02 Attch 1 PWS Strategic Advisors Bridge 2_Final.docx

Department of Defense Defense Health Agency Performance Work Statement

Strategic Contracting Advisory and Training Services

PEO Medical Systems/CIO J-6

IT Business Strategy and Rationalization (ITBSR) Branch Enterprise Information Technology Services (EITS) Program Office

Solicitation Number: HT001123R0011 Version: 1.0 Date: 9 January 2023

Summary of Changes

Table of Contents

PART 1

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide to provide strategic advisory and training services across the Defense Health Agency for the PEO Medical System/CIO J-6. PEO MEDICAL SYSTEM/CIO J-6 must reduce information technology (IT) spending over the next five years. The majority of these reductions will be realized by implementing new acquisition and contracting strategies for current and future IT contracts. Current IT acquisition and contracting approaches are not strategic in nature, stovepiped to individual organizations, and suboptimal in meeting reform goals. PEO Medical System/CIO J-6 requires consulting expertise from personnel highly experienced in new Department of Defense (DoD) acquisition and contracting processes emerging from the Section 809 panel findings (https://section809panel.org/) to develop new acquisition strategies and contracting approaches. PEO Medical System/CIO J-6 requires acquisition innovation and thought leadership based on participation in and/or knowledge of recent DoD acquisition reform, streamlining, and improvement initiatives and associated legislation.

1.2 Description of services/introduction: The contractor shall facilitate development of new organizational section (Information Technology Business Strategy and Rationalization [ITBSR] Branch) within the PEO Medical System/CIO J-6 to foster strategic contract development.

1.3 Background: The DHA operates under the policy guidance and directorate of the Office of the Assistant Secretary of Defense (Health Affairs) (OASD (HA)). The PEO Medical System/CIO J-6 is a principal advisor to the ASD (HA), the Principal Deputy Assistant Secretary of Defense (Health Affairs) (PDASD (HA)), and the DHA Director on all matters pertaining to MHS information technology (IT), to include strategic planning; IT capital planning and investment processes; linking performance measures to MHS and DHA priorities and goals; emerging IT, data standardization, cyber security; establishing appropriate external coalitions and communications related to IT; Clinger-Cohen/FITARA compliance, and guiding the IT integration and standardization across the MHS.

The NDAA 2017 (National Defense Authorization Act for Fiscal Year 2017) directed DHA to assume Authority, Direction, and Control of the Military Treatment Facilities (MTFs). In an effort to provide continuity of operations and creating efficiencies, the DADIO requires strategic guidance in acquisitions to assume control of the MTFs’ IT infrastructure, personnel, and contracts.

In support of the PEO Medical System/CIO J-6 are 5 Divisions; PRMD (Portfolio & Resource Management), AACE (Architecture, Advanced Concepts, & Engineering), I&O (Infrastructure & Operations), CSD (Cyber Security), and SDD (Solutions Delivery Division).

The PRMD Division is comprised of five (5) branches: IT Business Strategy and Rationalization (ITBSR) Branch, Infrastructure and Service Resource Management Branch (ISRMB), Solutions Delivery Resource Management Branch (SDRMB), Budget Execution Branch (BE), Investment Management Branch and Business Execution Branch.

This contract will support all of PEO Medical System/CIO J-6 efforts across the MHS and be managed by the ITBSR Branch of PRMD.

This branch is responsible for:

· Providing guidance and direction to staff across the entire MHS to accomplish Information Technology implementation at all Military Treatment Facilities (MTF's)

· Providing management, supervision, technical direction and coordination of acquisition actions, reporting, and analytical activities

· Reviews and recommends acquisition policies related to J6 for PEO Medical System/CIO J-6 approval

· Coordinates acquisition activities for the PEO Medical System/CIO J-6 program offices and divisions

· Liaison acquisition activities with external/internal entities for PEO Medical System/CIO J-6

· Craft acquisition policies related to J6 for PEO Medical System/CIO J-6 approval

· Managing Procurement System Administration

· Procurement Liaison

· Status of Acquisition and Completed Procurement Packages

· Review and Report on J6 Contracts

· Processing and tracking payments

· Review and report on invoice payments

· Overseeing Contract Administration

· Contracting Officer Representative (COR) for contracts valued >$100M and/or those special interest contracts as determined by PEO Medical System/CIO J-6 CIO

· Contractor Performance Assessment Reports Updates

· Contractor Status Report

· Providing Acquisition and Contracting Officer Representative Support for contracts valued at <$100M

· Monitoring Government Purchase Card Operations

· Perform rationalizations efforts on J6 contracts

· Review contract requirements for potential reuse of existing enterprise agreements or create enterprise agreements as needed

· Identify contracts for potential rationalization across directorate

· Review and ensure new, recompete, modify contract packages (PWS, Acq Strategy, etc.) meet PEO Medical System/CIO J-6 standards

· Gatekeeper for the DHA Service Contract Approval Request (D-SCAR) process

· Provide shared acquisition services to J6 Divisions and Branches

1.4 Objectives: The end-state goal is to improve the quality of IT Business Strategy and Rationalization (ITBSR) Branch, Enterprise Information Technology Services (EITS) Program Office products in support of strategic initiatives. Additionally, the Contractor(s) shall provide consultation of preferred acquisition strategy to manage the acquisition lifecycle from initiation to closeout. This shall include support for contract administration, development and execution. This support further includes preparation and maintenance of the contract file and participation in Integrated Product Teams (IPT). The Contractor shall analyze and measure the probable effects of various acquisition strategies, and make recommendations on acquisition strategies to ITBSR/EITS Program Office.

1.5 Scope: Strategic Advisors typically perform the following kinds of functions: consults with client to define need or problem; initiates, supervises, and/or develops concepts and strategies for complex programs; provides strategic advice, guidance, and expertise to program and project staff; provides detailed analysis, evaluation, and recommendations for improvements for mission critical challenges/issues; supervises studies and leads surveys to collect and analyze data to provide advice and recommend solutions.

1.6 Period of Performance (PoP): Six (6) month Bridge with the option to extend services up to an additional six (6) months.

1.7 Administrative specifications

1.7.1 Place of performance: The work shall be performed at the contractors facility within the Falls Church, VA Area. The Contractor shall perform site visits to San Antonio, TX and those locations deemed necessary by the government. The address for Defense Health Headquarter (DHHQ) is located at 7700 Arlington Blvd, Falls Church, VA. The Government will provide access to Government controlled facilities and equipment, as required. The Contractor will be provided keys or codes for access to the Government facility. These keys and codes shall be controlled, tracked, and protected. Upon termination of the period of performance, all keys and/or access badges to the Government facility shall be turned in to the COR.

1.7.2 Recognized Federal holidays: The contractor is not required to perform services on Federal holidays.

Independence Day

1.7.3 Hours of operation: The contractor is responsible for conducting business Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. Core Hours are 7:00 a.m. to 4:00 p.m.

1.7.4 Emergency Services: On occasion, services may be required to support an activation or exercise of contingency plans outside the normal duty hours.

1.7.5 Organizational Conflict of Interest (OCI): Because the work under this contract involves supporting the DHA in planning, programming, budgeting, and executing (PPBE) Information Technology (IT) finances as well as strategically aligning and rationalizing PEO Medical System/CIO J-6 IT acquisition support functions and services across the Military Health System (MHS) and managing the MHS IT portfolio, the contract holder will have broad‐based access to competitively useful information, will be in a position to influence the development of MHS IT requirements, and regularly will be called upon to provide the government with objective recommendations and advice.

As such, the contracting officer has determined that the work performed under the contract will give rise to OCI for the contract holder and any of its owners, partners, subsidiaries, affiliates, team members, and subcontractors both during performance and in relation to potential future Government contracts, particularly the PEO Medical System/CIO J-6 contracts.

Therefore, the Contract holder and any of its owners, partners, subsidiaries, affiliates, team members, and subcontractors shall be ineligible to perform as a contractor, subcontractor, or team member on any of PEO Medical Systems/CIO J-6 contracts associated with the EITSI, GSP, and CSP associated contracts for the duration of the contract and for 18 months after the final day of performance under the contract.

1.8 Contractor travel: Reserved.

1.9 Other Direct Costs (ODC): Reserved

1.10 Quality

1.10.1 Quality Control (QC): Reserved.

1.10.2 Quality assurance (QA): The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.11 Contractor personnel

1.11.1 CAC requirements: For all contractors who will work in Government facilities, the Facilities Security Officer (FSO)/Company's Security point of contact (POC) will provide the Government all the required information per the DHA CAC request process current version 2.1, January 2018, or more recent when updated. See process attached at Part 7 Section 7.1.1 of the PWS. A CAC is the standard identification for eligible DoD contractor personnel.

1.11.1.1 The contractor shall return all CACs to the COR upon the departure of the contractor(s).

1.11.2 Contractor onboarding and training. The contractor shall complete all requirements, training, and forms as prescribed in the following requirements:

1.11.2.1 The DHA’s “Onboarding Checklist for Contractor Employees” is located at the DHA Onboarding and Offboarding Portal at https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx

1.11.2.2 The DHA’s contractor training instructions embedded at Part 7 Section 7.1.2.

1.11.2.3 The contractor shall comply with onboarding requirements of the DHA for contractors needing to be issued CAC identification, including DoD- and DHA-directed training and forms submission, prior to network access, as displayed in the In/Out-Processing Portal at: https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx (note: Public Key Infrastructure (PKI)-restricted, printed versions available).

1.11.3 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.11.4 Key control: The contractor shall establish and implement methods of making sure all keys/key cards issued to the contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the contractor by the Government shall be duplicated. The contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the CO.

1.11.4.1 In the event keys, other than master keys, are lost or duplicated, the contractor shall, upon direction of the CO, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re-keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying or the replacement of the lock or locks shall be deducted from the monthly payment due the contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the contractor.

1.11.4.2 The contractor shall prohibit the use of Government issued keys/key cards by any persons other than the contractor’s employees. The contractor shall prohibit the opening of locked areas by contractor employees to permit entrance of persons other than contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the CO.

1.11.5 Lock combinations: Reserved

1.12 Key personnel (Contractor): The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the CO. The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 7:00 a.m. to 4:00 p.m., Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons. Qualifications for all key personnel are listed below:

1.12.1 Contract Manager and Alternate. The Contract Manager and alternate are Strategic Advisors, whose qualifications and expertise are exceptional and/or highly unique. Strategic Advisors are experts who demonstrate thought leadership in their area of expertise through publications, speaking engagements, media citations, or other recognized interactions. PEO Medical System/CIO J-6 requires Strategic Advisors who are experts in DoD acquisition and contracting, especially related to recent legislative and regulatory efforts to streamline acquisition and introduce innovative processes. Strategic Advisors must have a minimum of 15 years professional experience and a master’s degree with Contracting Officer experience a plus, or 20 years of professional experience and a bachelor’s degree with Contracting Officer experience a plus.

1.13 Data rights: The Government will retain rights to all data produced in the course of developing, deploying, training, using and supporting DHA or other federal agencies that utilize this order.

1.14 Reporting

1.14.1 Contractor Manpower Reporting (CMR): RESERVED.

1.14.2 Non-Disclosure Agreement (NDA): All contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA contractor NDA (DHA Form 49) prior to beginning work on the subject contract. The contractor shall execute an NDA on behalf of the company and shall ensure that all staff assigned to, including all subcontractors and consultants, or other personnel performing on contract/Task order execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other contractors. The NDA shall be executed not later than first day of employment and to be renewed upon exercising a contract option period. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the contractor. The contractor shall maintain originally signed NDAs of individual employees and provide copy to the COR.

1.14.3 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings. The contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is contractor support personnel. Include a title block in all emails that states the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is contractor support personnel.

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order. Contractor personnel shall make their contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16 Contractor Access to Health Affairs (HA)/DHA Network(s)

1.16.1 FSO/Company's Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system (If applicable, if not delete 1.16.1 and 1.16.2 and replace to 1.16 Reserved). Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and the security awareness training. The contractor shall be prepared for this process as it could take two (2) or more weeks. The FSO/Security POC shall submit a Standard Form (SF) 85/86 to DHA's Personnel Security Office for a background investigation.

1.16.2 Company's FSO/Security POC must notify the Personnel Security Office when the contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the DHA Personnel Security Office in writing of a contractor's termination from the contract, including the termination date.

1.17 Personnel Security

1.17.1 The contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce Improvement Program, CH4” November 10, 2015 as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM 5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.17.1.1 Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at (703) 275-6038.

1.17.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.17.1.3 DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing off on any access request.

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D-Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R-Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.1.7 Program Manager (PM): An individual who is responsible for the cost, schedule and performance of a specific project. The PM must understand and manage multiple discipline areas in order the successfully execute a project. This individual does NOT have authority to change the terms and conditions of the contract.

2.2 Acronyms:

2.3 Applicable Publications, DHA Administrative Instructions (AI), etc.

Federal Acquisition Regulation (FAR) Defense Federal Acquisition Regulation Supplement (DFARS)

Defense Acquisition System (DoD Directive 5000.1)

Cybersecurity (DoDI 8500.01) Risk Management Framework for DoD Information Technology (DoDI 8510.01) Identify Authentication for Information Systems (DoDI 8520.03) DoD Privacy Program (DoD Directive 5400.11) DoD Health Information Privacy Regulation (DoD 6025.18-R) Personnel Security Program Requirements (DoD 5200.2-R) GoG Information Security Program: Controlled Unclassified Information (CUI) (DoD5200.01, Vol 4)

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government:

☐ Will NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Government Furnished Services required in support of this contract/task orders. These Services are described below: provide access to business telephones, for business purposes only, and access to other equipment as necessary to perform the tasks specified in this PWS. The government will provide IT services necessary to maintain government issued equipment on the network.

3.1.1 The government will provide the training on the annual mandatory training schedule identified as required for CSPs. This training will typically encompass matters of security and safety, human relations (to include subjects such as sexual harassment, violence in the workplace, and race relations), and other conduct – related training that is generally required for government personnel, such as team building, ethics. The Government will provide this training, at no cost to the Contractor; during contract duty hours; Contractor may charge this training against the contract as a service required under the contract. Contractor personnel will provide proof of required training to the TM within 3 business days of each training course completion. Cyber Awareness training is required prior to gaining network access, and annually thereafter. HIPAA training, Level 1 Antiterrorism Awareness training, OPSEC Awareness training, and others as may be assigned are required to be completed within 30 days of being assigned, and annually thereafter.

3.1.2 The Government will provide training as required for new systems that it elects to add to the duties of the site support contractor. The training will be via industry standard training courses or courses as approved by the Government. The Government will provide for the cost of travel, accommodations, rental car when appropriate, meals and incidentals, and training course fees and materials in accordance with Federal Travel Regulation and JTR. The Government will fund additional training at its discretion to meet task order requirements involving new or unique applications, tools, or processes.

3.2 Facilities: The Government:

☐ Will NOT provide Facilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Facilities in support of this contract/task orders. The Government provided Facilities are described below:

For work performed within Government facilities, the Government will provide the necessary workspace for the contractor staff to provide the support outlined in the PWS

3.3 Utilities: The Government:

☐ Will NOT provide Utilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Utilities in support of this contract/task orders. The Government provided Utilities are described below:

For work performed within Government facilities, the Government will provide access to any utilities required in the performance of this contract. The Contractor shall instruct employees in utilities conservation practices, and shall be responsible for operating under conditions that preclude the waste of utilities.

3.4 Equipment: The Government:

☐ Will NOT provide Equipment in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Equipment in support of this contract/task orders. The Government provided Equipment is described below:

The Government will provide laptop computers, monitors, and other equipment necessary to perform the tasks specified in this PWS. For work performed within government facilities, the government will provide access to printers, scanners, shredders, and telephones for business purposes only.

3.4.1 Procurement Integrated Enterprise (PIEE), GFP Module Application: The contractor shall be responsible for obtaining and maintaining access, training and successful operation of the PIEE/GFP Module application for the entirety of the contract/task order PoP. The PIEE GFP Module application is located at the following website: https://wawf.eb.mil/piee-landing/. Access to PIEE/GFP Module application training materials and in-depth information applicable to the contractor’s responsibilities regarding GFP can be found at the following website: https://dodprocurementtoolbox.com/.

Contracting Office Responsibilities:

The Contracting Office shall ensure close coordination and validation of the GFP items with the COR and DHA Accountable Property Officer prior to uploading the GFP Attachment into the PIEE/GFP Module. At the time GFP is anticipated and identified, the Government will upload the GFP Attachment into the PIEE/GFP Module. It is the Contracting Office’s responsibility to prepare, upload and maintain the GFP Attachment in the PIEE/GFP Module in accordance with the GFP Attachment instructions provided at the DoD Procurement Toolbox. The CO and COR shall manage and keep an inventory of any GFP associated with contract/task orders awarded through DHA, in accordance with applicable FAR Part 45, DoD FAR Supplement (DFARS) 245 with respective clauses, DHA AI 095 and PD 45-01 following the change in disposition of items listed on that PIEE/GFP Module Attachment.

The contracting office will also review, acknowledge, reject and/or approve shipment orders provided by the contractor as appropriate. Functional roles can be determined within the Contracting Office, and requested within the PIEE/GFP Module system.

Contractor Responsibilities:

A key contractor responsibility is to work with the CO and COR to ensure the PIEE/GFP Module data, to include the PIEE/GFP Attachment, provides a timely, complete and accurate accounting of the GFP applicable to the contract/task order. Contractors are required to report the receipt of any GFP shipped to them, regardless of whether it is listed on the GFP Attachment for their contract. Similarly, contractors are required to utilize the GFP Module application in conjunction with the shipment of GFP to the Government, or in reporting Property Loss of GFP issued (such as destruction or loss). Discrepancies or disputes regarding property shipped to or shipped from the contractor must be reported via the GFP Module application, with the CO having authority over final designation of status.

The contractor shall report semi-annually 100% inventories, reconciliations, and final disposition of GFP provided by the government. Final invoices will not be paid pending GFP reconciliation. Contractors shall be aware of and ensure compliance with applicable FAR Part 45, DFARS 245 and 252.245, Defense Pricing and Contracting Policies, Procurement Integrated Enterprise Environment Standards, DHA Administrative Instruction 094 and DHA Guidance. (If this option is used, a semi-annual GFP inventory CDRL will need to be added to the PWS Technical Exhibit 1.)

3.5 Materials: The Government:

☐ Will NOT provide Materials in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ IS providing Materials in support of this contract/task orders. The Government-provided Materials are described below: The Government will provide standard office supplies as necessary to perform the tasks specified in this PWS for work performed within Government facilities.

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 Services: The Contractor:

☒ Will NOT provide Contractor Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Contractor Furnished Services required in support of this contract/task orders. These Services are described below: Any work performed at the contractors facility

4.2 Secret Facility Clearance: A Secret Facility Clearance is not required.

PART 5

5.0 SPECIFIC TASKS

5.1 Specific Tasks: The contractor shall provide strategic advice and guidance related to PEO Medical System/CIO J-6 Strategic Contract Development methods and practices for ITBSR to tactically align the DAD IO priorities with legislations that affects and/or modernizes the acquisition of IT across the DoD.

5.1.1 Acquisition Regulatory Support: PEO MEDICAL SYSTEM/CIO J-6 requires consulting expertise from personnel highly experienced in Department of Defense (DoD) acquisition and contracting processes to develop new acquisition strategies and contracting approaches, by having participated in the Section 809 Panel to Streamline and Codify Defense Acquisition report. PEO Medical System/CIO J-6 requires acquisition innovation and thought leadership based on participation in and/or knowledge of recent DoD acquisition reform, streamlining, and improvement initiatives and associated legislation. Contractor is responsible for contributing to the establishment of guidelines, policies and procedures for defining, developing, documenting, validating and managing PEO MEDICAL SYSTEM/CIO J-6 responsibility areas. The following are critical Acquisition Regulatory related activities, but are not limited to regulatory areas that must be considered.

· The Contractor shall provide acquisition and strategic advice to identify, understand, analyze, articulate, and ensure compliance with acquisition (especially information technology) contracting regulations, guidelines, policies, processes/procedures.

· The Contractor shall provide strategic advice on new guidance identified by the Section 809 Panel pending revisions to DoD Small Business strategy based on Section 851 of the FY 2019 NDAA, and acquisition reform provisions included in National Defense Authorization Acts (NDAAs) for FYs 2016-2019.

· The Contractor shall provide strategic advice and guidance related to, but not limited to, non-personal services, hardware and software acquisition practices, agile acquisition approaches and techniques, smarter use of common contract solutions and practices, best practices and state-of-the art techniques in fair opportunity and source selection.

· The Contractor shall provide strategic advice and guidance on Design and Acquisition of Software for Defense Systems, Intellectual Property and Data Rights, current DoD cloud services acquisition initiatives, pending revisions to DoD Small Business strategies, and acquisition reform provisions included in NDAA for FY16 through FY19.

5.1.2 Acquisition Package Support: The Contractor will specifically advise the Government on mechanisms to incorporate Section 809 panel, pending revisions to DoD Small Business strategy based on Section 851 of the FY 2019 NDAA, and acquisition reform provisions included in National Defense Authorization Acts (NDAAs) for FYs 2016-2019. The tasks that are required to perform this function include, but are not limited to the following:

· The Contractor shall provide a review and comment on Acquisition Packages as required by the Government lead.

· The Contractor shall make recommendations on how to improve ITBSR tools and ensure compliance with Federal, DoD and DHA policy, plans, processes, standards and requirements.

· The Contractor shall provide guidance and assistance in the drafting of complex Request for Information, Statement of Objectives, draft special clauses and provisions to address unique program situations, use of other Transaction Agreements and Commercial Solutions Opening, Draft solicitations, Requests For Quotes (RFQ), and Requests for Information (RFI).

· The Contractor shall provide recommendations regarding contract type.

· The Contractor shall provide strategic preparation and development of Justifications and Approvals (J&A), delivery schedules, Security Requirements (DD254’s Exhibit 6) and funding requirements, Assist and provide business process re-engineering guidance based on observations of current processes.

· The contractor shall become familiar with the Government collaboration tool, Ektropy, for management of tasks associated with this contract.

5.2 Special Qualifications: PEO Medical System/CIO J-6 requires Strategic Advisors who are experts in DoD acquisition and contracting. Strategic Advisors must have a minimum of 15 years professional experience and a master’s degree with Contracting Officer experience a plus, or 20 years of professional experience and a bachelor’s degree with Contracting Officer experience a plus.

DHA DADIO requires acquisition innovation and thought leadership based on participation in and/or Subject Matter Expert (SME) knowledge of recent DoD acquisition reform, streamlining, and improvement initiatives and associated legislation.

These may include:

· Defense Innovation Board (DIB) Software Acquisition Practices (SWAP) report and recommendations

· Defense Science Board (DSB) Design and Acquisition of Software for Defense Systems report and recommendations

· Section 813 Panel on Intellectual Property and Data Rights report and recommendations

· Office of Management Budget (OMB) Policy Memo M-19-13: Category Management: Making Smarter Use of Common Contract Solutions and Practices

· In progress revisions to DoDI 5000.02, DoDI 5000.74, DoDI 5000.75

· Current DoD cloud services acquisition initiatives (e.g., Joint Enterprise Defense Infrastructure [JEDI], Defense Enterprise Office Solutions [DEOS])

· Best practices and state-of-the-art techniques in Fair Opportunity and Source Selection

· Other Transaction Agreements and Commercial Solutions Opening

· Agile acquisition approaches and techniques

· Pending revisions to DoD Small Business strategy based on Section 851 of the FY 2019 NDAA

· Acquisition reform provisions included in National Defense Authorization Acts (NDAAs) for FYs 2016-2019

PART 6

6.0 INFORMATION TECHNOLOGY & SECURITY

6.1 All work under this contract is unclassified; however, contractor personnel will undergo a criminal background investigation and a favorable National Agency Check with Inquiries (NACI) or higher. The contractor personnel must be able to obtain and maintain favorable suitability adjudication prior to commencement of duties; one major legal issue with 36 months of the suitability adjudication date is automatically disqualifying. The contractor will pre-screen employees for major issues relating to; Intoxicants, Drug Use, Financial Responsibility, Sexual Misconduct, Honesty, Disruptive or Violent Behavior, Employment Misconduct or Negligence, Illegal possession of Firearms or Weapons, acts of terrorism, Security denials or revocations, Serious Mental Health Issues, Associates or Relatives with issued that directly relate to the Contractor, and misuse of Information Technology Systems. It is highly recommended Contractors bring their original passport or birth certificate. The final Suitability Determination will be made by DHA leadership through the Security Office. The Contractor personnel will be removed from the network and may be removed from the facility at any time if they are found unsuitable through the continuing evaluation process. If Contractor personnel received interim declination or eligibility denial by the Defense Industrial Security Office (DISCO) or any other Central Adjudication Facility (CAF), this action is automatically disqualifying and overrides local suitability determinations. If a Contractor personnel is found unqualified for any reason or the personnel submits their resignation, the personnel shall be replaced with a qualified individual within 5 business days. Contractor personnel will be required to sign a Non-Disclosure Agreement due to access to procurement sensitive information.

6.2 The TIER 1 or TIER 2 levels and position sensitivity designation for positions under this contract is: (Requirement must be checked in order to be a requirement for this PWS.)

6.2.1 TIER II: Non-critical sensitive position

6.3 Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal information requirements: Refer to Clause Section, Attachments 1 and 2 of DHA Procedures, Guidance and Information 224.90, Personally Identifiable Information (PII), and Federal Information Requirement and adherence to DHA Administrative Instruction-110, Safeguarding Procurement Sensitive Information, is required.

6.3.1. Data Sharing Agreements (DSAs): Contractors requiring access to PII, which includes PHI, or access to de-identified data, are subject to the DHA Privacy and Civil Liberties Office (DPCLO) (Privacy Office) Data Sharing Program. This program requires DHA to enter into DSAs with parties outside the MHS who use or create MHS data. A DHA contract may use the term Data Use Agreement (DUA) rather than DSA. DSAs assure that outside parties protect MHS data in accordance with the Privacy Act and the HIPAA Rules. To apply for a DSA, the contractor submits a Data Sharing Agreement Application (DSAA) to the DHA DPCLO. The contractor submits the DSAA even if a subcontractor will be the party accessing MHS data. After review and approval of the DSAA, the Privacy Office provides a DSA to the contractor for execution.

6.3.2. Processing Procurement Sensitive Information: All individuals shall seek guidance from the CO regarding the coordination of documents, dissemination, and transmission of procurement sensitive information. Procurement sensitive information shall not be transmitted electronically unless encryption is utilized. Depending on a particular procurement, other restrictions may apply.

6.4 Training

6.4.1 Contractor employees performing cybersecurity/cyberspace functions shall comply with the following requirements:

6.4.1.1 Training: All contractor and associated subcontractor employees working Cybersecurity Information Assurance (IA)/Cyberspace functions must comply with DoD training requirements in Department of Defense Directive (DoDD) 8140.01 and DoD 8570.01-M. Contractors shall identify, document, track, and report qualifications of contract support personnel who perform cyberspace work roles.

6.4.1.2 Certification: The contractor shall ensure that personnel accessing IS have the proper and current IA certification to perform IA functions at contract award in accordance with DoD 8570.01–M, IA Workforce Improvement Program. The contractor shall meet the applicable IA certification requirements as outlined in DFARS 252.239-2001, including:

6.4.1.2.1 DoD-approved IA workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01–M; and

6.4.1.2.2 Appropriate operating system certification for IA technical positions as required by DoD 8570.01–M.

6.4.1.2.2.1 Upon request by the Government, the contractor shall provide documentation supporting the IA certification status of personnel performing IA functions.

6.4.1.2.2.2 Contractor personnel who do not have proper and current certifications shall be denied access to DoD IS for the purpose of performing IA functions.

6.4.2 User requirements: All contractor employees that require access to DHA IT must comply with the requirements of DHA-Procedural Instruction 8140.01, Acceptable Use of DHA IT, to include those contract employees with privileged access.

6.5 Cybersecurity Requirements for Non-DoD IT or Covered Contractor IS: Reserved

6.6 Risk Management Framework (RMF) for DoD IT: All IS, Platform Information Technology (PIT) and IT Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with DoDI 8510.01, Risk Management Framework (RMF) for DoD IT and comply with annual Federal Information Security Modernization Act (FISMA) security control testing. IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the NIST SP 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

6.6.1 All systems subject to RMF must present evidence of authorization in the System Security Plan, Security Assessment Report) a Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has a DoD RMF or equivalent DoD Component PIT system accreditation decision that is current within 3 years within 5 business days of CO request. Evidence of FISMA compliance must be presented in the form of a POA&M. Systems must have and maintain an Authority to Operate (ATO) or Authority to Operate with Conditions (ATO-C) by contract award.

6.6.2 The contractor shall implement security controls in accordance with NIST implementation and validation requirements specified in the NIST SP 800-37 Risk Management Framework (RMF) and DoDI 8510.01, Risk Management Framework (RMF).

6.6.3 The contractor shall configure the information system in accordance with Defense Information Agency (DISA) Security Requirements Guides (SRGs) and security technical implementation guides (STIGs).

6.6.4 The contractor shall ensure that the information system conforms to the requirements of DoDI 8551.01 “Ports, Protocols, and Services Management (PPSM)”.

6.6.5 The contractor shall ensure that the information system shall authenticate all entities as specified in DoDI 8520.03 “Identity Authentication for Information Systems” prior to granting access.

6.6.6 The contractor shall Public Key (PK) enable the information system, implementing digital signature and encryption requirements specified in DoDI 8520.02, “Public Key Infrastructure (PKI) and Public Key (PK) Enabling”.

6.6.7 The contractor will be responsible for compliance with the Joint Force Head Quarters – Department of Defense Information Network issuances and IA Vulnerability Management (IAVM) issuances by ensuring that the issuances are assessed, implemented and maintained throughout development and sustainment in accordance with specified timelines.

6.6.8 The contractor shall support reciprocity, by providing all directed information in NIST security documents to the government.

6.6.9 The contractor shall implement system level protection and detection capabilities that are consistent with their contract for NIST Security requirements that meet DoD and DHA Cybersecurity Architectures.

6.6.10 Cyber Incident Reporting Requirement: The contractor shall comply with the incident management requirements of Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B, “Cyber Incident Handling Program”.

6.6.11 Information security continuous monitoring (ISCM): ISCM is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. ISCM is a critical part of the risk management process to ensure that IS and PIT operations remain within an acceptable level of risk despite any changes that occur.