Solicitation Amendment HT942726RE0170001 SF 30.pdf

R

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offers is extended. is not extended.

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or electronic communication which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by letter or electronic communication, provided each letter or electronic communication makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NUMBER AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER

NUMBER IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation data, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

15B. CONTRACTOR/OFFEROR

(Signature of person authorized to sign)

15C. DATE SIGNED 16B. UNITED STATES OF AMERICA

(Signature of Contracting Officer)

16C. DATE SIGNED

Previous edition unusable STANDARD FORM 30 (REV. 11/2016) Prescribed by GSA FAR (48 CFR) 53.243

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT 1. CONTRACT ID CODE PAGE OF PAGES

2. AMENDMENT/MODIFICATION NUMBER 3. EFFECTIVE DATE 4. REQUISITION/PURCHASE REQUISITION NUMBER 5. PROJECT NUMBER (If applicable)

6. ISSUED BY CODE 7. ADMINISTERED BY (If other than Item 6) CODE

8. NAME AND ADDRESS OF CONTRACTOR (Number, street, county, State and ZIP Code) (X) 9A. AMENDMENT OF SOLICITATION NUMBER

9B. DATED (SEE ITEM 11)

10A. MODIFICATION OF CONTRACT/ORDER NUMBE

10B. DATED (SEE ITEM 13)

CODE FACILITY CODE

SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

Description/Specifications/Statement of Work

Header Miscellaneous Text (Modified):

Addendum to 52.212-4

Amend Paragraph 52.212-4 (b) to include - The contractor shall provide the following, and affirm the ability to meet the minimum essential characteristics (MECS) for the Enterprise Dose Monitoring

The contractor shall deliver software and configure it as necessary to establish connectivity throughout the infrastructure. The ultimate service goal is to consolidate site local Dose Monitoring systems to a single enterprise dose monitoring solution to provide standardization across the Defense Health Agency (DHA). This task includes but is not limited to:

i. Implementation at government hosted virtual environment not directly associated with any currently deployed Picture Archiving and Communication System (PACS). This virtual environment will be used for the complete implementation of the solution to include training and Risk Management Framework (RMF) (if no current Authority to Operate (ATO)).

ii. Standardize system configurations throughout the DHA Enterprise

M E C

Description

1 Support for all ionizing modalities

2 Validated with volumes >10M exams/year

Ability to provide event alerts/notifications to include the ability to attach follow-up reports or notes in response to alerts. Should track who provided responses and be searchable

4 Must be IHE (Integrated Healthcare Enterprise) compliant

Must support SSDE calculated according to TG204 report or Water Equivalent Diameter and be American Association of Physicists in Medicine (AAPM) customer selectable

6 Must support multiple outputs to Radiology and Hospital Information Systems as well as PACS

Must support for the new Centers for Medicare and Medicaid Services (CMS) Computed Tomography (CT) Noise Index Electronic Clinical Quality Measures (eCQM) as well as metrics for both noise and repeat rate

8 Must support capability to export DHA doses to the Global Dose Registry for dose comparisons as needed by user.

9 Must display individual patient study detail as well as complete patient imaging lifetime dose record for studies created within DHA.

HT942726RE0170001

Pre-exam and post-exam (automatic) organ dose calculations for modalities which produce ionizing radiation

Realistic anatomy based on the International Commission on Radiological Protection (ICRP) reference phantoms, higher age resolution, the most up-to-date bone marrow dosimetry, and use of dose models for peds, adult, women/men, and different weights

Must have full integration with PowerScribe 360 and PowerScribe 1

Must support all the following values for analytics and reporting.

- Referring Physician

- Study Common Name

- Studies with Alerts

- Date Range

- Age

- Weight

- Gender (Male/Female only)

- Procedure Code

- Accession Number

- Patient MRN

- Patient Name

- Percentile

- Diagnostic Reference Levels (DRLs)

- Facility/Trust

- Department

- Device

- Dose Type

- Pregnancy status.

- Accession Number

- Alert Note

- Alert Rule

- Body Part

- Description

- Operator/ radiographer

- Performing Physician

- Modality Type

Must integrate for DICOM data bi-directional with DHA Radiology PACS

Must perform body part mapping or study common name procedure mapping

Must be able to limit functionality based on user role

Must support system access through use of CAC

Must have the ability to provide contrast tracking

Must provide Auto-generation of Leapfrog submission data

Must have the ability to capture exam acquiring radiation dose by Technologist

Must be able to support study splitting with dose per segment as well as organ per segment

Must provide an embedded viewer or dashboard or system administrators

Must include a dashboard for system administrators to monitor the solution

The contractor shall provide a detailed topography document to include how the enterprise system will be configured and deployed with submission.

The document will be updated to reflect any changes during implementation within 7 calendar days prior to Go-Live .(Deliverable #1)

Vendor must propose the most recent commercially available software version. The solution shall not be implemented until a valid DHA ATO has been obtained. The entire solution must be commercially available at time of submission that meets or exceeds the MECs outlined in this document, no future features and functionality of the solution will be considered.

The contractor shall include maintenance support for the enterprise software solution over the contract period of 5 years.

The contractor must include software updates/upgrades, to include any professional services required to maintain the application version deployed to the current commercially available software version.

The contractor shall not make software updates/upgrades without written approval from the PACS Program Management Office (PMO).

The contractor shall provide applications training for up to 100 individuals hosted at the 12 PACS Hubs across the enterprise and the PMO. Training shall be conducted virtually once per PACS Hub with connected sites. One virtual session shall be recorded and saved for future training purposes.

Hub locations are as follows:

i. Tripler Army Medical Center, HI

ii. Brian D. Allgood, Korea

iii. Evans Army Community Hospital, CO

iv. Madigan Army Community Hospital, WA

v. Brooke Army Medical Center, TX

vi. Walter Reed National Military Medical Center, MD

vii. Womack Army Medical Center, NC

viii. Landstuhl Regional Medical Center, Germany

ix. Blanchfield Army Community Hospital, KY

x. Eisenhower Army Community Medical Center, GA

xi. Portsmouth Naval Medical Center, VA

xii. Naval Medical Center San Deigo, CA

The contractor shall assign a Project Manager (PM) and have initial kick off meeting with PACS PMO within 30 calendar days of award Meeting .

minutes must be provided by the contractor within 48 hours of the meeting conclusion (Deliverable #2).

1 Kick off meeting with PACS PMO, PACS hubs, connected sites, and network hosting team between 60-90 calendar days of award. (Deliverable #3).

The contractor shall deliver a draft project plan at proposal submission and a final project plan within 30 calendar days after award of the contract; and every 30 calendar days until project completion. The project plan shall include detailed implementation information with specific tasks and a timeline for all sites at time of submission. (Deliverable #4).

Project plan shall include the following:

i. The project plan shall include the start of delivery of software within 60 calendar days of award of the contract and installation shall begin within 90 calendar days of award. All sites must Go-live (clinically in use) within 12-months of contract award.

ii. The project plan shall include detailed implementation information that highlights the key deliverables, timelines, and expectations of each party responsible for delivery, configuration, and final acceptance of the systems Comprehensive implementation plan to install all systems, including total number of project managers and implementation team(s) involved.

iii. Detailed steps and task owners for implementation as well as expected completion time for each task.

iv. Proposed timeline for production Go-live for all implementations. "Go-live" date is met by full clinical usage of the system with fulfillment of migration requirements related to Go-live with no reliance on the legacy system.

The contractor shall host weekly status meetings with the Government representatives; contractor shall provide meeting agenda 24 hours prior to meeting and provide meeting minutes within 48 hours of the meeting conclusion. Meeting minutes shall be provided in PDF format. (Deliverable #5).

Contractor shall be provided an environment for a test system to be utilized for RMF and application testing.

The contractor shall validate functionality of software in accordance with RMF accreditation documentation. RMF/ATO must continually be updated to meet the requirements of MECS 23 and 24.

DoD Cybersecurity/Risk Management Framework (RMF):

Vendor must comply with RMF Security Technical Implementation Guides (STIG) requirements and scan for vulnerabilities with DoD provided Nessus vulnerability scan software monthly.

A. The DoD Cybersecurity/Risk Management Framework critical requirements for cybersecurity and supply chain risk management shall be included in all applicable solicitations and contracts for Information or Communication Technology (ICT), including medical devices. The language below addresses both the prohibition of components from foreign adversaries and the assurance of secure software development and vulnerability management practices.

Compliance with the requirements herein is a material contract requirement. The Contractor acknowledges that effective Information and Communications Technology Supply Chain (ICTS) management, including all constituent software, firmware, and hardware, is critical to DHA's mission and security and integrity of the DoD Information Network.

1. Vendors shall only offer items, including third-party vendor items, which already have an Authorization or Approval to Operate (ATO), or items for which the vendor, and third-party vendor if applicable, agrees to go through the RMF approval process and obtain an RMF ATO.

(a) Vendors, and any third-party vendor items, must meet all cybersecurity requirements listed in the MDE PMO Cybersecurity Requirements_RMF Requirements in Attachment

1. These cybersecurity requirements are listed as minimum requirements 01-19.

(b) Any offered system must meet DoD Cybersecurity/Risk Management Framework (RMF) and the attached MDE Cybersecurity/Risk Management Framework document;

Attachment 2 - MDE Cybersecurity_RMF Contracting Requirements V3.0). Vendors must provide a statement with its offer that they, and any third-party vendors, agree to the Cybersecurity/RMF Requirements, HIPAA requirements, and B2B requirements.

(c) Vendors are required to provide a completed CyberLOG-MDE PMO Medical Device and Equipment Risk Assessment (MDERA) Questionnaire (Attachment 3 -MDE PMO Cyber_MDERA v7.0) for the offered system along with its offer. This includes any third-party vendor items.

(d) Submitting an offer for any requirement under this initiative constitutes full agreement to all specific RMF requirements listed in this RFO and Attachment 2 (MDE PMO Cybersecurity_RMF Contracting Requirements V3.0).

This includes:

2. For all MDE identified by the Government as requiring a full Assess and Authorize (A&A) approval, including IV&V test, the vendor shall not make any delivery and shall not receive payment until the Authorizing Official (AO) approves the medical device and equipment to be installed at the site and connected to the MedCOI network. Delivery of all system components, including any 3rd party items, may take place prior to this milestone (AO approval) only if written permission is provided by the Contracting Officer.

3. For all MDE identified by the Government as requiring an Assess and Incorporate (A&I) approval, the vendor shall not make any delivery and shall not receive payment until the PMO has completed a review of submitted RMF documentation and technical results, And the Authorizing Official (AO) approves the medical device and equipment to be installed at the site and connected to the MedCOI network. Delivery of all system components including any 3rd party items, may take place prior to this milestone only if written permission is provided by the Contracting Officer.

4. For all MDE identified by the Government as requiring an Assess and Use (A&U) approval, the vendor must receive written confirmation from the MDE PMO or Contracting Officer that the Authorizing Official (AO) approves the medical device and equipment to be installed at the site and connected to the MedCOI network, then the vendor may proceed with delivery.

5. Prior to final acceptance and installation, as a part of acceptance testing, the vendor shall provide procedures for the accepting sites to ensure the delivered device matches the DHA authorized configuration. The vendor shall coordinate running Nessus and SCAP scans with the site and the assigned DHA Cybersecurity Analyst to verify compliance. Any deviations from the approved configuration will require the vendor to bring the system into compliance before final acceptance and payment.

6. The vendor shall maintain an DHA RMF ATO on all equipment/product versions, owned or operated by the DHA, and covered under this contract/order. If the vendor cannot support the DHA RMF ATO for all DHA contract/ordered versions of the equipment/product, the vendor can meet this requirement by offering to provide all upgrades to the equipment/product that are required to maintain the DHA RMF ATO, either at no cost to the Government or at a fixed price that is included in a subsequent

SMA offering under the vendor's contract/order. During the period of time the vendor's product is installed on the DHA network, the vendor shall provide all required cybersecurity patches/updates/upgrades, including Operating System and application upgrades where necessary. Maintaining the DHA RMF ATO shall be included as part of the vendor's warranty. For updates/patches, executable files shall be distributed by the vendor accordingly, or implemented by the manufacturer's technical staff, dependent on the contract/order processes.

7. Maintaining DHA RMF ATO shall be included as part of the vendor's warranty period.

8. All RMF costs related to the initial purchase of the equipment must be added to the vendor's long-term contract prior to award.

9. Vendors must clearly state in their offer if there are any costs associated with RMF support for any support term, including life of the system.

RMF support is defined as the support required to maintain the DHA RMF ATO by providing all required cybersecurity patches/ updates/upgrades, including Operating System and application upgrades where necessary.

10. Failure to agree to the attached DHA Cybersecurity Requirements document, disclose third-party vendor items requiring DHA RMF ATO provide a completed Attachment 3 -MDE PMO Cyber_MDERA v 7.0 questionnaire, and provide or state any RMF related costs, may result in rejection of the vendor's offer. Failing to disclose that a system has third-party components requiring RMF Approval, the system cannot meet RMF requirements, failure to meet certification timeframes or failure to receive DHA RMF ATO, including third-party items, may result in termination for cause in accordance with FAR 52.212-4(m).

NOTE: Any weaknesses may be mitigated through other RMF requirements and vendor must indicate how any issue can be mitigated.

Unmitigated weakness could be severe as to lead to a vendor being unable to receive an ATO.

B. The following shall be provided as part of the vendor's technical proposal. The completeness and quality of these submissions will be used to assess the offeror's security maturity and will be a key factor in the Government's evaluation of competing proposals.

1. Prohibition on Foreign Adversary Sourcing and Certain Telecommunications and Video Surveillance Services and Equipment:

The Vendor represents and warrants that the 'company' and its subcontractors or suppliers thereof do not incorporate hardware (including components), software, or firmware to be supplied under a contract that is manufactured, assembled, or otherwise sourced, in whole or in part, consisting of the product types or services contained in the 'Covered List' at https://www.fcc.gov/ supplychain/coveredlist, or from any supplier who is an affiliate or otherwise controlled by a 'Foreign Adversary Country'. "Foreign Adversary Country" is defined as the Peoples Republic of China, the Russian Federation, North Korea, Iran, and Venezuela (Madura Regime), and any other actor identified by the Secretary of War or Office or the Director of National Intelligence. With regard specifically to the supply of classes of equipment only, these prohibitions do not apply to equipment or components that "cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that

Representations and declarations shall be made consistent with FAR such equipment transmits or otherwise handles."

52.204-24 and DFARS 252.204-7017, which are not limited to covered equipment or their components except as described in the "Covered List".

2. Bills of Material (HBOM/SBOM)

The Vendor shall provide a comprehensive Hardware and Software Bill of Materials (HBOM/SBOM) for all products to be provided in response to this solicitation or to be provided under this contract. Reference the CISA Hardware Bill of Material Framework for Supply Chain Risk Management and the CISA 2025 Minimum Essential Requirements for Software Bills of Material. The resultant BOMs must include:

(a) The supplier and/or manufacturer, and country of origin for each electronic component.

(b) Identification of any components sourced (in whole or in part) from a Foreign Adversary Country, Prohibited Source of Supply, or any non-TAA Compliant Country.

(c) Other information as is required under the representation provided in compliance to FAR 52.204-24 and DFARS 252.204-7017.

The SBOM and HBOM submitted and accepted by the Government at the time of award shall be considered the baseline for the delivered system and or equipment.

3. Secure Development Practices and ICT Supply Chain Risk Management (SCRM)

Using NIST SP 800-218 as a reference, and as applicable to the vendors' product(s) to be delivered under the contract, the vendor must demonstrate, based on its own documented procedures, a commitment to secure software development practices.

The vendor must also demonstrate that it has processes and procedures in-place for vetting third-party components (hardware and software), managing open-source software and related supplier and supply chain risks, managing changes to system and component configuration, and discovering and responding to vulnerabilities.

HT942726RE0170001

https://www.fcc.gov/supplychain/coveredlist

4. HBOM and SBOM Change Management

The vendor shall be responsible for change management and notification to the Government in cases where there have been changes to the baseline HBOM and SBOM post award. Notification of the COR will be required under the following conditions:

(a) Upon any Software/Firmware Update: An updated SBOM shall be delivered within 15 business days of the release of any software or firmware update which would impact the product or component baseline for subsequent deliveries under the contract.

(b) Upon Hardware Component Revision: An updated HBOM shall be delivered if any hardware component of the system undergoes a revision or part substitution which would impact the configuration of devices delivered under the contract.

(c) Upon Government Request: The Contractor shall provide the most current SBOM and HBOM within 30 days of a request from the COR.

5. Vulnerability Management, Continuous Monitoring and Notification of Non-Compliance

Post award, and every 90 days thereafter, the vendor shall monitor the list of prohibited equipment and or services at https:// www.fcc.gov/supplychain/coveredlist, or otherwise posted to SAM.gov. Should the vendor based on these Government sources or through any other source including any subcontractor or supplier, determine that any equipment or component violates these requirements relative to prohibited sources of supply, the Vendor shall:

(a) Notify the Contracting Officer within 3 business days of discovery and follow the other reporting procedures under FAR 52.204-25 and DFARS 252.204-7018.

(b) Within 30 days of discovery, provide a detailed mitigation strategy to address any potential security risks, including required configuration changes and/or upgrades that would remediate the potential risks.

(c) If the component is deemed critical to the operation of the system relative to the system functional requirements or specifications, and cannot otherwise be mitigated or remediated, provide an alternative sourcing plan for the affected component within 30 days of notification.

In addition, the vendor shall proactively monitor all components in the baseline SBOM/HBOM for new vulnerabilities. For any 'High' or 'Critical' severity vulnerability (CVSS v3.x score of 7.0 or higher), the Contractor shall notify the COR and the DHA Cyber Operations Center within 72 hours of discovery using secure mail or by contacting the DHA Cyber Operations Watch Desk at (866)-786-4432. This notification must include the CVE, a description of vulnerability, the affected components, potential impact, and immediate mitigation instructions. A formal remediation plan and timeline for corrective action shall be delivered within 30 days of notification.

6. Government Review, Validation and Approval

All mitigation strategies, remediation plans, and alternative sourcing plans are subject to the Defense Health Agency's (DHA) review and written approval. The Vendor's ability to adequately address ICT supply chain risks to DHA's satisfaction will be a critical factor in the assessment of contract performance. Independent review and verification can include, but is not limited to, analysis of the delivered SBOM/HBOM and sources of supply, physical inspection of components, vulnerability scanning of the system or components to validate hardware, software and firmware configuration. In case of non-compliance with these requirements, or misrepresentations, the Agency may implement whatever remedies under the contract that it deems appropriate or necessary. Current policy and regulations state that in some cases, non-compliance with these requirements will render the vendor, company, or a supplier ineligible for subsequent awards.

7. Support for Risk Management Framework (RMF)

The Vendor shall provide all necessary cooperation and required artifacts for the Government to obtain and maintain the necessary approvals under the Risk Management Framework (RMF) as required to operate the system A (Deliverable #6).

system or device which cannot attain the necessary approvals cannot reside on the DHA information network. Prior to first unit delivery, and not later than 30 days from the date of award, the vendor shall provide the following artifacts to the COR and Project Management Office's designated Information Systems Security Manager:

(a) System Architecture Diagram (required in all cases except where the configuration consists of a single stand-alone device)

(b) Completed DHA Security Questionnaire

(c) Hardware and Software Bills of Material (provided as part of the Solicitation or updated at time of Award)

(d) Comprehensive discovery, configuration, and vulnerability scans (all system components and devices), using Tenable Nessus

And within 60 days:

- Completed Controls Selection Worksheet (as provided by the Government for the system, component(s), or device(s)

No system components or devices are to be delivered, nor will the Government be responsible for payment for any system component or device, subject to the RMF process, until the minimum required artifacts are delivered and accepted by the Government. If the complexity of the system, component, or device requires configuration or integration, such that validation of the security configuration cannot be done independently, the vendor may propose a vendor site inspection and validation to occur not later than 90 days from award. The vendor will still be responsible for the 30 and 60 deliverables listed above excluding the

HT942726RE0170001

comprehensive discovery, configuration, and vulnerability scans which would be done at the vendor site. The vendor site must be located in the continental United States (lower 48 States). Final artifacts will be due 30 days after the inspection and pending approval and acceptance by the Government.

8. Flow-down Requirements

Relative to the requirements for prohibited sources of supply under FAR Subpart 4.21 and associated clauses, the Vendor (Contractor) shall insert the substance of these requirements as well as the clause at DFARS 252.204-7018 in all subcontracts and other contractual instruments for the acquisition of commercial products or commercial services under the prime contract.

VENDORS MUST MEET ALL OF THE RMF MINIMUM REQUIREMENTS LISTED IN Attachment 1

The contractor shall provide vulnerability scan and Security Content Automation Protocol (SCAP) scan results to DHA cybersecurity POC on a monthly basis. Contractor shall provide raw scan results and administrative reports, 30 calendar days after contract award and by the 10th of each month thereafter. (Deliverable #7).

The contractor shall submit a drawing for/from RMF/ATO package to clearly demonstrate any 3rd party vendors being quoted are within the vendors boundary. Initial drawing shall be submitted with their proposal and will be updated as required for RMF Certification and Accreditation to achieve ATO.

(Deliverable #8).

Business-to-Business (B2B) remote connection cannot be guaranteed. At times the B2B may not be available due to a variety of issues. If this happens, the contractor is still responsible to implement, and to maintain the up time of the system. If needed, the contractor shall send someone to the site to address any issue if progress is not shown within 48 hours. Contractor shall include costs for onsite installation and maintenance in the event B2B connection is not available or is not approved for a connection. The absence or lack of remote connectivity shall not delay implementation of system or configuration.

The DHA will determine the need to perform AT at a single PACS hub or multiple hubs as the implementation progresses. AT will be performed by Subject Matter Experts from the DHA PMO.

MILESTONE PERFORMANCE SCHEDULE

Month Tasks/Milestones Completed

Month

Kick Off Meeting with DHA PMO and vendor, project plan presented and agreed to by Govt and vendor.

Month

2 - 3 Kick Off meeting with PACS hubs, Network hosting team and software/licenses delivered

Month

4-9

Implementation and configuration of software

PACS desktop integration configuration

Month

Configuration and integration testing with Super Users and DHA PMO

Month

System Administrator and User applications training

Month

System Go-live and DHA AT and validation

DELIVERABLES SCHEDULE

Deliverable Frequency Medium/Format Submit To

A p pl ic a bl e to

Deliverable #1: Detailed topography

With submission and 7 calendar days prior to Go-Live Contractor's discretion

COR

and Site

POC

M E C s

Deliverable #2:

Contractor shall assign a Project Manager (PM) and conduct initial kickoff meeting with PMO.

Within 30 calendar days of award and provide meeting minutes within 48 hours of the meeting conclusion

Contractor's discretion

COR

and Site

POC

M E C s

Deliverable #3:

Kick off meeting with PACS PMO, PACS hubs, connected sites, and network hosting team

Between 60-90 calendar days of award Contractor's discretion

COR

and Site

POC

M E C s

Deliverable #4: Detailed project plan/Site-by-site project plan

Draft with submission proposal; Final within 30 calendar days after contract award; and every 30 calendar days until project completion

Contractor's discretion

COR

and Site

POC

M E C s

M E C

Deliverable #5:

Weekly status meetings

Weekly status meetings, provide meeting agenda 24 hours prior to meeting and provide meeting minutes within 48 hours of the meeting conclusion

Contractor's discretion/ Minutes in PDF format COR and Site

POC

s

Deliverable #6:

Provide artifacts to maintain ATO

Within 30 days of completion of each site installation and complete inventory at the completion of project. Vendor shall provide required scans, and patch updates every 30 calendar days

Contractor's discretion

COR

and Site

POC

M E C s 6.

Deliverable #7:

Vulnerability and SCAP scan results

Initial results due 30 calendar days after contract award and by the 10th of each month thereafter.

As required for RMF Certification and Accreditation to achieve ATO

COR

and

DHA

Cyber

POC

M E C s 7.

Deliverable #8:

Artifacts and Documentation required for RMF Certification and Accreditation

At proposal submission and as required for RMF Certification and Accreditation to achieve ATO.

As required for RMF Certification and Accreditation to achieve ATO

COR

and

DHA

Cyber

POC

M E C s 8.

MEDICAL R&D CONTRACTING DIVISION 2, 808 SCHREIDER STREET

FORT DETRICK, MD 21702

UNITED STATES

Jennifer Sikes, Email: jennifer.m.sikes2.civ@health.mil Telephone: 3016191966 AdminBy:

SCD: PAS: