FINAL PWS_Amendment 0001.docx

Department of Defense Defense Health Agency Performance Work Statement

Continued Readiness Program and Life Safety Assessment

Naval Hospital Jacksonville

Facilities Management Department

Date: 25 March 2026

PART 1

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide Continued Readiness Program and Life Safety Assessment services for the Environment of Care (EOC) Program in support of the Facilities Management Department at Naval Hospital Jacksonville (NHJAX), Florida.

1.2 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform the Continued Readiness Program and Life Safety Assessment as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this PWS.

1.3 Background: This requirement is to provide Continued Readiness Program and Life Safety Assessment services for the Environment of Care (EOC) program. The EOC program is responsible for ensuring that the Facilities Management Department at NHJAX is implementing and maintaining its safety management system to promote safety, a culture of safety and other initiatives, to include cleanliness and maintenance, designed to reduce mishap trends and cost on behalf of patients and staff safety at the military treatment facility (MTF) in accordance with (IAW) the Joint Commission and National Fire Protection Association (NFPA) 101 Life Safety Code 2024 (or current adopted edition). The EOC program verifies updated standards are identified and correctly implemented and creates a learning environment to ensure the hospital staff remains prepared at all times for an audit or inspection at any level.

1.4 Objectives: To provide Continued Readiness Program and Life Safety Assessment services for NHJAX by reviewing processes and reporting deficiencies on the following Environment of Care components:

· Safety

· Security

· Fire Safety

· Hazardous Materials and Waste

· Medical Equipment

· Utilities Management

· Emergency Management

1.5 Scope: The contractor shall provide Continued Readiness Program (CRP) services and Life Safety Assessment services that consists of a comprehensive and multiple audit process for the Environment of Care (EOC) Program. The contractor shall conduct an in-depth inspection of the MTF’s safety management system to ensure that process’ and outcomes are in accordance with the Joint Commission Audit standards. The contractor shall use the Joint Commission Audit standards as the measuring tool for assessing Environment of Care Committee (EOCC) plan managers’ current knowledge level of all Safety (SA), Security (SE), Fire Safety (FS), Hazardous Materials (HM), Medical Equipment (ME), Utilities Management and Fire Safety Elements of Performance, and Emergency Management. Services shall include the inspection and assessment of all Environment of Care related items, Life Safety standards and Emergency Management processes. The contractor shall conduct compliance verification of EC records and documents, to include all Safety Management Plans, Risk Assessments, audits, annual evaluations, environment of care (EOC), emergency management (EM), and life safety (LS) reporting and committee activities for the development of performance improvement plans. The contractor shall accomplish identifying strengths and weaknesses within the MTF’s processes and take the opportunity to teach the MTF staff on processes needing performance improvement.

The Contractor shall conduct four (4) scheduled on-site visits per year. On-site visits shall be conducted on a quarterly basis with each visit being conducted over a four (4) day period for a total of sixteen (16) on-site days per year.

The contractor shall provide an updated set of Life Safety drawings and comprehensive Statement of Conditions assessment to determine compliance with NFPA 101 Life Safety Code 2024 (or current adopted edition).

1.6 Period of Performance (PoP): The Period of Performance (PoP) consists of a base period of twelve (12) months with four (4) 12-month option periods, and the potential to extend services for an additional six (6) months in accordance with FAR 52.217-8, Option to Extend Services, if exercised.

1.7 Administrative specifications:

1.7.1 Place of performance: The work shall be performed at Naval Hospital Jacksonville, Building 2080 Child St., Jacksonville, FL 32214.

1.7.2 Recognized Federal holidays: Contractor is not required to perform services on Federal holidays.

Independence Day

1.7.3 Hours of operation: The contractor is responsible for conducting business Monday through Friday, except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. Work shall be performed during the core business hours of 0700 hours through 1600 hours, Monday through Friday.

1.8 Reserved.

1.9 Reserved.

1.10 Quality

1.10.1 Quality Control (QC): The contractor shall develop and maintain an effective QC program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The contractor’s QC program is the means by which the work complies with stated requirements. The contractor shall submit the OC program to the COR for acceptance no later than 30 days after contract award. The COR will notify the contractor of acceptance or required modifications to the plan within 30 days of receiving the QC program. The contractor shall make appropriate modifications and obtain acceptance of the QC program by the COR within 15 days. A comprehensive written QC program shall be submitted to the CO and COR within 5 working days when changes are made thereafter. After acceptance of the Quality Control Plan (QCP) the contractor shall receive the CO’s acceptance in writing of any proposed change to his QC system. Any changes to the QC plan shall be submitted and approved in 10 business days.

The QC program shall include the following:

· A description of the audits and inspections of the safety management system to cover all services listed in the PWS. Description shall include specifics as to the areas to be surveyed and inspected on a scheduled quarterly basis, and the title and organizational placement of the assessment inspectors. Additionally, control procedures for any Government provided keys or lock combination should be included.

· A description of the methods to be used for identifying strengths and weaknesses and preventing mishaps in the quality of service performed.

· A description of the records to be kept to document audits, surveys, inspections and recommended performance improvement plans (actions taken) to ensure compliance with the Joint Commission and NFPA 101 Life Safety Code 2024 (or current adopted edition).

· All records of comprehensive audits, inspections, surveys, etc., shall be retained and made available to the Government upon request throughout the contract period of performance, and for the period after contract completion until final settlement of any claims under this contract.

List of Research WEB sites that may be needed in reference to DOD, DHA, and other Instructions/Memos:

DoD 8570.01-M: http://www.dtic.mil/whs/directives/corres/pdf/857001m.pdf

ADA Section 508: http://www.ada.gov/2010_regs.htm

The Joint Commission: https://www.jointcommission.org/

NFPA 101 Life Safety Code 2024: https://www.nfpa.org/codes-and-standards/nfpa-101-standard-development/101

1.10.2 Quality assurance (QA): The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.11 Contractor Personnel:

1.11.1 All contractor personnel requiring admission onto base must coordinate a date and time with the Facilities Management Department at NHJAX to have a pass issued.

1.11.2 All contractor personnel requiring access to the base must present a valid driver’s license, vehicle registration and vehicle insurance to visitor’s center to obtain a daily pass to the base.

1.11.3 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.14 Reporting

1.14.1 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.15 Contractor Identification:

1.15.1 Contractor personnel performing services in a contractor capacity in a Government facility shall possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings. The contractor shall answer all telephone calls and have a personalized voice message with an introductory statement that identifies the person is contractor support personnel. Include a title block in all emails that states the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is contractor support personnel.

1.15.2 Contractor personnel are required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order. Contractor personnel shall make their contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.15.4 Contractor personnel requiring access to the military base and Government facility must adhere to all applicable base regulations, policies, and procedures, to include showing proper identification, observing and complying with safety standards and security protocols while on Government property.

1.16 Personnel Security:

1.16.1 The contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce Improvement Program, CH4” November 10, 2015 as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM 5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE

PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D-Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R-Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: A contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.2 Acronyms:

2.3 Applicable Publications, DHA Administrative Instructions (AI), etc.:

2.3.1 DoD Instruction 6025.13, “Medical Quality Assurance and Clinical Quality Management in the Military Health System.” July 26, 2023. Change 1 effective May 23, 2025. https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/602513p.PDF?ver=IRKjS0kVT_XVFmImo__jUA%3d%3d

2.3.2 National Fire Protection Association Code “National Fire Protection Agency (NFPA) Life Safety Code® (LSC) (NFPA 101),” 2021. https://www.nfpa.org/codes-and-standards/nfpa-101-standard-development/101

2.3.3 UFC 4-510-01, 03 February 2023, Change 4, 15 July 2025. https://www.wbdg.org/FFC/DOD/UFC/ufc_4_510_01_2023_c4.pdf

2.3.4 DHA-Procedures Manual 4140.0, Accreditation and Certification Compliance Management for Defense Health Agency-Assigned Facilities. Government will provide after contract award.

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government:

☒ Will NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Government Furnished Services required in support of this contract/task orders. These Services are described below: provide

3.2 Facilities: The Government:

☐ Will NOT provide Facilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Facilities in support of this contract/task orders. The Government provided Facilities are described below: Naval Hospital Jacksonville (NHJAX), Building 2080 Child St., Jacksonville, FL 32214. The Government will provide the following:

(a) Life Safety CAD drawings for interior partitions layouts and room numbers. Drawings shall include notations of fire rated walls and smoke partitions.

(b) Timely access to all spaces to be surveyed, with appropriate keys, letters of introductions, security identification badges, and any other means required for contractor’s access.

(c) If necessary, remove key tiles for above-ceiling inspections and provide ladder.

3.3 Utilities: The Government:

☒ Will NOT provide Utilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Utilities in support of this contract/task orders. The Government provided Utilities are described below:

3.4 Equipment: The Government:

☐ Will NOT provide Equipment in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Equipment in support of this contract/task orders. The Government provided Equipment is described below:

The Government will provide office space and loaned office supplies (e.g., paper, pens, etc.) for the contractor staff that are required to be physically present during on-site visits at the facilities. Contractor staff working on-site will be provided a loaned desktop or laptop computer. All equipment (i.e., desktop/laptop computers) and office supplies loaned to the contractor staff shall be returned to the Government upon to exiting the facilities.

3.5 Materials: The Government:

☒ Will NOT provide Materials in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ IS providing Materials in support of this contract/task orders. The Government-provided Materials are described below.

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 Services: The Contractor:

☐ Will NOT provide Contractor Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Contractor Furnished Services required in support of this contract/task orders. These Services are described below: As listed in this PWS.

4.2 General: The contractor shall furnish all supplies, equipment, facilities and services required to perform work listed under Section 5 of this PWS.

4.3 Secret Facility Clearance: N/A

4.3.1 Facilities: The contractor shall provide all facilities, space, equipment, supplies and services required to perform work in accordance with this PWS, other than the Government furnished property, equipment, and services listed in Part 3 of this PWS

PART 5

5.0 SPECIFIC TASKS

5.1 CONTINUED READINESS PROGRAM (CRP) SUPPORT AND LIFE SAFETY ASSESSMENT SERVICES

5.1.1 CONTINUED READINESS PROGRAM SUPPORT

The contractor shall provide Continued Readiness Program (CRP) and Life Safety Assessment Services for the Environment of Care (EOC) Program in support of the Facilities Department at Naval Hospital, Jacksonville (NHJAX).

The contractor shall conduct CRP support services that consists of an on-site life safety survey and comprehensive and multiple audit process for the Environment of Care (EOC) Program. During the base period and each option period, conduct support of one site visit per quarter conducted over a consecutive four (4) day period for a total of sixteen (16) on-site days per period of performance. Contractor shall coordinate with COR at the beginning of each quarter to schedule site visits.

On-site visits shall include a comprehensive review of all Safety (SA), Security (SE), Fire Safety (FS), Hazardous Materials and Waste (HM), Medical Equipment (ME), Utilities Management and Fire Safety Elements of Performance, as well as Emergency Management via compliance verification of records and documents (including all Management Plans, Risk Assessments, Annual Evaluation, EOC/LS/EM Reporting and Committee Activities, Performance Improvement Plans, etc.).

The Contractor shall perform the following tasks:

a. Compliance Verification of Records and Documents:

5.1.2 Site Assessments:

The contractor shall provide four (4) scheduled on-site visits per year. On-site visits shall be conducted on a quarterly basis with each on-site visit being conducted over a consecutive four (4) day period for a total of sixteen (16) on-site days per year. Exact dates of on-site shall be scheduled with the Facilities Management Department point of contact (POC) at NHJAX prior to and following each on-site visit. Each scheduled on-site visit shall include a physical site evaluation consisting of random staff challenges in mock survey fashion combined with a hazard surveillance tour (inspecting facility for potential hazards and problems that do not align with Joint Commission standards), as well as following up on any issues noted on previous safety assessment surveys. For the base period, the site will provide contractor with a copy of the last safety assessment survey to familiarize themselves with current issues.

The site assessment shall include:

(a) Review key EOC/LS/EM records and documents (e.g. Management Plans, Annual Evaluations, EOC Committee meetings minutes, Performance Measures, etc.)

(b) Random Records Review – examine a random selection of Performance Measures, Hazard Surveillance rounds, Security Records, Training documentation, etc.

(c) Perform physical site evaluations and risk assessment – the contractor shall tour the facility during each visit, performing visual inspections and conducting random “staff challenges” (in mock survey fashion) to ask safety response questions.

(d) Assist in EOC/LS/EM program development (discuss recent changes and anything new in the field) and maintenance (surveyor reviews EM or LS) with safety manager and emergency manager and provide education (anything that has changed, or rules, requirements on what the Joint Commission Surveyor is looking for) throughout the survey to assist NHJAX staff better understand the EOC/LS/EM process and requirements.

(e) Perform life safety walk-through of Buildings 2080 and 2034 to assess physical readiness (review of smoke barriers, rated walls, rated door assemblies, etc.)

(f) Provide a written report submitted in PDF format after each visit to facility manager within 14 calendar days of completion of site visit.

(g) Provide follow-up on previously noted deficiencies

(h) Provide any updates to Joint Commission – EOC/LS/EM informational updates, and other regulatory updates.

(i) Provide telephone support & guidance during the actual survey.

5.1.3 Comprehensive Statement of Conditions Assessment and Compliance Document:

5.1.3.1 During the contract period of performances where The Joint Commission (TJC) does not visit NH JAX, TJC requires completion of a Statement of Conditions compliance document to certify NH JAX’s compliance with NFPA 101 standards.

5.1.3.2 The contractor shall conduct a Comprehensive Statement of Conditions during each period of performance, except the period in which the TJC performs their visit of MTF (Building 2080) to assess compliance with NFPA 101 Life Safety Code 2024 (or current adopted edition), as prescribed by The Joint Commission Statement of Conditions Compliance Document. The Comprehensive Statement of Conditions document shall be completed either remotely or while the contractor is onsite for a quarterly site visit accessed on the Joint Commission’s online portal. Building 2080 is mixed occupancy that consists of a Hospital Health Care occupancy and an adjacent connected Out-Patient Clinic Business Occupancy. Building 2080 consists of 436,323 square feet; the hospital portion includes 8 floors and the out-patient clinic includes 2 floors. The split between clinical and non-clinical spaces are 70% clinical and 30% non-clinical.

5.1.3.3 The Comprehensive Statement of Conditions Assessment shall be visual in nature and document all penetrations along two (2) hour walls, one (1) hour walls, smoke barriers and corridor walls.

5.1.3.4 The Joint Commission Statement of Conditions Compliance document is due to the COR within 2 weeks of the Comprehensive Statement of Conditions Assessment.

5.1.3.5 Comprehensive touring for the Statement of Conditions shall be conducted during quarterly onsite Continued Readiness Program Visits.

5.1.4 Set of Life Safety Drawings: The contractor shall update the set of Life Safety Drawings two times per year during each period of performance. The contractor shall coordinate with the facility manager to determine dates. Performance of this task requires access to areas of the MTF during normal working hours (0700 – 1600) in order to perform the evaluation (i.e., areas such as the operating rooms, sterile processing, inpatient rooms and outpatient clinics, etc.).

The updated set of Life Safety drawings shall be in accordance with NFPA 101 Life Safety Code 2024 (or current adopted edition). A set of drawings includes the entire facility (all floors) of building 2080 (hospital) and building 2034 (substance abuse rehab facility). Draft Life Safety Drawings shall be delivered to the facility manager within two (2) months after request by COR facility manager. The Government will provide corrective remarks within two (2) weeks of receiving the draft drawings. Final revised drawings addressing the Governments remarks shall be returned within two (2 weeks).

The following features shall be shown on individual layers:

(a) Utilizing the current adopted NFPA version (currently NFPA 101 2021), the drawings shall define occupancy types with associated areas and include a legend showing compliance with suite and compartment rules. The following features shall be shown on individual layers:

(1) Fire/Smoke Barrier Locations

(2) Smoke Compartments

(3) Distance to Exits

(4) Horizontal Exits

(5) Stairwell Exits

(6) Areas under construction

(7) Compartment ID

(8) Occupancy Type

(9) Compartment / Suite Square Footage

(10) Distance to smoke barriers

(11) Suites

(12) Hazard area locations

5.1.5 Develop Plan for Improvement: Upon completion of the Statement of Conditions assessment, the Contractor shall work with the EOC Program to develop a Plan for Improvement (PFI) consisting of PFI groups and Lists of Deficiency by type or category. For each deficiency, a unique identifier for tracking purposes and the specific location shall be provided. The PFI resolution section shall provide a description of the proposed plan for improvement action, to include placement for the assessor’s name/in-house personnel name, relevant dates of actions to be completed by the facility, and estimated cost to repair the deficiencies.

5.1.5.1 Contractor shall provide one (1) complete set of documentation in electronic format, which includes:

(a) One (1) copy of the Life Safety Plan drawings in 11” x 17” format

(b) One (1) copy of the Detailed Deficiency report with preliminary repair cost estimates

(c) One (1) copy of the Plan for Improvement (PFI) in Excel format

5.1.6 Telephone Support During Joint Commission Inspection/Survey: The contractor shall be available by telephone during business hours during the Joint Commission inspection/survey in order to respond to facility manager questions that may arise. The Joint Commission inspection/survey is expected to be scheduled during Option Period one (1) or Option Period two (2). Inspections usually occur during the summer over a one-week period.

5.2 Special Qualifications: The contractor must have experience working with the NFPA 101 Life Safety Code 2024 and The Joint Commission (TJC), specifically relating to working with the Environment of Care (EOC) standards. The contractor’s assessment team shall be considered experts in this area, and as such shall be called upon to provide expert continued readiness program and life safety assessment services within these standards and must be able to address the other TJC standards as they relate to the EOC standards. The majority of the contractor’s assessment team supporting this contract shall have, at a minimum, four (4) years of experience working with TJC standards and the Life Safety Code.

PART 6

6.0 INFORMATION TECHNOLOGY & SECURITY

6.1 All work under this contract is unclassified.

6.2 The TIER 1 or TIER 2 levels and position sensitivity designation for positions under this contract is:

6.2.1 TIER II: Non-critical sensitive position.

6.3 Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal information requirements: DoD Privacy Program Issuances means the current DoD issuances implementing within DoD the Privacy Act and certain privacy-related authorities, as identified by DHA Privacy Office Guidance. These issuances are DoDI 5400.11, “DoD Privacy and Civil Liberties Programs,” January 29, 2019, DoDM 5400.11, Volume 2 “DoD Privacy and Civil Liberties Programs: Breach Preparedness and Response Plan.” May 6, 2021, and DoD 5400.11-R, “Department of Defense Privacy Program,” May 14, 2007, and Attachment 2 DHA Procedures, Guidance and Information 224.90, Personally Identifiable Information (PII), PHI), and Federal Information Requirement; DHA Administrative Instruction-110, Safeguarding Procurement Sensitive Information). These issuances are available on the Washington Headquarters Services DoD Directives website (https://www.esd.whs.mil/DD/) or upon request.

6.3.1. Data Sharing Agreements (DSAs): Contractors requiring access to PII, which includes PHI, or access to de-identified data, are subject to the DHA Privacy and Civil Liberties Office (DPCLO) (Privacy Office) Data Sharing Program. This program requires DHA to enter into DSAs with parties outside the MHS who use or create MHS data. A DHA contract may use the term Data Use Agreement (DUA) rather than DSA. DSAs assure that outside parties protect MHS data in accordance with the Privacy Act and the HIPAA Rules. To apply for a DSA, the contractor submits a Data Sharing Agreement Application (DSAA) to the DHA DPCLO. The contractor submits the DSAA even if a subcontractor will be the party accessing MHS data. After review and approval of the DSAA, the Privacy Office provides a DSA to the contractor for execution.

6.3.2. Processing Procurement Sensitive Information: All individuals shall seek guidance from the CO regarding the coordination of documents, dissemination, and transmission of procurement sensitive information. Procurement sensitive information shall not be transmitted electronically unless encryption is utilized. Depending on a particular procurement, other restrictions may apply.

6.4 Training: N/A.

6.5 Cybersecurity Requirements for Non-DoD IT or Covered Contractor IS: Reserved.

6.6 Risk Management Framework (RMF) for DoD IT: All IS, Platform Information Technology (PIT) and IT Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with DoDI 8510.01, Risk Management Framework (RMF) for DoD IT and comply with annual Federal Information Security Modernization Act (FISMA) security control testing. IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the NIST SP 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

6.6.1 All systems subject to RMF must present evidence of authorization in the System Security Plan, Security Assessment Report) a Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has a DoD RMF or equivalent DoD Component PIT system accreditation decision that is current within 3 years within 5 business days of CO request. Evidence of FISMA compliance must be presented in the form of a POA&M. Systems must have and maintain an Authority to Operate (ATO) or Authority to Operate with Conditions (ATO-C) by contract award.

6.6.2 The contractor shall implement security controls in accordance with NIST implementation and validation requirements specified in the NIST SP 800-37 Risk Management Framework (RMF) and DoDI 8510.01, Risk Management Framework (RMF).

6.6.3 The contractor shall configure the information system in accordance with Defense Information Agency (DISA) Security Requirements Guides (SRGs) and security technical implementation guides (STIGs).

6.6.4 The contractor shall ensure that the information system conforms to the requirements of DoDI 8551.01 “Ports, Protocols, and Services Management (PPSM)”.

6.6.5 The contractor shall ensure that the information system shall authenticate all entities as specified in DoDI 8520.03 “Identity Authentication for Information Systems” prior to granting access.

6.6.6 The contractor shall Public Key (PK) enable the information system, implementing digital signature and encryption requirements specified in DoDI 8520.02, “Public Key Infrastructure (PKI) and Public Key (PK) Enabling”.

6.6.7 The contractor will be responsible for compliance with the Joint Force Head Quarters – Department of Defense Information Network issuances and IA Vulnerability Management (IAVM) issuances by ensuring that the issuances are assessed, implemented and maintained throughout development and sustainment in accordance with specified timelines.

6.6.8 The contractor shall support reciprocity, by providing all directed information in NIST security documents to the government.

6.6.9 The contractor shall implement system level protection and detection capabilities that are consistent with their contract for NIST Security requirements that meet DoD and DHA Cybersecurity Architectures.

6.6.10 Cyber Incident Reporting Requirement: The contractor shall comply with the incident management requirements of Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B, “Cyber Incident Handling Program”.

6.6.11 Information security continuous monitoring (ISCM): ISCM is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. ISCM is a critical part of the risk management process to ensure that IS and PIT operations remain within an acceptable level of risk despite any changes that occur. The Contractor shall maintain ongoing monitoring, analysis and incident response procedures for all ARRT and PIT systems under this requirement in accordance with NIST SP 800-137.

6.6.12 The contractor shall mitigate supply chain risk to the government by complying with DFARS 252.239-7018 and only utilizing unified capability equipment identified on the DODIN Unified Capabilities Approved Products List (https://aplits.disa.mil/processAPList), unless granted a waiver in accordance with DODI 8100.04, DOD Unified Capabilities (UC).

6.7 Facility Related Control Systems: Reserved.

6.7.1 Post Award Requirements: Reserved.

6.7.2 Cybersecurity Requirements/Continuous Monitoring/Risk Management

6.7.3 Utilizing a test/laboratory environment, the contractor shall be able to duplicate all fielded equipment/product that falls under the authorization boundary. The contractor shall maintain the system or device in an operational condition with the latest security patches installed.

6.7.4 The contractor shall ensure that all fielded equipment/product falling under one authorization is tested to maintain the ATO or approved. For each version owned by DHA and originally purchased through the contractor’s contract, the contractor will ensure that each component within the authorization boundary is represented in the test/laboratory group.

6.7.5 The contractor shall maintain continually monitor the authorized security configuration and notify the government within forty-eight (48) hours of any new vulnerabilities discovered either in the laboratory or production environments.

6.7.6 The contractor shall test all IAVAs, patches, updates, and upgrades in the test/laboratory environment before implementing in a production environment. All production environment IAVAs, patches, updates, and upgrades will be approved by the MTF’s Change Control Board prior to contractor implementation. Approved changes shall be implemented on a quarterly basis.

6.7.7 The contractor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to Government for approval.

6.7.8 The contractor shall ensure the contractor’s device or system is in compliance with the DoD IAVM program upon each additional deployment.

6.7.9 The contractor shall monitor the public DoD Cyber Exchange website for new or updated STIGs. The contractor shall implement updated STIG compliance for systems or devices within three (3) months of their availability on the DoD Cyber Exchange.

6.7.10 A major upgrade such as major software or hardware revision must be reassessed for ATO or addition to the APL. Minor upgrades must be assessed by the Government to determine if a reauthorization is required. The contractor shall support reauthorizations due to both major and minor upgrades.

6.7.11 The contractor shall update all ATO or approved products required supporting documentation in the event of a system policy, procedural, logical or technical changes to the system or device.

6.7.12 The contractor shall provide vulnerability and configuration scan results of the test/laboratory environment to the Government on a quarterly basis. The contractor shall provide raw scan results and administrative reports no later than ten (10) days after a request from the Government POC.

6.7.13 The contractor shall close all discovered vulnerabilities within three (3) months of discovery or provide a POA&M describing how they will work to close the vulnerability.

6.7.14 The contractor shall submit to the Government for approval, all mitigation plans that address any open vulnerabilities.

6.7.15 The contractor shall ensure any new deployment (including rebuilds) deploy with a fully patched, accredited version maintained in a lab environment.

6.7.16 The contractor shall make the test/laboratory system available for periodic security reviews, within forty-five (45) business days of notification by Government. The contractor shall perform monthly vulnerability scans using the most recent and updated version of approved DoD scan tools.

6.8 Systems Communications: Reserved.

6.9 Reserved.

6.10 Reserved.

6.11 System Authorization Access Request (SAAR), Defense Department (DD) Form 2875: Reserved.

6.12 Reserved.

6.13 Reserved.

6.14 Contractors Located On Military Installations: Reserved.

PART 7

7.0 ATTACHMENTS/TECHNICAL EXHIBIT LISTING

PART 7, ATTACHMENT 1

PERFORMANCE REQUIREMENTS SUMMARY

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Performance Objective

Performance Requirements Summary (PRS) # 1 The contractor shall provide 4 Site Assessments per year, consisting of 4 days per visit.

PRS # 2

The contractor shall provide a written report within 14 days of each site assessment.

PRS # 3

The contractor shall provide updated Life Safety Drawings within 2 months of request by COR.

PART 7, ATTACHMENT 2

DELIVERABLES SCHEDULE

image1.png