Performance Work Statement (PWS) Deployment Solutions_2026.04.13.pdf

Program Executive Office - Defense Healthcare Management Systems 1

(PEO DHMS) 2

Deployment Solutions 3

Performance Work Statement (PWS) 4

1. Background 5

The Program Executive Office - Defense Healthcare Management Systems (PEO DHMS) 6 is responsible for delivering advanced health IT solutions to the Department of War 7 (DoW), the Department of Veterans Affairs (VA), the United States Coast Guard 8 (USCG), North Atlantic Treaty Organization (NATO)/Coalition partners, and other 9 federal partners including efforts coordinated through the Federal Electronic Health 10 Record Modernization (FEHRM) office. Within its portfolio, PEO DHMS oversees three 11 critical programs: DoD Healthcare Management System Modernization (DHMSM), Joint 12 Operational Medicine Information System (JOMIS) and Enterprise Intelligence and Data 13 Solutions (EIDS). These programs collectively enhance healthcare delivery, operational 14 medicine capabilities, and medical readiness across diverse environments. 15

DHMSM was established to acquire and field a configurable and scalable modernized 16 Electronic Health Record (EHR) system to replace DoW legacy healthcare systems. In 17 support of this mission, DHMSM acquired an integrated inpatient/outpatient Commercial 18 EHR solution known as MHS GENESIS. The DHMSM portfolio extends beyond MHS 19 GENESIS, incorporating a broader set of solutions to create a single, unified EHR for the 20 federal health community. Through a suite of clinical applications and products, 21 DHMSM provides comprehensive health management, advanced data applications, and 22 improved usability, supporting priorities such as telehealth, population health analytics, 23 and a user-facing patient portal. The DHMSM Program Management Office (PMO) 24 manages the integration of these business processes and clinical workflows to ensure user 25 adoption and a seamless experience throughout the full continuum of care. 26

JOMIS provides warfighters with technologies to make life-saving and critical mission 27 decisions in operational medicine (OpMed) environments. In support of this mission, 28 JOMIS develops, deploys, and manages OpMed products that allow for documentation of 29 patient care, transmission of patient care data through all roles of care, medical readiness 30 tracking and aggregation of medical Command and Control Situation Awareness (C2SA) 31 data. The JOMIS products are meant to be used as an integrated suite of products that 32 work together with DHMSM and EIDS products to inform the longitudinal health record 33 and conduct aggregated medical reporting and simulations to support C2SA. The suite 34 includes but is not limited to OpMed Care Delivery Platform (CDP), Battlefield Assisted 35 Trauma Distributed Observation Kit - Joint (BATDOK-J), Medical Hub (MedHUB), and 36 Theater Blood-Mobile (TBLD-M). As new capabilities are identified, new products or 37 capabilities may need to be deployed, once developed. JOMIS users are deployed forces 38 across the globe supporting all roles of care in connected and disconnected operational, 39 austere, and forward-deployed locations. To deploy and train OpMed products to the 40 field, JOMIS collaborates with their Service partners to provide a variety of different 41 deployment and training methods based on each individual site or unit, to include low-to-42 no touch deployment and training. 43

The EIDS PMO supports the strategic goals of the MHS and facilitates informed 44 decision-making through the delivery of robust information services and data in a timely, 45 relevant, and actionable manner. They deliver, connect, and curate data across a diverse 46 data ecosystem in support of Military Health, readiness, federal health data integration, 47 and innovation. EIDS provides seamless data services and decision support for 48 clinicians, patients, beneficiaries, analysts, researchers, and DoW leadership to support 49 improved patient care. EIDS provides service delivery and product line management, 50 offering more than 100 products and services to DoW, Defense Health Agency (DHA), 51 federal partners, academic, and research communities. They focus on providing the right 52 data at the right time to the right person to drive organizational insights and better patient 53 outcomes. The primary capability supported by EIDS is the Military Health System 54 Information Platform (MIP), which is the largest secondary repository of health-related 55 data in the DoW. It provides self-service access to high trust, governed data and enables 56 traditional reporting and dashboarding capabilities in a secure, cloud-based platform. 57 Users are able access and analyze data within a single, cohesive environment with a 58 collaborative user community. 59

Due to the growing demand for its product portfolio, PEO DHMS has expanded its focus 60 to include the deployment to operational locations, and additional federal partners, as 61 well as specialized environments where standard network connectivity is limited or 62 unavailable. 63

2. Purpose & Scope 64

This is a non-personal services contract to provide all services and materials necessary to 65 support and execute the on-demand deployment of any product(s) within the DHMS 66 portfolio and related or supporting components. This includes program management, 67 deployment planning and execution, hardware delivery and connectivity, product 68 connectivity and interface validation, user enablement services, data management and 69 migration. 70

Services are applicable to Continental United States (CONUS) and Outside Continental 71 United States (OCONUS) locations, covering various roles of care and facility types as 72 specified in individual task orders1. 73

1 The Department anticipates that the user base, supported organizations, and operational footprint may expand over the period of performance. While the scope and timing of any such expansion cannot be precisely defined at this time, offerors should be aware that future requirements may include support for periods of increased operational tempo and additional participating entities consistent with evolving mission needs.

3. Desired Outcomes/Tasks/Objectives 74

This section outlines the desired outcomes, high-level tasks, and core objectives for the 75 successful deployment of products and integrated systems to hospital (fixed facility) and 76 field unit (expeditionary) environments under this Indefinite Delivery, Indefinite Quantity 77 (IDIQ) contract. The contractor shall be responsible for all activities necessary to ensure 78 a seamless transition from project initiation to full operational capability at each 79 deployment site with minimal disruption to ongoing operations. The overarching goal is 80 to deliver a fully functional and adopted solution that ensures the seamless and accurate 81 transmission of data through all roles of care and meets the mission needs of each 82 location. This is critical for updating patient health records and aggregating data for 83 C2SA reporting. 84

Each task order will specify the exact scope, schedule, and performance criteria for a 85 given deployment. The objectives listed herein describe the full range of capabilities that 86 may be required across the full range of military operations. 87

3.1 Program Management 88

As part of the Deployment Approach (A003) and the Implementation Plan (A010), the 89 contractor shall provide a program management framework to ensure deployment efforts 90 are governed by consistent standards of quality, risk management, and fiscal discipline. 91 This framework shall provide the Government with full transparency into project 92 performance and ensure the contractor is accountable for all outcomes. The contractor 93 shall successfully execute all work under this contract, including the necessary processes 94 and tools to effectively manage cost, schedule, and performance/resources. Specific 95 requirements, deliverables, and reporting frequencies for each activity will be defined 96 within individual task orders. 97

The contractor shall designate a primary Program Manager (PM) who will serve as the 98 Government's single point of contact and be responsible for the overall management of 99 the contract. While the contractor may designate other points of contact at the task order 100 level, the primary PM is the one individual authorized to act on behalf of the contractor 101 for all matters related to this contract. This primary PM is ultimately responsible for 102 coordinating all contract performance, including resource allocation, risk mitigation, and 103 ensuring clear communication with the Government's Contracting Officer's 104 Representative (COR). 105

Core Management Functions: 106

• Support for Governance and Stakeholder Engagement: The contractor shall 107 provide dedicated support for all Government-led governance bodies (e.g., 108 Informatics Steering Committee or OpMed IT Steering Committee). The 109 contractor's role is to facilitate informed decision-making by: 110 o Preparing and Facilitating Materials: Developing meeting agendas, 111 presentation materials (D001), data-driven analyses, and expert 112 recommendations on deployment strategies for Government review and 113 consideration. 114 o Documenting and Tracking Outcomes: Recording meeting minutes 115 (D002) and tracking action items and key decisions made by the 116 Government-led committees. 117 o Executing a Stakeholder Communications Plan: Developing and 118 executing a comprehensive communications plan that identifies all key 119 stakeholder groups and defines the contractor's strategy for disseminating 120 information about project status, risks, and changes as directed by 121 Government leadership. 122

• Risk and Issue Management: The contractor shall develop and actively maintain 123 a risk register. This includes creating a comprehensive Contingency Plan to 124 mitigate identified risks, such as data loss, network failures, or schedule delays, 125 ensuring mission-critical operations are protected for the task order. 126

• Quality and Change Management: The contractor shall implement a robust 127 Quality Management process to ensure all deliverables meet or exceed contract 128 standards. The contractor shall develop and maintain an effective Quality Control 129 Plan (QCP) (CDRL A001), which outlines quality procedures and includes a self-130 inspection and internal coordination plan. The QCP shall establish a formal 131 Change Control process to manage, document, and validate any modifications to 132 the system or its configuration post-deployment. Required revisions must be 133 made within 5 working days. 134

• Staffing Plan: The contractor shall develop, maintain, and deliver a Staffing Plan 135 (D003) that details the roles and labor categories required to successfully execute 136 all tasks specified in the task order. 137

• Contract Reporting and Administration: The contractor shall manage the 138 timely development and submission of all contract deliverables as delineated in 139 the PWS and Sections 34-37. 140

• Financial and Contract Reporting: The contractor shall provide a Monthly 141 Progress Report (D006) detailing performance against schedule, budget, and 142 objectives. 143

• Kick-Off Meeting: The contractor shall conduct a kick-off meeting with the 144 Government for each awarded task order. The purpose of this meeting is to 145 ensure a shared understanding of the task order requirements, establish lines of 146 communication, and review the contractor's planned approach. 147

3.2 Deployment Planning and Execution 148

The contractor shall employ an adaptable framework for planning and executing all 149 deployment activities or events to include initiation, planning, configuration, validation, 150 implementation, stabilization, and transition. This framework ensures that each project, 151 regardless of scale or location, moves from concept to sustained operation in a deliberate 152 and controlled manner. The contractor will receive a tested product ready for deployment 153 that requires configuration, validation, and implementation. 154

3.2.1 Initiation and Planning 155

During initiation and planning, the focus shall be on discovery and creating the blueprint 156 for successful deployment. The desired outcome is a complete and actionable blueprint 157 for deployment, including a strategic approach, a readiness assessment, and a detailed 158 schedule that provides a clear and executable roadmap for successful implementation. 159

• The Deployment Approach (CDRL A003) is the foundation for the 160 Implementation Plan (CDRL A010). The contractor shall provide the overall 161 approach and methodology for deployment, continuity and logistics, training, user 162 adoption, change management, and communications across multiple 163 environments/networks, fixed/expeditionary facilities for multiple products, and 164 with different federal partners (DoW and non-DoW). The contractor shall include 165 any potential opportunities, risks, issues, and dependencies for each area, and 166 mitigation plans. 167

• Deployment Readiness Assessment (D008): The contractor shall provide a 168 Deployment Readiness Assessment, which is a formal and systematic evaluation 169 used to determine if an organization, its users, and the technology itself are fully 170 prepared for a successful "go-live" event. This assessment is a comprehensive 171 review that measures preparedness against a predefined set of criteria, moving 172 beyond just technical functionality to include people, processes, and support 173 systems. The contractor shall identify risks, gaps, and potential points of failure 174 that could jeopardize the deployment's success, disrupt operations, or hinder user 175 adoption. 176

• Implementation Plan (CDRL A010): Based on the Readiness Assessment, the 177 contractor shall develop, maintain, and actively manage an implementation plan, 178 to include a detailed Integrated Master Schedule (IMS) (CDRL A011). The 179 Implementation Plan is the detailed tactical execution plan that operationalizes the 180 approach outlined in the Deployment Approach. 181

• Data Collection (D009): As specified by the task order, the contractor shall 182 facilitate the timely and accurate collection of all data required to configure the 183 product, hardware, equipment, and interfaces for deployment (Product 184 Configuration Data (D009)). 185

3.2.2 Product Configuration, Validation, and Implementation 187

As specified in the task order, the contractor shall perform configuration, validation, and 188 implementation activities required for deployment, culminating in the formal cutover 189 event. DHMS products may include hardware and/or component installation and 190 configuration across various networks. This may include user role assignment, security 191 permissions, and system-level parameters. The desired outcome is a fully integrated and 192 validated product where all functionality and data are confirmed to be accurate and 193 operate as intended, ensuring the product is ready for operational use. 194

3.2.2.1 Product Validation 195

The contractor shall develop and execute a Product Validation Plan (D012) for all 196 products configured as specified in the task order. The desired outcome is to verify the 197 configured product matches the specifications outlined in the task order. 198

• Validate the product(s) functionality, which may include integration with both 199 internal and external clinical, financial, and administrative systems and interfaces, 200 to ensure it operates as intended under expected conditions, as specified in the 201 task order. 202

• The contractor shall complete data validation and reconciliation as designated in 203 the task order. 204

3.2.2.2 Network Integration and Configuration 205

The contractor shall ensure seamless integration with existing network infrastructure, 206 validating bandwidth requirements and testing all network configurations and firewall 207 rules. As applicable, the contractor shall deploy and configure products to operate 208 autonomously in Disconnected, Intermittent, and Limited (DIL) environments, 209 encompassing the full range of operational platforms from server-based theater hospital 210 products to mobile, point-of-injury data capture solutions running on handheld devices 211 and wearable sensors. The desired outcome is a fully configured and integrated product 212 that complies with applicable DoW cybersecurity requirements. 213

3.2.2.3 Hardware Delivery, Installation, and Configuration 214

The contractor shall manage the procurement, end-to-end logistics using DD Form 1149 215 (D011), installation, and network integration of all required hardware, which shall be 216 contractor-furnished and not Government Furnished Equipment (GFE), as delineated in 217 the task order. The desired outcome is that all physical components are identified, 218 delivered, installed, connected, and functioning as intended in their designated 219 operational environment based on Government requirements. 220

3.2.2.4 Medical Device Configuration and Validation 221

The contractor shall ensure that all required medical devices can securely and reliably 222 connect to and interoperate with the newly deployed product. The desired outcome is a 223 fully validated, integrated environment where data flows accurately and securely between 224 medical devices and the central system, ensuring patient safety and quality of care. 225

3.2.2.5 Data Management and Migration 226

As part of the Deployment Approach (CDRL A003) and Implementation Plan (CDRL 227 A010), the contractor shall be responsible for the secure and accurate management, 228 migration, and validation of all clinical and administrative data as specified in the task 229 order. The desired outcome is for all necessary data to be validated and securely 230 transferred to the new product with its integrity intact, ensuring continuity of care. 231

• For fixed facilities, execute the Extract, Transform, and Load (ETL) process, 232 potentially by replicating data to a parallel data center prior to a planned cutover. 233

• For field units, perform "Data Seeding" as a critical pre-deployment task. This 234 involves pre-loading the ship's or unit's local server with essential data such as 235 patient demographics, formularies, and clinical templates to enable autonomous 236 operation. 237

• Utilize secure data migration methods, such as encrypted transfer protocols or the 238 physical transport of encrypted backup media. 239

3.2.3 Cutover, Stabilization, and Transition 240

The contractor shall manage the activities associated with cutover to the new product, 241 stabilize the new environment, and ensure a seamless hand-off to sustainment teams. The 242 desired outcome is to have a seamless transition from one product or system to another 243 with minimal impact on healthcare operations. 244

• Cutover: The contractor shall manage the coordination and communication of the 245 transition to the new product. 246

• Post-Deployment Stabilization Support: The contractor shall implement and 247 manage a multi-tiered user support structure to provide rapid and effective 248 assistance, including on-site "at-the-elbow" and remote support as defined in the 249 task order. 250

• Post-Deployment Stabilization Report (D010): The contractor shall provide a 251 daily report during the Post-Deployment Support period as defined in the task 252 order. This report will include status of tickets, devices, user support, and other 253 key indicators of a successful transition. 254

• Transition to Sustainment: The contractor shall execute a formal transition plan 255 to hand off the fully deployed and stabilized product(s) to the Government 256 sustainment and operations teams. 257

3.3 User Enablement Services 258

The contractor shall provide all necessary personnel, supervision, and materials required 259 to perform a full range of training and user adoption services in support of the 260 deployment of DHMS products. The contractor must possess the capability to perform 261 the services described in the sections below. 262

3.3.1 Human Systems Integration (HSI) Alignment 263

The contractor shall ensure that all training, adoption, and support services are aligned 264 with the principles of Human Systems Integration (HSI) as outlined in DoDI 5000.95. 265 The objective is to ensure that the contractor's services contribute to a total system that is 266 effective, suitable, and safe for human use. The contractor shall maintain a working 267 knowledge of HSI principles and processes, and leverage HSI principles to identify and 268 help mitigate barriers to user performance and acceptance. 269

3.3.2 Consideration of Operational Environments 270

The contractor shall possess the capability to provide training, adoption, and user support 271 services to users in operational environments, including theaters of war and other 272 locations with DIL network connectivity. The specific requirements for such support will 273 be detailed in individual task orders. When providing services for these environments, 274 the contractor shall ensure all resources, methods, and support models are operationally 275 suitable to achieve optimal staff efficiency at the lowest possible barrier to adoption. The 276 focus shall be on user self-sufficiency and mission effectiveness in a contested or austere 277 environment. 278

3.3.3 Consideration of Global User Community 279

All services described herein shall be available to a global user base. The contractor shall 280 deliver consistent, prompt, and effective support to personnel regardless of their 281 geographic location or time zone. All planning, staffing, and execution strategies must 282 account for the complexities of worldwide operations, including but not limited to, 283 varying network conditions, local command structures, and cultural considerations. 284

3.3.4 Training 285

As part of the Deployment Approach (CDRL A003) and Implementation Plan (CDRL 286 A010), the contractor shall design, develop, and execute a comprehensive training 287 program to ensure users are familiar with the product deployed in the task order. For the 288 Federal EHR, proficiency is achieved when a user can consistently and confidently 289 complete role-specific workflows and pass course-specific competency assessments. For 290 JOMIS products, the training shall be intuitive, user-centric, and outline a joint approach 291 for collaborative execution with the Services. The training program should also provide 292 schedules, risk assessments, and mitigation plans for each product and site in a timely 293 manner. The Government will specify the required materials and target audiences in each 294 task order. The desired outcome is a confident and competent user base capable of 295 leveraging the product(s) full capabilities effectively and efficiently. 296

3.3.4.1 Training Program Development 297

• The contractor shall develop a formal training and orientation plan that identifies 298 all relevant user groups, personas, and their specific learning needs. 299

• The contractor shall create training materials, including instructor guides, user 300 manuals, quick reference guides (tip sheets), computer-based training, micro-301 learning, and in-application guidance such as tooltips and contextual help directly 302 within the tool (CDRL A002). 303

• The contractor shall identify and train designated "super users" from experienced 304 staff who will participate in testing and provide peer support. 305

• As specified in the task order, the contractor shall establish a dedicated training 306 environment that mirrors production and mimics real-world configuration, 307 workflows, and product interactions to allow hands-on practice. 308

3.3.4.2 Training Delivery 309

• The contractor shall provide qualified instructors to deliver and manage end-to-310 end training for a diverse and geographically dispersed user base. Instruction 311 must be tailored to the specific task order and operational environment, 312 accommodating all echelons of care. To build user confidence in newly deployed 313 products, the training shall incorporate role-based simulations and "day-in-the-314 life" scenarios for users throughout the full continuum of care. 315

• Deliver blended, role-based training for all impacted functional and 316 technical/system admin users that combines various methods like instructor-led 317 training (both virtual and in-person), self-paced e-learning, and hands-on 318 simulations. Training must be tailored to the specific workflows and 319 responsibilities of the user. 320

• The contractor shall manage all end-to-end logistics for training delivery as 321 specified in the task order, including user assignment, scheduling, and tracking. A 322 key component will be conducting "train-the-trainer" sessions to enable 323 government personnel to provide ongoing sustainment training. 324

• Training shall be delivered via multiple methods, including Instructor-Led 325 Training (ILT), Virtual Instructor-Led Training (VILT), Computer-Based 326 Training (CBT), in person support, and self-guided learning. To ensure a smooth 327 transition, the contractor will identify critical user groups to maintain key 328 functions during cutover and provide on-site or virtual support for end-users 329 during and after deployment. 330

• The contractor shall identify a method for tracking user proficiency. As specified 331 in the task order, they will deliver a User Training Completion Report (D007) to 332 measure progress. A final report on all training activities is also required, which 333 will include attendance records, a roster of untrained users, a summary of user 334 feedback, and lessons learned. 335

3.3.5 Adoption and Change Management 336

The contractor shall provide and execute robust user adoption and change management 337 support to facilitate a smooth transition and foster buy-in. The overarching goal is to 338 prepare the organization for change, drive user acceptance and adoption, and demonstrate 339 the realization of measurable value from the newly deployed product(s). The contractor 340 is responsible for the execution of all change management activities to ensure the 341 successful integration of the new product(s) into the organization's daily workflows and 342 culture, leading to high levels of user satisfaction and the realization of the product's 343 intended benefits. 344

3.3.5.1 Change Management and Leadership Engagement 345

• As part of the Deployment Approach (CDRL A003) and Implementation Plan 346 (CDRL A010), develop and execute a comprehensive Change Management and 347 Adoption Plan that outlines the approach for managing the human side of the 348 transition. The contractor shall be responsible for managing all activities outlined 349 in the plan, leveraging proven industry best practices and models for both its 350 development and execution. 351

• Conduct a thorough stakeholder and change impact analysis and use its findings 352 to actively manage stakeholder engagement, mitigate resistance, and adapt to 353 evolving organizational needs throughout the transition. Use readiness surveys to 354 gauge organizational preparedness. 355

• Actively engage Government leadership to secure strong executive and clinical 356 buy-in. The contractors shall lead the effort to empower and equip Government 357 identified physicians and staff champions to take a leadership role in the 358 transition. 359

• Implement and manage a dedicated communication and engagement strategy, as 360 applicable, ensuring consistent and effective communication throughout the task 361 order. 362

3.3.5.2 Communication and End-User Engagement 363

• Design and execute a tailored communication and engagement plan to keep all 364 stakeholders informed, build awareness, and address concerns. 365

• Create, disseminate, and maintain communication products that build awareness 366 of the "why" behind the change, broadcast key project milestones, and celebrate 367 successes to build momentum and positive sentiment. The contractor is 368 responsible for the full lifecycle of these materials. 369

• Actively and continuously manage the engagement of end-users throughout the 370 design, planning, and implementation process, ensuring their feedback is 371 documented and incorporated to create effective workflows. 372

• Design, schedule, and conduct dedicated engagement sessions for supervisors and 373 organizational leaders. The contractor shall develop and deliver leader-specific 374 talking points, FAQs, and coaching materials to equip leaders to champion the 375 change and manage resistance. 376

• Establish, manage, and host regularly scheduled, informal "Office Hours" and 377 open forum sessions (both virtual and in-person) as required by the task order. 378 The contractor is responsible for staffing these sessions and providing immediate, 379 transparent answers. 380

• Facilitate engagement activities (e.g., focus groups, user interviews, direct 381 observation) to assess organizational readiness and identify potential barriers to 382 user acceptance. The contractor shall then analyze these findings to develop and 383 implement targeted interventions (e.g., additional demos, specialized 384 communication) to address identified barriers and ensure all user groups are 385 successfully supported. 386

3.3.5.3 Adoption Measurement and Reinforcement 387

• Implement and manage the tools and processes to monitor product usage and user 388 proficiency post-cutover. The contractor shall define, track, analyze, and report 389 on metrics demonstrating measurable value, user satisfaction, and user 390 acceptance. 391

• The contractor shall be responsible for delivering regular performance reports that 392 analyze Key Performance Indicators (KPIs) tied to operational efficiency (e.g., 393 reduced patient documentation time, improved clinical workflow compliance) and 394 user sentiment. These reports will serve as the primary evidence of a successful 395 change initiative for the task order. 396

• The contractor shall design and conduct user satisfaction surveys and lead after-397 action reviews. The contractor shall then analyze the findings to produce detailed 398 reports with actionable recommendations and lessons learned to guide future 399 deployments and continuous improvement efforts. 400

4. Period of Performance (PoP) 401

The PoP shall be for one (1) base year of 12 months and four (4) 12-month option years. 402

5. Transition-in Period 403

The Transition-in period is 30 days from task order award date. Transition-in 404 performance is defined as the period for the contractor to integrate and provide 405 onboarding activities. During the transition-in period, the contractor shall develop a 406 Transition-in Plan (CDRL A004) and a Staffing Plan (D003) to demonstrate how all 407 contract requirements will be met and ensure incoming personnel are functionally trained 408 and qualified on the full performance start date. Personnel shall be trained and qualified 409 within 30 days. 410

6. Transition-out Period 411

The contractor shall provide information and cooperation to affect an orderly and 412 efficient transition to a successor. The contractor shall develop a Transition-out Plan 413 (CDRL A005) supporting outgoing transition support and provide the plan 60 days prior 414 to the end of the task order. Upon approval of the Transition Plan, the contractor shall 415 commence transition out activities working with the incoming contractor or Government 416 entity. Additionally, the contractor shall provide formal coordination with Government 417 staff and successor staff and management. The Transition Plan shall specify a training 418 program and a date for transferring responsibilities for each division of work described in 419 the plan, including the delivery of all final documentation. The contractor shall provide 420 an adequate number of experienced personnel during the phase-in, phase-out period to 421 ensure that the services called for by this contract are maintained at the required level of 422 proficiency. The Transition Plan shall include, but is not limited to: 423

1. Coordination with Government representatives. 424

2. Review, evaluation, and transition of current support services. 425

3. Turn-in of all Government keys, ID/access cards, and security codes. The 426 contractor shall comply with transition-out requirements of the DHA for 427 contractors who have been issued a CAC or who generate “records”, as defined 428 by DoW (records manual), including DoW-directed disposition of records, and 429 others displayed on the In/Out (I/O) Processing Portal. 430

7. Place of Performance 431

Specific places of performance will be identified in individual task orders issued under 432 the contract. The contractor shall comply with host nation agreements for performance of 433 any work in OCONUS locations and as specified in individual task orders. 434

8. Hours of Operation 435

The contractor must maintain an adequate workforce for the uninterrupted performance 436 of all tasks to be defined within each task order. 437

9. Recognized Federal Holidays 438

Unless otherwise defined in the task order, contractors are not required to perform 439 services on the following holidays: 440

New Year’s Day 441

Martin Luther King Jr.’s Birthday 442

President’s Day 443

Memorial Day 444

Juneteenth Day 445

Independence Day 446

Labor Day 447

Columbus Day 448

Veteran’s Day 449

Thanksgiving Day 450

Christmas Day 451

10. Travel 452

Contractor travel requirements will be defined within each task order. 453

11. Other Direct Costs (ODC) 454

The contractor shall be authorized to bill ODCs as established within the task order. 455 These costs must be preapproved by the COR and include costs applied to the contract, 456 except for the cost of material or labor. The cumulative reimbursable ODC amount shall 457 not exceed the relevant Contract Line Item Number (CLIN) obligated amount. 458

12. Status of Forces Agreements (SOFA) 459

It is possible for some contract activity to occur at OCONUS locations. In the event such 460 support is required, if the country in which contractor support will occur has a SOFA 461 with the United States, it is critical for those designated for travel to receive authority to 462 operate as a contractor for the U.S. Military in those countries. The Government will 463 identify SOFA points of contact (POCs) for any OCONUS location where the contractor 464 will be required to travel. The contractor shall coordinate to understand fully and to 465 complete and submit necessary documents to the SOFA authority for each country where 466 such support is to be scheduled. The contractor shall perform this task not later than 90 467 calendar days prior to any scheduled travel. 468

13. Government Furnished Property (GFP), Equipment, and Services 469

The Requiring Activity Authority has assessed the need for Government Furnished 470 Property, Equipment, and Services as described in the sub-sections below. 471

13.1 Services 472

In general, the Government will not provide Services unless specified in the task order. 473

13.2 Facilities 474

In general, the Government will not provide Facilities unless specified in the task order. 475

13.3 Materials 476

In general, the Government will not provide Materials unless specified in the task order. 477

13.4 Equipment 478

In general, the Government will not provide Equipment unless specified in the task order. 479

13.4.1 Procurement Integrated Enterprise Environment (PIEE), GFP Module 480 Application 481

The contractor shall be responsible for obtaining and maintaining access, training, and 482 successful operation of the PIEE/GFP Module application for the entirety of the task 483 order PoP. The PIEE GFP Module application is located at the following website: 484 https://wawf.eb.mil/piee-landing/. Access to PIEE/GFP Module application training 485 materials and in-depth information applicable to the contractor’s responsibilities 486 regarding GFP can be found at the following website: 487 https://dodprocurementtoolbox.com. 488

Contracting Office Responsibilities: 489

The Contracting Office shall ensure close coordination and validation of the GFP items 490 with the COR and DHA Accountable Property Officer prior to uploading the GFP 491 Attachment into the PIEE/GFP Module. At the time GFP is anticipated and identified, 492 the Government will upload the GFP Attachment into the PIEE/GFP Module. It is the 493 Contracting Office’s responsibility to prepare, upload, and maintain the GFP Attachment 494 in the PIEE/GFP Module in accordance with the GFP Attachment instructions provided 495 at the DoD Procurement Toolbox. The Contracting Officer and COR shall manage and 496 keep an inventory of any GFP associated with contract/task orders awarded through 497 DHA, in accordance with applicable Federal Acquisition Regulation (FAR) Part 45, 498 Revolutionary FAR Overhaul (RFO) Part 45, DoD FAR Supplement (DFARS) 245 with 499 respective clauses, DHA Administrative Instruction (AI) 094 and PD 45-01 following the 500 change in disposition of items listed on that PIEE/GFP Module Attachment. 501

The Contracting Office will also review, acknowledge, reject, and/or approve shipment 502 orders provided by the contractor as appropriate. Functional roles can be determined 503 within the Contracting Office and requested within the PIEE/GFP Module system. 504

Contractor Responsibilities: 505

A key contractor responsibility is to work with the Contracting Officer and COR to 506 ensure the PIEE/GFP Module data, to include the PIEE/GFP Attachment, provides a 507 timely, complete, and accurate accounting of the GFP applicable to the contract/task 508 order. Contractors are required to report the receipt of any GFP shipped to them, 509 regardless of whether it is listed on the GFP Attachment for their contract. Similarly, 510 contractors are required to utilize the GFP Module application in conjunction with the 511 shipment of GFP to the Government, or in reporting Property Loss of GFP issued (such 512 as destruction or loss). Discrepancies or disputes regarding property shipped to or 513 shipped from the contractor must be reported via the GFP Module application, with the 514 Contracting Officer having authority over final designation of status. 515 https://wawf.eb.mil/piee-landing/ https://dodprocurementtoolbox.com/

14. Contractor Furnished Items and Services 516

The contractor shall furnish all supplies, materials, equipment, facilities, and services 517 required to perform work listed in Section 3, Desired Outcomes/Tasks/Objectives of this 518 PWS as specified in the task order. 519

15. Manpower Reporting 520

Contractors shall report “contractor manpower” (including subcontractor manpower) via 521 the internet at www.sam.gov. The contractor shall report annually by October 31, for 522 services performed during the preceding Government fiscal year (October 1 – September 523 30), the amount invoiced for services, the number of hours of contract employees, and 524 any relevant subcontract numbers and hours. 525

16. Data Rights 526

In accordance with the DFARS clauses pertaining to data rights included in this contract 527 (ref. DFARS RFO Class Deviation 2026-O0036 Part 227.4), the Government shall have 528 unlimited rights to all data, documents, and materials produced or delivered in the 529 performance of this contract. These deliverables include, but are not limited to, all 530 analyses, evaluations, models, reports, documents, studies, computer programs, and 531 services developed with Government funding. 532

All materials developed and delivered under this contract are the sole property of the 533 Government. The contractor shall not use, sell, or otherwise distribute these materials for 534 any purpose without the express written permission of the Contracting Officer. 535 Government ownership includes the right to copyright, patent, register, and transfer these 536 rights. This provision does not abrogate any other rights of the Government. 537

For any deliverables that contain or incorporate pre-existing materials not first produced 538 under this contract, the contractor shall grant the Government a nonexclusive, worldwide, 539 royalty-free, irrevocable license to use, reproduce, distribute, prepare derivative works, 540 publicly perform, and publicly display such materials. The contractor warrants that it 541 possesses all necessary intellectual property rights, permissions, and licenses to grant this 542 to the Government. 543

The contractor shall provide prompt written notification to the Contracting Officer of any 544 notice or claim of copyright or patent infringement received by the contractor with 545 respect to any materials delivered or used in the performance of this contract. 546

17. Information Technology and Security 547

Work under this contract may include classified work. Any additional security 548 requirements will be specified under individual task orders. 549

Unless specified in the task order, the Automated Data Processing/Information 550 Technology (ADP/IT) levels and position sensitivity designation for positions under this 551 contract is ADP/IT-II Level (Limited Privileged): Positions in which the contractor is 552 responsible for the direction, planning, design, operation, or maintenance of a computer 553 system, and whose work is technically reviewed at the IT-II Position level by a higher 554 authority to ensure the integrity of the system. Personnel whose duties meet the criteria 555 for an IT-II Position require a FAVORABLY ADJUDICATED TIER III (T3) 556 Background Investigation for Suitability Determination. ADP/IT-II Level positions will 557 not be granted eligibility for SECRET access. 558

17.1 Training 559

Contractor employees performing cybersecurity/cyberspace functions shall comply with 560 the following requirements: 561

• Training: All contractor and associated subcontractor employees working 562 Cybersecurity Information Assurance (IA)/Cyberspace functions must comply 563 with DoW training requirements in Department of Defense Directive (DoDD) 564

8140.01 and DoD Manual (DoDM) 8140.03. Contractors shall identify, 565 document, track, and report qualifications of contractor support personnel who 566 perform cyberspace roles. 567

• Certification: The contractor shall ensure that personnel accessing Information 568 Systems (IS) have the proper and current IA certification to perform IA functions 569 at task order award in accordance with the most current version of DoDM 570 8140.03, “Cyberspace Workforce Qualification and Management Program.” The 571 contractor shall meet the applicable IA certification requirements as outlined in 572 DFARS 252.239-7001, including: 573 o DoW-approved IA workforce certifications appropriate for each category 574 and level as listed in the current version of DoDM 8140.03, “Cyberspace 575 Workforce Qualification and Management Program.” 576 o Appropriate operating system and/or product certification for IA technical 577 positions as required by the most current version of DoDM 8140.03, 578 “Cyberspace Workforce Qualification and Management Program.” 579

Upon request by the Government, the contractor shall provide documentation supporting 580 the IA certification status of personnel performing IA functions. 581

Contractor personnel who do not have proper and current certifications shall be denied 582 access to DoW IS for the purpose of performing IA functions. 583

17.2 Access to Defense Health Agency (DHA) IT 584

All contractor employees that require access to DHA IT must comply with the 585 requirements of DHA-Procedural Instruction 8140.01, Acceptable Use of DHA IT, to 586 include those contract employees with privileged access. 587

17.3 System Authorization Access Request (SAAR), Defense Department (DD) 588 Form 2875 589

The contractor shall submit the most current version of DD Form 2875, “System 590 Authorization Access Request (SAAR), in accordance with the Contracting Officer 591 guidance for all contractors that use the DoW Gateways to access Government IT 592 systems and/or DoW applications. DD Form 2875 shall clearly specify the system and/or 593 application name and justification for access to that system and/or application. 594

The contractor shall submit the completed DD Form 2875 to DHA IT Security for 595 verification of Tier I or Tier II Designation. The DHA Personnel Security will verify that 596 the contractor employee has completed the appropriate background investigation or a 597 request for background investigation has been submitted to the Office of Personnel 598 Management (OPM). Acknowledgement from OPM that the request for a background 599 investigation has been received and that an investigation has been scheduled will be 600 verified by the DHA Personnel Security prior to access being approved. 601

Upon approval, DHA will notify the user of the ID and password via secure/encrypted e-602 mail upon the establishment of a user account. User accounts will be established for 603 individual use and may not be shared by multiple users or for system generated access to 604 any DoW application. Misuse of user accounts by individuals or contractor entities will 605 result in termination of system access for the individual user account. 606

The contractor shall conduct a monthly review of all contractor employees who have 607 been granted access to DoW Information Systems/networks to verify that continued 608 access is required. 609

The contractor shall provide the DHA Privacy and Civil Liberties Office (DPCLO) with a 610 report of the findings of their review by the 10th day of each month following the review. 611 Reports identifying changes to contractor employee access requirements shall include the 612 name, DoW ID number from CAC, Company, IS/network for which access is no longer 613 required and the date access will be terminated. 614

17.4 Cybersecurity Requirements for Non-DoW IT or Covered Contractor 615 Information Systems (IS) 616

The contractor shall, at time of award, have implemented the security requirements 617 prescribed in the National Institute of Standards and Technology (NIST) Special 618 Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal 619 Information Systems and Organizations” (available via the internet at 620 http://dx.doi.org/10.6028/NIST.SP.800-171), in accordance with DFARS clause 252.204-621 7012. 622

NIST SP 800-171 DoD Assessment Methodology. 623

The DFARS RFO clause 252. 240-7997 introduces the “NIST SP 800-171 DoD 624 Assessment Methodology” requirement. This requirement enables a strategic assessment 625 of a contractor’s implementation of the NIST SP 800-171 requirements as required in 626 DFARS clause 252.204-7012. The DoD Assessment Methodology requirement flows 627 down to subcontractors. The contractor shall consider the recommendations for enhanced 628 security requirements prescribed in the NIST SP 800-172, “Enhanced Security 629 Requirements for Protecting Controlled Unclassified Information” (available via the 630 internet at https://doi.org/10.6028/NIST.SP.800-172). 631

Basic Assessment. 632

The contractor shall perform a Basic Assessment, using the NIST SP 800-171 DoD 633 Assessment Scoring Template, and provide the results for each covered contractor 634 information system that is relevant to an offer, call, contract, task order, or delivery order. 635

The contractor shall ensure that applicable subcontractors also have their results of a 636 current assessment posted in the designated government system prior to awarding a 637 subcontract or other contractual instrument in accordance with DFARS clause 252.240-638 7997. 639

The contractor shall provide the Government with access to its facilities, systems, and 640 personnel when necessary to conduct or renew a higher-level (i.e., Medium or High) 641 assessment in accordance with DFARS clause 252.240-7997. 642

Cybersecurity Maturity Model Certification. 643

The contractor shall comply with DFARS RFO Class Deviation 240.371 Cybersecurity 644 Maturity Model Certification. The CMMC (DFARS clause 252.204-7021) builds upon 645 the NIST SP 800-171 DoD Assessment Methodology by adding a comprehensive and 646 scalable certification element to verify the implementation of processes and practices 647 associated with the achievement of a cybersecurity maturity level. The CMMC is 648 designed to increase assurance to the DoW that federal contract information (FCI) and 649 DoW CUI is protected at a level commensurate with the risk. The CMMC requirement 650 flows down to subcontractors. 651

The contractor shall align with the most current CMMC program milestones and prepare 652 to attain an accredited CMMC Third Party Assessment Organization (3PAO) at CMMC 653 Level 2. Once CMMC 2.0 is fully implemented, DoW will only accept CMMC 654 assessments provided by the Government or an authorized and accredited C3PAO or 655 certified CMMC Assessor. In the final phases of the transition to CMMC 2.0 656 assessments will be retroactive, and contractors will need to demonstrate compliance. 657 Additional information on CMMC is available at https://dodcio.defense.gov/CMMC and 658 https://www.cyberab.org/. 659

The contractor shall submit requests to vary from NIST SP 800-171 in writing to the 660 Contracting Officer or COR, for consideration by the DoW Chief Information Officer 661

(CIO). The contractor need not implement any security requirement adjudicated by an 662 authorized representative of the DoW CIO to be non-applicable or to have an alternative, 663 but equally effective, security measure that may be implemented in its place. 664

If the DoW CIO has previously adjudicated the contractor’s requests indicating that a 665 requirement is not applicable or that an alternative security measure is equally effective, a 666 copy of that approval shall be provided to the Contracting…