SECRET access.

Training:

Contractor employees performing cybersecurity/cyberspace functions shall comply with the following requirements:

• All contractor and associated subcontractor employees working Cybersecurity Information Assurance (IA)/Cyberspace functions must comply with DoW training requirements in Department of Defense Directive (DoDD) 8140.01 and DoD Manual (DoDM) 8140.03. Contractors shall identify, document, track, and report qualifications of contractor support personnel who perform cyberspace roles.

Certification:

The contractor shall ensure that personnel accessing Information Systems (IS) have the proper and current IA certification to perform IA functions at contract award in accordance with the most current version of DoDM 8140.03, “Cyberspace Workforce Qualification and Management Program.” The contractor shall meet the applicable IA certification requirements as outlined in DFARS 252.239-7001, including:

• DoW-approved IA workforce certifications appropriate for each category and level as listed in the current version of DoDM 8140.03, “Cyberspace Workforce Qualification and Management Program.”

• Appropriate operating system and/or product certification for IA technical positions as required by the most current version of DoDM 8140.03.

Upon request by the Government, the contractor shall provide documentation supporting the IA certification status of personnel performing IA functions.

Contractor personnel who do not have proper and current certifications shall be denied access to DoW IS for the purpose of performing IA functions.

Access to Defense Health Agency (DHA) IT:

All contractor employees that require access to DHA IT must comply with the requirements of DHA-Procedural Instruction 8140.01, Acceptable Use of DHA IT, to include those contract employees with privileged access.

System Authorization Access Request (SAAR), Defense Department (DD) Form 2875:

The contractor shall submit the most current version of DD Form 2875, “System Authorization Access Request (SAAR), in accordance with the Contracting Officer guidance for all contractors that use the DoW Gateways to access Government IT systems and/or DoW applications. DD Form 2875 shall clearly specify the system and/or application name and justification for access to that system and/or application. The contractor shall submit the completed DD Form 2875 to DHA IT Security for verification of Tier I or Tier II Designation. The DHA Personnel Security will verify that the contractor employee has completed the appropriate background investigation or a request for background investigation has been submitted to the Office of Personnel Management (OPM). Acknowledgement from OPM that the request for a background investigation has been received and that an investigation has been scheduled will be verified by the DHA Personnel Security prior to access being approved. Upon approval, DHA will notify the user of the ID and password via secure/encrypted email upon the establishment of a user account. User accounts will be established for individual use and may not be shared by multiple users or for system generated access to any DoW application. Misuse of user accounts by individuals or contractor entities will result in termination of system access for the individual user account. The contractor shall conduct a monthly review of all contractor employees who have been granted access to DoW Information Systems/networks to verify that continued access is required. The contractor shall provide the DHA Privacy and Civil Liberties Office (DPCLO) with a report of the findings of their review by the 10th day of each month following the review. Reports identifying changes to contractor employee access requirements shall include the name, DoW ID number from CAC, Company, IS/network for which access is no longer required and the date access will be terminated.

1.12 Cybersecurity Requirements for Non-DoW IT or Covered

Contractor Information Systems (IS) The contractor shall, at time of award, have implemented the security requirements prescribed in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (available via the internet at http://dx.doi.org/10.6028/NIST.SP.800-171), in accordance with DFARS clause 252.204- 7012.

NIST SP 800-171 DoD Assessment Methodology: The DFARS RFO clause 252. 240- 7997 introduces the “NIST SP 800-171 DoD Assessment Methodology” requirement.

http://dx.doi.org/10.6028/NIST.SP.800-171

This requirement enables a strategic assessment of a contractor’s implementation of the NIST SP 800-171 requirements as required in DFARS clause 252.204-7012. The DoD Assessment Methodology requirement flows down to subcontractors. The contractor shall consider the recommendations for enhanced security requirements prescribed in the NIST SP 800-172, “Enhanced Security Requirements for Protecting Controlled Unclassified Information”.

Basic Assessment: The contractor shall perform a Basic Assessment, using the NIST SP 800-171 DoD Assessment Scoring Template, and provide the results for each covered contractor information system that is relevant to the contract. The contractor shall ensure that applicable subcontractors also have their results of a current assessment posted in the designated government system prior to awarding a subcontract or other contractual instrument in accordance with DFARS clause 252.240-7991. The contractor shall provide the Government with access to its facilities, systems, and personnel when necessary to conduct or renew a higher-level (i.e., Medium or High) assessment in accordance with DFARS clause 252.240-7991.

Cybersecurity Maturity Model Certification: The contractor shall comply with DFARS RFO Class Deviation 240.371 Cybersecurity Maturity Model Certification. The CMMC (DFARS clause 252.204-7021) builds upon the NIST SP 800-171 DoD Assessment Methodology by adding a comprehensive and scalable certification element.

The CMMC requirement flows down to subcontractors. The contractor shall align with the most current CMMC program milestones and prepare to attain an accredited CMMC Third Party Assessment Organization (3PAO) at CMMC Level 2. Once CMMC 2.0 is fully implemented, DoW will only accept CMMC assessments provided by the Government or an authorized and accredited C3PAO or certified CMMC Assessor.

The contractor shall submit requests to vary from NIST SP 800-171 in writing to the Contracting Officer or COR, for consideration by the DoW Chief Information Officer

(CIO).

1.13 Cloud Computing

If the contractor intends to use an external cloud service provider, on their behalf, to store, process, or transmit any DoW CUI in performance of this contract, the contractor shall require the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/) and that the cloud service provider complies with requirements outlined below for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment. If the information is DoW CUI-specific (e.g., PII/PHI), then the contractor shall ensure the https://www.fedramp.gov/ external cloud service provider meets security requirements equivalent to FedRAMP High baseline.

1.14 Cyber Incident Reporting Requirement

When the contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor’s ability to perform the requirements of this contract that are designated as operationally-critical support, the contractor shall:

• Conduct a review for evidence of compromise of covered defense information, including identifying compromised computers, servers, specific data, and user accounts.

• In accordance with DFARS clause 252.204-7012, rapidly report (within 72 hours) cyber incidents involving DoW CUI to DoD Cyber Crime Center (DC3) via https://dibnet.dod.mil. In the event of a cybersecurity incident involving a CUI Specific breach (i.e., PII/PHI), the contractor, in addition to reporting to the DC3, shall follow the incident reporting guidance prescribed in the TRICARE Operations Manual, Chapter 1, Section 5, “Compliance with Federal Statutes” at https://manuals.health.mil/.

The cyber incident report shall be treated as information created by or for DoW.

Malicious Software: When the contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to DC3 in accordance with instructions provided by DC3 or the Contracting Officer.

Media Preservation and Protection: When a contractor discovers a cyber incident has occurred, the contractor shall preserve and protect images of all known affected IS and all relevant monitoring/packet capture data for at least 90 days.

Access to Additional Information: Upon request by DoW, the contractor shall provide DoW with access to additional information or equipment that is necessary to conduct a forensic analysis.

1.15 Maintenance of Government Data & Supply Chain Risk

The contractor shall maintain within the United States (US) or US territories all Government data that is not physically located on DoW premises, unless the contractor receives written notification from the Contracting Officer to use another location, in accordance with DFARS RFO Class Deviation 2026-O0024 239.7602-2(a).

The contractor shall mitigate sutrpply chain risk to the Government by complying with DFARS 252.239-7018 and only utilizing unified capability equipment identified on the https://dibnet.dod.mil/ https://manuals.health.mil/

Department of Defense Information Network (DoDIN) Unified Capabilities Approved Products List.

1.16 Risk Management Framework (RMF) for DoW IT

The contractor shall comply with any implemented security controls for the product being deployed. All IS, Platform Information Technology (PIT) and IT Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with DoDI 8510.01, RMF for DoD Systems and comply with annual Federal Information Security Modernization Act (FISMA) security control testing.

Systems and/or product(s) must have and maintain Authority to Operate (ATO) or ATO with Conditions (ATO-C) by contract award. The contractor shall implement security controls in accordance with NIST implementation and validation requirements specified in the NIST SP 800-37 RMF and DoDI 8510.01, RMF. The contractor shall configure the information system in accordance with Defense Information Agency (DISA) Security Requirements Guides (SRGs) and Security Technical Implementation Guides (STIGs).

1.17 Physical Security & Security Management

Contractors shall safeguard all Government equipment, information, and property provided by the Government for their use. The contractor shall designate a Security POC to support the onboarding of contractor personnel under this contract. This Security Officer will be responsible for coordinating with the COR to complete the required personnel security clearances and onboarding, training, and CAC requirements.

1.18 Personnel Security Requirements

This clause establishes requirements and processes for the Personnel Security Screenings for DHA contractor personnel and any subcontractors in performance of this contract, in accordance with DoW and federal regulations.

• Background Investigations: Prior to starting work, all contractor personnel shall complete the required security background investigation to obtain the minimum required clearance for this contract.

• Minimum Background Investigation: Unless otherwise specified, all personnel performing duties on this contract must undergo and maintain a favorably adjudicated Tier 1 or Tier 3 background investigation, or an equivalent or higher-level investigation that meets the requirements of the position or role on this contract.

• Background Investigation (Secret): As specified in the contract, if the work is classified, some personnel performing duties on this contract must have been subject to, at a minimum, a Tier 3, or equivalent background investigation.

• Controlled Unclassified Information (CUI): Controlled Unclassified Information under this contract shall be safeguarded as specified in DoDI 5200.48 Controlled Unclassified Information (CUI). Prior to accessing CUI, all personnel must have completed a Personnel Security screening and received, at a minimum, a favorable HSPD-12 interim determination.

CUI Protection, Handling, and Marking Requirements:

• Handling: Access to CUI material shall be limited to those employees needing the material to perform their duties.

• Marking: All CUI shall be marked in accordance with DoDI 5200.48 and 32 CFR Part 2002.

• Storage: During normal duty hours, steps will be taken to minimize the risk of access by unauthorized personnel. After normal duty hours, CUI information will be stored in unlocked containers, desks, or cabinets if the government or government-contract building provides security for continuous monitoring of access.

• Transmission: CUI information and material may be transmitted via first class mail, parcel post, or bulk shipments.

• Destruction: When the CUI material no longer meets the threshold for safeguarding and dissemination, it shall be immediately decontrolled, be processed through the records management process, and destroyed by the approved methods.

1.19 Common Access Card (CAC) Issuance

All contractors working onsite in Government facilities or requiring system access for a Government accredited system is required to have a CAC. As required, each contractor employee shall provide the Government all information required by the DHA CAC request process.

1.20 Contractor Personnel (Onboarding, NDAs, OCI)

• Onboarding & Training: The contractor shall ensure that all staff assigned to, including all subcontractors, consultants, or other personnel performing on the contract complete all required training and provide Staff Training Certificates (D004) of completion to the COR.

• Contractor Identification: All contractor employees are required to identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel and displaying distinguishing badges.

• Non-Disclosure Agreement (NDA): All contractor personnel who will obtain access to proprietary, classified, or confidential information shall be required to complete and sign a DHA contractor NDA, DHA Form 49 (D005) prior to beginning work on the contract.

• Organizational Conflict of Interest (OCI): The contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI.

1.21 Privacy, Data Rights, and Federal Information Laws

The contractor shall comply with The Privacy Act of 1974, The Freedom of Information Act (FOIA), and The Health Insurance Portability and Accountability Act (HIPAA) as set forth in applicable statutes, implementing regulations and DoW issuances.

Records Management: When creating and maintaining official government records, the contractor shall comply with all federal requirements established by 44 U.S.C. Chapters 21, 29, 31, 33 and 35.

FOIA: The contractor shall comply with the established procedures if it receives a FOIA request and immediately contact the DHA FOIA Officer for evaluation/action.

Data Sharing Agreements (DSA): The contractor shall consult with the DHA Privacy Office to determine if the contractor must obtain a DSA or Data Use Agreement (DUA) when DHA data will be accessed, used, disclosed, or stored, to perform the requirements of this contract.

Privacy Act of HIPAA Training: The contractor shall ensure that its entire staff receives training on the Privacy Act, HIPAA, and the federal regulations on confidentiality of substance use disorder patient records, 42 CFR Part 2.

HIPAA Business Associate General Provisions: The contractor meets the definition of Business Associate, and DHA meets the definition of a covered entity under the HIPAA Rules. Therefore, a Business Associate Agreement (BAA) between the contractor and DHA is required.

Breach Response: Immediately upon discovery of a possible or confirmed breach or cybersecurity incident, the contractor shall initiate an investigation. If the incident involves electronic PII/PHI, and if the investigation finds a confirmed breach or cybersecurity incident, the contractor shall report it, within 1 hour of confirmation, to the US-CERT Incident Reporting System. In addition to US-CERT reporting, the contractor shall report to the DHA Privacy Office by submitting the required form within 24 hours of discovery of a breach.

Data Rights: In accordance with the DFARS clauses pertaining to data rights included in this contract (ref. DFARS RFO Class Deviation 2026-O0036 Part 221.4), the Government shall have unlimited rights to all data, documents, and materials produced or delivered in the performance of this contract. These deliverables include, but are not limited to, all analyses, evaluations, models, reports, documents, studies, computer programs, and services developed with Government funding.

1.22 Reporting Requirements

Cost and Software Data Reporting (CSDR):

The contractor shall comply with the Cost and Software Data Reporting (CSDR) guidance in accordance with the CSDR Plan (DD Form 2794) and DoD 5000.04-M-1, Cost and Software Data Reporting Manual. The contractor shall:

• Conduct a Cost and Software Data Reporting Kickoff Meeting within 30 days after contract award.

• Conduct a Cost and Software Data Reporting Readiness Review Meeting within 90 days after contract award.

• Incorporate subcontractor CSDR data in its CSDR submission.

• Provide a Cost and Hour Report (Flexfile) (CDRL TBD) and a Technical Data Report

(TDR) (CDRL TBD).

• Provide and maintain the Contractor Work Breakdown Structure (CWBS) and CWBS

Dictionary (CDRL TBD).

(Note: CSDR applies when the contract exceeds the $50M threshold.)