HT941023Q2043_DHA PWS_NHCP_Urgent_IV Hood.pdf

DHA PWS Template V13

November 16, 2021

Department of Defense

Defense Health Agency

Performance Work Statement

Procurement, Delivery, Training and Installation of Three (3) IV Hood for Inpatient Pharmacy

Directorate of Clinical Support Services (DCSS)

Pharmacy Department, NMRTC Camp Pendleton

PART 1

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide procurement, delivery, training and installation of three (3) IV Hood for Inpatient Pharmacy, NMRTC Camp Pendleton.

1.2 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform delivery and installation (including training) of three

(3) IV Hood for Inpatient Pharmacy as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this PWS.

1.3 Background: Inpatient Pharmacy have two (2) IV Horizontal Laminar Flow Hood – for sterile compounding of IV Medications and one (1) Class 2 Biosafety Cabinet Chemo Hood – for sterile preparation of chemo medications, that were purchased in Oct 2013 with a life expectancy of ten (10) years, which warranted replacement, hence, this procurement request. The fulfillment of this requirement MUST be in compliance with USP 800 and the attached recommendations from DHA inspections.

1.4 Objectives: Inpatient Pharmacy requests procurement, delivery, installation and training of three IV Hood, in strict compliance with USP 800, with corresponding accessories listed below:

November 16, 2021

1) One (1) Class 2 Biosafety Cabinet for Chemo Compounding Hood (Labguard NU-543-

400UB10) with the following required additions:

a) One (1) IV Bar (NU-4M262) with 6 hooks and 3 height locations for 4 feet

b) One (1) Motorized Based Stand (NU-500-130) for 4FT Hood, Casters

c) One (1) 10 IN Diameter Fixed Range Transition Canopy (NU-916-406)

d) One (1) Flex Duct Kit (NU-940-004)

2) Two (2) Horizontal Laminar Flow Workstation for IV Compounding Hood (NU-240-

430US1) with the following required additions:

a) Two (2) IV Bar with 6 Hooks and 3 height locations, 4FT

b) Two (2) Motorized Based Stand (NU-200-153) for 4FT, Casters

3) Delivery and Freight Charges

4) Installation

5) Training

6) Five (5) Year Parts and Labor Warranty

1.5 Scope: The contractor shall provide the following required services:

1) Shipment and Delivery of three (3) IV Hood and all necessary accessories as listed in the priced quote and/or description aforementioned in (1.4).

2) Installation and Training

3) Five (5) Year Parts and Labor Warranty

1.6 Period of Performance (PoP): Not Applicable

1.6.1 Transition: Transition-in/transition-out period - Not Applicable

1.7 Administrative specifications

1.7.1 Place of performance: The work – installation, final delivery and training, shall be performed in IV Room, Inpatient Pharmacy inside Room 1412 Main Pharmacy located at Naval

Hospital Camp Pendleton at Bldg H-200 Mercy Circle, Camp Pendleton, CA 92055.

1.7.2 Recognized Federal holidays: The contractor shall NOT perform services on holidays listed below:

New Year’s Day Labor Day

Martin Luther King Jr.’s Birthday Columbus Day

President’s Day Veteran’s Day

Memorial Day Thanksgiving Day

Juneteenth Day Christmas Day

Independence Day

1.7.3 Hours of operation: The contractor is responsible for conducting business Monday thru

Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.7.4 Emergency Services:. Not Applicable

1.8 Contractor travel: As Applicable/listed in the requirement listed herein and/or the attached price quote - Contractor shall be authorized travel expenses consistent with the cost principles and procedures in Federal Acquisition Regulation (FAR) Part 31.2, Travel Costs and the limitations of funds specified in this contract. All travel requires Government approval/authorization and notification to the Contracting Officer Representative (COR).

1.9 Other Direct Costs (ODC): Not Applicable

1.10 Quality

1.10.1 Quality Control (QC): The contractor shall develop and maintain an effective QC program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The contractor’s QC program is the means by which the work complies with stated requirements. After acceptance of the Quality Control Plan (QCP) the contractor shall receive the CO’s acceptance in writing of any proposed change to his QC system.

1.10.2 Quality assurance (QA): The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.11 Contractor personnel

1.11.1 CAC requirements: For all contractors who will work in Government facilities, the

Facilities Security Officer (FSO)/Company's Security point of contact (POC) will provide the

Government all the required information per the DHA CAC request process current version 2.1, January 2018, or more recent when updated. See process attached at Part 7 Section 7.1.1 of the

PWS. A CAC is the standard identification for eligible DoD contractor personnel.

1.11.1.1 The contractor shall return all CACs to the COR upon the departure of the contractor(s).

1.11.2 Contractor onboarding and training. The contractor shall complete all requirements, training, and forms as prescribed in the following requirements:

1.11.2.1 The DHA’s “Onboarding Checklist for Contractor Employees” is located at the DHA

Onboarding and Offboarding Portal at:

https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx

1.11.2.2 The DHA’s contractor training instructions embedded at Part 7 Section 7.1.2.

(Government (DHA) requirements development staff must cut/paste onboarding checklist at https://info.health.mil/sites/DOP/OnboardingCtr/Contractor_OnBoarding_Checklist.pdf and embed most up-to-date form in Part 7, Section 7.1.2.)

1.11.2.3 The contractor shall comply with onboarding requirements of the DHA for contractors needing to be issued CAC identification, including DoD- and DHA-directed training and forms submission, prior to network access, as displayed in the In/Out-Processing Portal at:

https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx (note: Public Key Infrastructure

(PKI)-restricted, printed versions available).

1.11.2.4 The DHA’s new employee handbook at Part 7 Section 7.1.4. Not Applicable

1.11.3 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.11.4 Key control: Not Applicable

1.11.5 Lock combinations: Not Applicable

1.13 Data rights: N/A

1.14 Reporting

1.14.1 Contractor Manpower Reporting (CMR): RESERVED.

1.14.2 Non-Disclosure Agreement (NDA): All contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA contractor NDA (DHA Form 49) prior to beginning work on the subject contract. The contractor shall execute an NDA on behalf of the company and shall ensure that all staff assigned to, including all subcontractors and consultants, or other personnel performing on contract/Task order execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other contractors. The NDA shall be executed not later than first day of employment and to be renewed upon exercising a contract option period. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the contractor. The contractor shall maintain originally signed NDAs of individual employees and provide copy to the COR.

1.14.3 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx https://info.health.mil/sites/DOP/OnboardingCtr/Contractor_OnBoarding_Checklist.pdf https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx

November 16, 2021 that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.14.4 Post award conference/periodic progress meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance.

At these meetings the CO will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Deputy

Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings. The contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is contractor support personnel.

Include a title block in all emails that states the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is contractor support personnel.

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with

Government and/or other contract representatives to meet the requirements of this order.

Contractor personnel shall make their contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16 Contractor Access to Health Affairs (HA)/DHA Network(s)

1.16.1 FSO/Company's Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system (If applicable, if not delete 1.16.1

November 16, 2021 and 1.16.2 and replace to 1.16 Reserved). Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and the security awareness training. The contractor shall be prepared for this process as it could take two (2) or more weeks. The FSO/Security POC shall submit a Standard Form (SF) 85/86 to DHA's

Personnel Security Office for a background investigation.

1.16.2 Company's FSO/Security POC must notify the Personnel Security Office when the contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the

DHA Personnel Security Office in writing of a contractor's termination from the contract, including the termination date.

1.17 Personnel Security

1.17.1 The contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce

Improvement Program, CH4” November 10, 2015 as amended; 8500.01, “Cybersecurity”, dated

March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance

Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care

Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA

Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM

5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.17.1.1 Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security

Office can be reached at (703) 275-6038.

1.17.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.17.1.3 DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing off on any access request.

November 16, 2021

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE

PUBLICATIONS/INSTRUCTIONS

2.1 Definitions: Not Applicable

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D-

Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R-

Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The

Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the

Government’s plan.

2.2 Acronyms: As Applicable/listed in the requirement listed herein and/or the attached price quote :

AIS Automated Information System

APL Approved Products List APL

AQL Acceptable Quality Level

ARRT Acquisition Requirements Roadmap Tool

ATO Authority to Operate

B2B Business-2-Business

CAC Common Access Card

CAP Cloud Access Point

CCEVS Common Criteria Cybersecurity Evaluation and Validation Scheme

CDI Covered Defense Information

CE Computer Environment

November 16, 2021

CDRL Contract Data Requirement List

CIO Chief Information Officer

CJCSM Chairman of the Joint Chiefs of Staff Manual

CMMC Cybersecurity Maturity Model Certification

CMR Contractor Manpower Reporting

CNSSI Committee on National Security Systems Instruction

CO Contracting Officer(s)

CONUS Continental United States (excludes Alaska and Hawaii)

COR Contracting Officer Representative

COTR Contracting Officer's Technical Representative

CSP Cloud Service Provider

CSSP Cyber Security Service Provider

CUI Controlled Unclassified Information

DAD-A Deputy Assistant Director for Acquisition

DC3 DoD Cyber Crime Center

DD Form 254 Department of Defense Contract Security Requirement List (if applicable)

DB Design-Build

DBB Design-Bid-Build

DFARS Defense Federal Acquisition Regulation Supplement

DHA Defense Health Agency

DISA Defense Information System Agency

DoD Department of Defense

DoDD Department of Defense Directive

DoDI Department of Defense Instruction

DSAs Data Sharing Agreements

DSAA Data Sharing Agreement Application

DMZ Demilitarized Zone

DoDM Department of Defense Manual

DPCLO DHA Privacy and Civil Liberties Office

DUA Data Use Agreement eMSM Enhanced Multi-Service Markets

EULA End User License Agreement

EVM Earned Value Management

FAR Federal Acquisition Regulation

FCI Federal contract information

FE Facilities Enterprise

FedRAMP Federal Risk Authorization and Management Program

FISMA Federal Information Security Modernization Act

FRCS Facility Related Control Systems

FSO Facilities Security Officer

HA Health Affairs

HIPAA Health Insurance Portability and Accountability Act

HCA Head of the Contracting Activity

HIT Health Information Technology

IGCE Independent Government Cost Estimate

IA Information Assurance

November 16, 2021

IO Initial Outfitting

I/O In/Out Processing Portal

IPv Internet Protocol Version

IS Information System

ISP Internet Service Provider

IT Information Technology

ISCM Information Security Continuous Monitoring

IV&V Independent Verification & Validation

MedCOI Medical Community of Interest

MHS Military Health System

MIL-STD Military Standard

MTFs Military Treatment Facilities

NCR National Capitol Region

NDA Non-Disclosure Agreement

NIAP National Information Assurance Partnership

NIST National Institute of Standards and Technology

OCONUS Outside Continental United States (includes Alaska and Hawaii)

ODC Other Direct Costs

OPM Office of Personal Management

OSD Office of the Secretary of Defense

P-ATO Personal Authorization to Operate

P&R Personnel and Readiness

PGI Procedures, Guidance and Information

PDT Project Delivery Team

PHI Protected Health Information

PII Personally Identifiable Information

PIT Platform Information Technology

PK Public Key

PKI Public Key Infrastructure

POA&M Plan of Action and Milestones

POC Point of Contact

PMO Program Management Office

PoP Period of Performance

PP Personal Property

PPSM Ports, Protocols, and Services Management

PRS Performance Requirements Summary

PSP Personnel Security Program

PWS Performance Work Statement

QA Quality Assurance

QAP Quality Assurance Program

QASP Quality Assurance Surveillance Plan

QC Quality Control

QCP Quality Control Plan

RFP Request for Proposal

RFQ Request for Quotation

RMF Risk Management Framework

November 16, 2021

SP Special Publication

SPRS Supplier Performance Risk System

SRM Sustainment, Restoration and Modernization

SRG Security Requirements Guides

STIG Security Technical Implementation Guides

TOS Terms of Service

US United States

UFC Unified Facilities Criteria

VPN Virtual Private Network

XML Extensible Markup Language

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government:

X Will NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Government Furnished Services required in support of this contract/task orders. These Services are described below: provide

________N/A__________________________________________________________________

3.2 Facilities: The Government:

☐ Will NOT provide Facilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

XWILL provide Facilities in support of this contract/task orders. The Government provided

Facilities are described below:

The work – installation, final delivery and training, shall be performed in IV Room, Inpatient Pharmacy inside Room 1412 Main Pharmacy located at Naval Hospital Camp

Pendleton at Bldg H-200 Mercy Circle, Camp Pendleton, CA 92055.

3.3 Utilities: The Government:

☐ Will NOT provide Utilities in support of this contract/task order. As a result, this paragraph is

Not Applicable.

☐ WILL provide Utilities in support of this contract/task orders. The Government provided

Utilities are described below:

3.4 Equipment: The Government:

X Will NOT provide Equipment in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Equipment in support of this contract/task orders. The Government provided

Equipment is described below:

_________N/A_________________________________________________________________

3.4.1 Procurement Integrated Enterprise (PIEE), GFP Module Application: Not Applicable.

Contracting Office Responsibilities:

The Contracting Office shall ensure close coordination and validation of the GFP items with the

COR and DHA Accountable Property Officer prior to uploading the GFP Attachment into the

PIEE/GFP Module. At the time GFP is anticipated and identified, the Government will upload the GFP Attachment into the PIEE/GFP Module. It is the Contracting Officer’s Representative

(COR) responsibility to prepare, upload and maintain the GFP Attachment in the PIEE/GFP

Module in accordance with the GFP Attachment instructions provided at the DoD Procurement

Toolbox. The CO and COR shall manage and keep an inventory of any GFP associated with contract/task orders awarded through DHA, in accordance with applicable FAR Part 45, DoD

FAR Supplement (DFARS) 245 with respective clauses, DHA AI 095 and PD 45-01 following the change in disposition of items listed on that PIEE/GFP Module Attachment.

The contracting office will also review, acknowledge, reject and/or approve shipment orders provided by the contractor as appropriate. Functional roles can be determined within the

Contracting Office, and requested within the PIEE/GFP Module system.

Contractor Responsibilities:

A key contractor responsibility is to work with the CO and COR to ensure the PIEE/GFP Module data, to include the PIEE/GFP Attachment, provides a timely, complete and accurate accounting of the GFP applicable to the contract/task order. Contractors are required to report the receipt of any GFP shipped to them, regardless of whether it is listed on the GFP Attachment for their contract. Similarly, contractors are required to utilize the GFP Module application in conjunction with the shipment of GFP to the Government, or in reporting Property Loss of GFP issued (such as destruction or loss). Discrepancies or disputes regarding property shipped to or shipped from the contractor must be reported via the GFP Module application, with the CO having authority over final designation of status.

The contractor shall report semi-annually 100% inventories, reconciliations, and final disposition of GFP provided by the government. Final invoices will not be paid pending GFP reconciliation.

Contractors shall be aware of and ensure compliance with applicable FAR Part 45, DFARS 245 and 252.245, Defense Pricing and Contracting Policies, Procurement Integrated Enterprise

Environment Standards, DHA Administrative Instruction 094 and DHA Guidance

3.5 Materials: The Government:

X Will NOT provide Materials in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ IS providing Materials in support of this contract/task orders. The Government-provided

Materials are described below

November 16, 2021

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 Services: The Contractor:

☐ Will NOT provide Contractor Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

X☐ WILL provide Contractor Furnished Services required in support of this contract/task orders.

These Services are described below:

The work – installation, final delivery and training, shall be performed in IV Room, Inpatient Pharmacy inside Room 1412 Main Pharmacy located at Naval Hospital Camp

Pendleton at Bldg H-200 Mercy Circle, Camp Pendleton, CA 92055.

4.2 General: The contractor shall furnish all supplies, equipment, facilities and services required to perform work listed under Section 5 of this PWS.

4.3 Secret Facility Clearance: Not Applicable - The contractor shall possess and maintain a

SECRET facility clearance from the Defense Security Service. The contractor’s employees, performing work in support of this contract shall have been granted a SECRET security clearance from the Defense Industrial Security Clearance Office.

4.4 Materials: The contractor shall Not Applicable

4.5 Equipment: The contractor shall Not Applicable

4.6 Facilities: The contractor shall Not Applicable

November 16, 2021

PART 5

5.0 SPECIFIC TASKS

5.1 Task Headings:

5.1.1 Subtask heading:

5.2 Special Qualifications:

5.2.1 When using education/certification in conjunction with labor categories, the COR in coordination with the CO must establish a review process of contractor personnel to ensure labor category requirements are met.

November 16, 2021

PART 6

6.0 INFORMATION TECHNOLOGY & SECURITY

6.3 Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal information requirements:

6.3.1. Data Sharing Agreements (DSAs): Contractors requiring access to PII, which includes

PHI, or access to de-identified data, are subject to the DHA Privacy and Civil Liberties Office

(DPCLO) (Privacy Office) Data Sharing Program. This program requires DHA to enter into

DSAs with parties outside the MHS who use or create MHS data. A DHA contract may use the term Data Use Agreement (DUA) rather than DSA. DSAs assure that outside parties protect

MHS data in accordance with the Privacy Act and the HIPAA Rules. To apply for a DSA, the contractor submits a Data Sharing Agreement Application (DSAA) to the DHA DPCLO. The contractor submits the DSAA even if a subcontractor will be the party accessing MHS data.

After review and approval of the DSAA, the Privacy Office provides a DSA to the contractor for execution.

6.3.2. Processing Procurement Sensitive Information: All individuals shall seek guidance from the CO regarding the coordination of documents, dissemination, and transmission of procurement sensitive information. Procurement sensitive information shall not be transmitted electronically unless encryption is utilized. Depending on a particular procurement, other restrictions may apply.

6.4 Training

6.4.1 Contractor employees performing cybersecurity/cyberspace functions shall comply with the following requirements: N/A

6.4.1.1 Training: All contractor and associated subcontractor employees working Cybersecurity

Information Assurance (IA)/Cyberspace functions must comply with DoD training requirements in Department of Defense Directive (DoDD) 8140.01 and DoD 8570.01-M. Contractors shall identify, document, track, and report qualifications of contract support personnel who perform cyberspace work roles.

6.4.1.2 Certification: The contractor shall ensure that personnel accessing IS have the proper and current IA certification to perform IA functions at contract award in accordance with DoD

8570.01–M, IA Workforce Improvement Program. The contractor shall meet the applicable IA certification requirements as outlined in DFARS 252.239-2001, including:

6.4.1.2.1 DoD-approved IA workforce certifications appropriate for each category and level as listed in the current version of DoD 8570.01–M; and

November 16, 2021

6.4.1.2.2 Appropriate operating system certification for IA technical positions as required by

DoD 8570.01–M.

6.4.1.2.2.1 Upon request by the Government, the contractor shall provide documentation supporting the IA certification status of personnel performing IA functions.

6.4.1.2.2.2 Contractor personnel who do not have proper and current certifications shall be denied access to DoD IS for the purpose of performing IA functions.

6.4.2 User requirements: All contractor employees that require access to DHA IT must comply with the requirements of DHA-Procedural Instruction 8140.01, Acceptable Use of DHA IT, to include those contract employees with privileged access.

6.5 Cybersecurity Requirements for Non-DoD IT or Covered Contractor IS: Not Applicable.

6.5.1 The contractor shall, at time of award, have implemented the security requirements prescribed in the National Institute of Standards and Technology (NIST) Special Publication

(SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information

Systems and Organizations” (available via the internet at http://dx.doi.org/10.6028/NIST.SP.800-

171), in accordance with DFARS clause 252.204-7012.

6.5.2 NIST SP 800-171 DoD Assessment Methodology. The DFARS provision 252.204-7019 introduces the “NIST SP 800-171 DoD Assessment Methodology” requirement. This requirement enables a strategic assessment of a contractor’s implementation of the NIST SP 800-

171 requirements as required in DFARS clause 252.204-7012. The DoD Assessment

Methodology requirement flows down to subcontractors.

6.5.2.1 Basic Assessment: The contractor shall obtain and maintain access to the Supplier

Performance Risk System (SPRS) via the PIEE, (available via the internet at https://www.sprs.csd.disa.mil/)

6.5.2.1.1 The contractor shall perform a Basic Assessment, using the NIST SP 800-171 DoD

Assessment Scoring Template, and enter the results electronically in SPRS for each covered contractor information system that is relevant to an offer, contract, task order, or delivery order.

6.5.2.1.2 The contractor shall ensure that applicable subcontractors also have their results of a current assessment posted in SPRS prior to awarding a subcontract or other contractual instrument in accordance with DFARS clause 252.204-7020.

6.5.3 The contractor shall provide the government with access to its facilities, systems, and personnel when necessary to conduct or renew a higher-level (i.e., Medium or High) assessment in accordance with DFARS clause 252.204-7020.

6.5.4 Cybersecurity Maturity Model Certification (CMMC) Not Applicable https://www.sprs.csd.disa.mil/

November 16, 2021

6.5.4.1 The contractor shall have a current (i.e., not more than three years old) CMMC certificate in SPRS issued by an accredited CMMC Third Party Assessment Organization

(3PAO) at the required CMMC level. The description of CMMC levels is available at https://www.cmmcab.org/.

6.5.5 The contractor shall submit requests to vary from NIST SP 800-171 in writing to the CO or COR, for consideration by the DoD Chief Information Officer (CIO). The contractor need not implement any security requirement adjudicated by an authorized representative of the DoD CIO to be non-applicable or to have an alternative, but equally effective, security measure that may be implemented in its place.

6.5.6 If the DoD CIO has previously adjudicated the contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the CO or COR when requesting its recognition under this contract.

6.5.7 Cloud Computing: If the contractor intends to use an external cloud service provider, on their behalf, to store, process, or transmit any DoD CUI in performance of this contract, the contractor shall require the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management

Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/) and that the cloud service provider complies with requirements in paragraphs 6.5.8 through 6.5.14 for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

6.5.7.1 If the information is DoD CUI-specific (e.g., PII/PHI), then the contractor shall ensure the external cloud service provider meet the security requirements equivalent to FedRAMP High baseline.

6.5.8 Cyber Incident Reporting Requirement – Not Applicable.

6.5.9 Malicious software: When the contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to DC3 in accordance with instructions provided by DC3 or the Contracting Officer. Do not send the malicious software to the Contracting Officer.

6.5.10 Media preservation and protection: When a contractor discovers a cyber incident has occurred, the contractor shall preserve and protect images of all known affected IS and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DoD to request the media or decline interest.

6.5.11 Access to additional information or equipment necessary for forensic analysis: Upon request by DoD, the contractor shall provide DoD with access to additional information or equipment that is necessary to conduct a forensic analysis.

https://www.cmmcab.org/ https://www.fedramp.gov/

November 16, 2021

6.5.12 Cyber incident damage assessment activities: If DoD elects to conduct a damage assessment, the CO will request that the contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of DFARS clause 252.204-7012.

6.5.13 Apply other IS security measures when the contractor reasonably determines that IS security measures may be required to provide adequate security in a dynamic environment or to accommodate special circumstances (e.g., HIPAA) and any individual, isolated, or temporary deficiencies based on an assessed risk or vulnerability. These measures may be addressed in a system security plan.

6.5.14 The contractor shall maintain within the US or US territories all Government data that is not physically located on DoD premises, unless the contractor receives written notification from the CO to use another location, in accordance with DFARS 239.7602-2(a).

6.5.15. The contractor shall mitigate supply chain risk to the government by complying with

DFARS 252.239-7018 and only utilizing unified capability equipment identified on the DODIN

Unified Capabilities Approved Products List (https://aplits.disa.mil/processAPList), unless granted a waiver in accordance with DODI 8100.04, DOD Unified Capabilities (UC).

6.6 Risk Management Framework (RMF) for DoD IT: Not Applicable.

6.7. Facility Related Control Systems: Not Applicable.

6.8. System Communications - RESERVED

6.9 MHS Demilitarized Zone (DMZ) Medical Community of Interest (MedCOI) Business-to-Business (B2B) Gateway – Not Applicable.

6.10 Contractor Provided IT Infrastructure – Not Applicable

6.11 System Authorization Acess Request (SAAR), Defense Department (DD) Form 2875

6.11.1 The contractor shall submit the most current version of DD Form 2875, “System

Authorization Access Request (SAAR), in accordance with CO guidance for all contractors that use the DoD Gateways to access Government IT systems and/or DoD applications shall. A DD

Form 2875 shall be completed for each contractor employee who will access any system and/or application on a DoD network. The DD Form 2875 shall clearly specify the system and/or application name and justification for access to that system and/or application.

6.11.2 The contractor shall submit the completed DD Form 2875 to the DHA IT Security for verification of Tier I or Tier II Designation. The DHA Personnel Security will verify that the contractor employee has the appropriate background investigation completed or a request for background investigation has been submitted to the Office of Personal Management (OPM).

Acknowledgment from OPM that the request for a background investigation has been received https://aplits.disa.mil/processAPList

November 16, 2021 and that an investigation has been scheduled will be verified by the DHA Personnel Security prior to access being approved.

6.11.3 Upon approval, DHA will notify the user of the ID and password via secure/encrypted e-mail upon the establishment of a user account. User accounts will be established for individual use and may not be shared by multiple users or for system generated access to any DoD application. Misuse of user accounts by individuals or contractor entities will result in termination of system access for the individual user account.

6.11.4 The contractor shall conduct a monthly review of all contractor employees who have been granted access to DoD IS’/networks to verify that continued access is required

6.11.5 The contractor shall provide the DHA DPCLO with a report of the findings of their review by the 10th day of each month following the review. Reports identifying changes to contractor employee access requirements shall include the name, DoD ID number from CAC, Company, IS/network for which access is no longer required and the date access will be terminated.

6.12 MHS Systems Telecommunications

6.12.1 The primary communication links shall be via encrypted tunnels (i.e., Secure Internet

Protocol (IPSEC), GetVPN, or Secure Socket Layer) between the contractor’s primary site and the MHS B2B Gateway.

6.12.2 The contractor shall place the VPN appliance device outside the contractor’s firewalls and shall allow full management access to this device (e.g., in router access control lists) to allow

Central VPN Management services provided by DHA or other source of service as designated by the MHS to remotely manage, configure, and support this VPN device as part of the MHS VPN domain.

6.12.3 The contractor shall procure and configure for operation an auxiliary VPN device for backup purposes to minimize any downtime associated with problems of the primary VPN.

6.12.4 The contractor shall send devices to the MHS VPN management authority (e.g., DHA) via postage paid and include prepaid return shipping arrangements for the devices(s).

6.12.5 The MHS VPN management authority (e.g., DHA) will remotely configure and manage the VPN appliance once installed by the contractor.

6.12.6 The contractor shall be responsible for the maintenance and repair of contractor procured

VPN equipment.

6.12.7 The Government will be responsible for the troubleshooting of VPN equipment.

6.13 Establishment of Telecommunications

6.13.1 Telecommunications shall be established with the MHS through coordination with DHA.

6.13.2 The contractor and DHA Program Office shall identify their requirement(s) for the establishment of telecommunications with the MHS and/or other Government entities.

6.13.3 The DHA/MedCOI B2B Gateway Questionnaire (provided by DHA) identifies the required telecommunication infrastructure between the contractor and the MHS systems. This includes all Wide Area Network, Local Area Network, VPN, Web DMZ, and B2B Gateway access requirements.

6.13.4 The contractor shall complete their applicable portion of the questionnaire and shall return it to the DHA designated POC for review and approval.

6.13.5 The contractor shall, Upon Government request, provide technical experts to provide any clarification of information provided in the questionnaire. DHA will review and process the questionnaire when it is accepted.

6.13.6 DHA will coordinate any requirements for additional information with the POC and schedule any meetings required to review the Questionnaire. Upon approval of the

Questionnaire, DHA will coordinate a testing meeting with appropriate stakeholders.

6.13.7 DHA will notify the contractor POC of the meeting schedule. The purpose of the testing meeting is to complete a final review of the telecommunication requirements and establish testing dates.

6.14 Contractors Located On Military Installations

6.14.1 The contractor(s) shall coordinate/obtain the connections with the local MTFs/ Enhanced

Multi-Service Markets (eMSMs) and Base/Post/Camp communication personnel located on a military installation who require direct access to Government systems.

6.14.2 These connections will be furnished by the Government.

6.14.3 Contractors located on military installations that require direct connections to their networks shall provide an isolated IT infrastructure. They shall coordinate with the

Base/Post/Camp communications personnel and the MTF/eMSM in order to get approval for a contractor procured circuit prior to installation to ensure the contractor is within compliance with the respective organizational security policies, guidance and protocols.

Note: In some cases, the contractor may not be allowed to establish these connections due to local administrative/security requirements.

6.14.4 The contractor shall be responsible for all security certification documentation as required to support DoD IA requirements for network interconnections.

November 16, 2021

6.14.5 The contractor shall provide, on request, detailed network configuration diagrams to support IA accreditation requirements.

6.14.6 The contractor shall comply with IA accreditation requirements. All network traffic shall be via Transmission Control Protocol/Internet Protocol using ports and protocols in accordance with current Service security policy. All traffic that traverses MHS and/or military Service

Base/Post/Camp security infrastructure is subject to monitoring by security staff using Intrusion

Detection Systems.