Monitoring Serv Draft PWS 04012025.docx

Department of Defense Defense Health Agency Performance Work Statement

Temperature and Other Environmental Control Monitoring Services

Walter Reed National Military Medical Center (WRNMMC), Directorate of Clinical Support, Bethesda, MD

Solicitation Number:

Version:

Date:

PART 1

1.0 GENERAL INFORMATION

The Walter Reed National Military Medical Center, Bethesda, Maryland, Directorate of Clinical Support requires the maintenance, annual complete system revalidation, and technical support of our existing (government-owned via prior procurement/installation) environmental monitoring system for 1,200 system inputs, divided into 7 management nodes (with the option for expansion). Additional inputs may be added to the system within the limitations of the technology via an incremental and proportional supplemental contact or contract modification. Support includes provision of a 24/7 hotline for resolving system malfunctions, timely maintenance service calls, system user orientation, and repairs with the burden of equipment and supplies for repairs and validation being covered by the vendor. Vendors will adhere to the installation’s security requirements and the institution’s safety requirements. Annual validation will be documented in keeping with all health care industry quality requirements and performance standards.

Services provided will specifically adhere to environment monitoring standards as stated in AABB, Food and Drug Administration, College of American Pathologists, DoD Clinical Laboratory Medicine Services, and The Joint Commission.

1.1 This is a non-personal services contract to provide Environmental Monitoring including the maintenance, annual complete system revalidation, and technical support of our existing (government-owned via prior procurement/installation) environmental monitoring system for 1,200 system inputs, divided into 7 management nodes (expandable via contract modification and/or a supplemental contract within the technology available through the vendor).

1.2 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform Environmental Monitoring as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this PWS.

1.3 Background: Previously, WRNMMC monitoring systems were transitioned from V-1/V2 type monitoring (using a virtual LAN) to DoD DIACAP-compliant Z-3 Wi-Fi systems, featuring encrypted signal communication. The intent of this follow-on contract is to consolidate various contracts supporting these systems within different departments at WRNMMC, into a single multiyear contract. control system within the regulatory requirements in keeping with WRNMMC’s array of devices requiring monitoring.

1.4 Objectives: Basic service requirements include the following components of support for environmental monitoring:

· Maintenance (repair or restoration of functionality),

· Annual complete system revalidation with provision of required documentation,

· 24/7 Technical support,

· Consultation/orientation/training in the optimal use of the existing system,

· User-manual updates if they become necessary.

1.5 Scope: Services required under this contract will include the following in support for environmental monitoring systems:

· Maintenance (repair or restoration of functionality),

· Annual complete system revalidation,

· Technical support,

· Consultation/orientation/ training in the optimal use of the existing system,

· User-manual updates, as they become available, to include the sustainment of the aforementioned services along with replacement batteries and provision of a 24/7 telephonic (or other electronic communication, as provided by the vendor) technical problem-solving consultation. The contractor shall accomplish annual system revalidation with documentation suitable to meet the requirements of the aforementioned regulatory organizations (see paragraph 1.0).

1.6 Period of Performance (PoP): Period of performance for the Base Contract Year will be 01 May 2025 through 30 April 2026, with four (4) subsequent Option Years.

1.6.1 Transition: Transition-in/transition-out period: Reserved.

1.7 Administrative specifications

1.7.1 Place of performance: The work shall be performed at The work shall be performed at Walter Reed National Military Medical Center (WRNMMC), Bethesda, Maryland 20889 in the work spaces occupied by the Department of Pathology and any tenant installation users requiring the use of open monitoring points within the Department of Pathology’s existing 4-nodes (Node 3 --Transfusion Service, Building 9; Nodes 4 & 5—Main Laboratory (operating spaces in several buildings on campus); Node 6—Armed Services Blood Bank Center, (operating in several spaces on the Walter Reed National Military Medical Center, Bethesda, campus) and Node 7- Department of Nutrition.

1.7.2 Recognized Federal holidays:

Independence Day

Technicians will observe the following holidays: New Year's Day, Memorial Day, Independence Day, Labor Day, Thanksgiving, Day After Thanksgiving, Christmas, and New Year's Eve. (If a holiday falls on a scheduled Friday, the technician will be assigned to the first available day prior to the holiday.)

1.7.3 Hours of operation: With the exception of the provision of the 24/7 technical support hotline, the contractor is responsible for conducting business, between the hours of 0800-1700 hours Monday thru Friday, except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The Contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall keep in mind that the stability and continuity of the workforce are essential.

1.7.4 Emergency Services: N/A.

1.8 Contractor travel: N/A--There will be no travel requirement beyond the spaces identified in paragraph 1.7.1. , (i.e., WRNMMC, Bethesda, Maryland, campus for the performance of annual system revalidation and on-site system repair, when required to maintain functionality.) Any travel to the WRNMMC campus will be covered by this contract without any additional billing on the part of the contractor.

1.9 Other Direct Costs (ODC): N/A.

1.10 Quality

1.10.1 Quality Control (QC): The contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s quality control program is the means by which the work complies with stated requirements. Quality control shall meet all CLIA, CAP, FDA and AABB standards and will be provided to the Pathology Department. Upon request historical QC data shall be provided to the contracting officer. Contractor will ensure the environmental monitoring system design and components meet the intent of good laboratory and current good manufacturing practices, as stated in 21 CFR Part 58 and 21 CFR part 211.

1.10.2 Quality assurance (QA): The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.11 Contractor personnel

1.11.1 CAC requirements: System service personnel are not permanently assigned to serve at WRNMMC. They are, therefore, escorted by WRNMMC staff members at all times. Access to contractor database is through their DoD escort. In the event that contractors are assigned by the vendor to work full time in Government facilities, the Facilities Security Officer (FSO)/Company's Security point of contact (POC) will provide the Government all the required information per the DHA CAC request process current version 2.1, January 2018, or more recent when updated. See process attached at Part 7 Section 7.1.1 of the PWS. A CAC is the standard identification for eligible DoD contractor personnel.

1.11.1.1 The contractor shall return all CACs to the COR upon the departure of the contractor(s).

1.11.2 Contractor onboarding and training. The contractor shall complete all requirements, training, and forms as prescribed in the following requirements:

1.11.2.1 The DHA’s “Onboarding Checklist for Contractor Employees” is located at the DHA Onboarding and Offboarding Portal at https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx

1.11.2.2 The DHA’s contractor training instructions embedded at Part 7 Section 7.1.2.

1.11.2.3 The contractor shall comply with onboarding requirements of the DHA for contractors needing to be issued CAC identification, including DoD- and DHA-directed training and forms submission, prior to network access, as displayed in the In/Out-Processing Portal at: https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx (note: Public Key Infrastructure (PKI)-restricted, printed versions available).

1.11.2.4 The DHA’s new employee handbook at Part 7 Section 7.1.4. N/A.

1.11.3 Physical Security: The contractor shall be responsible for safeguarding all government equipment, information and property provided for contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.11.4 Key control: Reserved.

1.11.5 Lock combinations: Reserved.

1.12 Key personnel (Contractor): N/A.

1.13 Data rights: Reserved.

1.14 Reporting

1.14.1 Contractor Manpower Reporting (CMR): Reserved.

1.14.2 Non-Disclosure Agreement (NDA): N/A.

1.14.3 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.14.4 Post award conference/periodic progress meetings: N/A.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings. The contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is contractor support personnel. Include a title block in all emails that states the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is contractor support personnel.

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order. Contractor personnel shall make their contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16 Contractor Access to Health Affairs (HA)/DHA Network(s)

1.16.1 FSO/Company's Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system (If applicable, if not delete 1.16.1 and 1.16.2 and replace to 1.16 Reserved). Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and the security awareness training. The contractor shall be prepared for this process as it could take two (2) or more weeks. The FSO/Security POC shall submit a Standard Form (SF) 85/86 to DHA's Personnel Security Office for a background investigation.

1.16.2 Company's FSO/Security POC must notify the Personnel Security Office when the contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the DHA Personnel Security Office in writing of a contractor's termination from the contract, including the termination date.

1.17 Personnel Security

1.17.1 The contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce Improvement Program, CH4” November 10, 2015 as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM 5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.17.1.1 Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at (703) 275-6038.

1.17.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.17.1.3 DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing off on any access request.

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D-Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R-Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.2 Acronyms: (List all acronyms used in the PWS and what they represent. At a minimum, insert the acronyms provided below).

AABB Association for the Advancement of Blood and Biotherapies

2.3 Applicable Publications, DHA Administrative Instructions (AI), etc. Code of Federal Regulations Title-21,FDA and Title 42, CLIA(Current Editions) Association for the Advancement of Blood and Biotherapies (AABB) Standards for Blood Bank and Transfusion Service (Current Edition) College of American Pathologists -- All Common, Lab General, Transfusion Medicine, and BioBank Checklists (Current Edition)

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government:

☒ Will NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Government Furnished Services required in support of this contract/task orders.

3.2 Facilities: The Government:

☒ Will NOT provide Facilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Facilities in support of this contract/task orders.

3.3 Utilities: The Government:

☒ Will NOT provide Utilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Utilities in support of this contract/task orders.

3.4 Equipment: The Government:

☐ Will NOT provide Equipment in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Equipment in support of this contract/task orders. The Government provided Equipment is described below: Copier Support will be available to the contractor to assist with the production of the annual system revalidation documentation, as required.

3.4.1 Procurement Integrated Enterprise (PIEE), GFP Module Application: N/A.

3.5 Materials: The Government:

☐ Will NOT provide Materials in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ IS providing Materials in support of this contract/task orders. The Government-provided Materials are described below: Copier paper support will be provided to the contractor to assist with the production of the annual system revalidation documentation, as required.

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 Services: The Contractor:

☐ Will NOT provide Contractor Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Contractor Furnished Services required in support of this contract/task orders. These Services are described below:

Services required under this contract will include the following in support for the Department of Pathology’s input monitoring system environmental monitoring system. (Note--System input number may increase if contract is expanded via procurement of additional inputs with associated technical/maintenance support):

· Maintenance (repair or restoration of functionality),

· Annual complete system revalidation,

· Technical support,

· Consultation/orientation/ training in the optimal use of the existing system,

· User-manual updates, as they become available, to include the sustainment of the aforementioned services along with replacement batteries and provision of a 24/7 telephonic (or other electronic communication, as provided by the vendor) technical problem-solving consultation. The contractor shall accomplish annual system revalidation with documentation suitable to meet the requirements of the aforementioned regulatory organizations (see paragraph 1.0).

4.2 General: The Contractor shall furnish all supplies, equipment, and services required to perform work listed under Paragraph 1.5 and 5 of this PWS.

4.3 Secret Facility Clearance: N/A.

4.4 Materials: The Contractor shall provide the environmental monitoring repair materials and replacement parts, as necessary to sustain the system described in para 1.1.

4.5 Equipment: The Contractor shall provide equipment needed to meet the requirements under this PWS.

4.6 Facilities: N/A.

PART 5

5.0 SPECIFIC TASKS

5.1 Task Headings: The contractor shall provide the following services:

See 5.3, 5.4, and 5.5 below for specifications and requirements for services as proposed by the Contractor and incorporated by reference, herein.

5.1.1 Annual Environmental Monitoring System Recalibration and Servicing (Annual System Preventive Maintenance (PM) Servicing):

(a) Annual System Revalidation. For all seven nodes (1.200 inputs) Provide Comprehensive System Testing to Verify & Document the following in accordance with the regulatory requirements of the references listed in paragraph 2.3. Documentation must include:

(1) Assurance of input reading accuracy assessed using a NIST-certified or NIST-traceable thermometer.

(2) Assurance of functionality of properly operating databases, operating alarm dial-outs, output reports, and accuracy of user programming.

(3) Documentation of annual system compliance with good [blood product] manufacturing practices/good laboratory practices installation qualification/operational qualification (IQ/OQ)

(4) Validation report will include software validation test report, calibration of temperature and humidity with traceable equipment, copies of reference equipment calibration certificates

(b) User and Supervisor Refresher Training. Provide onsite refresher training in conjunction with the PM visit.

5.1.2. Provision of a 24/7 Technical Support to include the following:

(a) Onsite Service/Repair Plan

(b) 24/7 Access to Troubleshooting Hotline

(c) Technical Support includes provision of repair or replacement parts when required to restore functionality of existing installed monitoring devices.

(d) Provision of a limited supply of replacement transmitter module batteries for onsite repairs.

(e) Assistance with Data Archival /Recovery, as required.

(f) Provision of any updated technical user instructions when published

5.1.3 Contractor Specified Support

(a) A 5-Year Routine Preventative Maintenance & Calibration Agreement. This agreement covers routine service, calibration, and validation of up to 700 monitoring points across WRNMMC, ensuring ongoing system performance and compliance with all regulatory requirements.

(b) Dedicated Labor Hours. Contractor will provide a dedicated part-time technician to be available one day bi-weekly at WRNMMC. This technician will focus on system maintenance, troubleshooting, and ensuring system optimization.

Schedule:

· Hours: A Technician will be assigned and on-site every other Friday, bi-weekly, during regular

· hours from 8:30 AM to 4:30 PM.

· Holidays: Technicians will observe the following holidays: New Year's Day, Memorial Day,

· Independence Day, Labor Day, Thanksgiving, Day After Thanksgiving, Christmas, and New Year’s Eve. (If a holiday falls on a scheduled Friday, the technician will be assigned to the first available day prior to the holiday.)

(c) Equipment Upgrades. To enhance system reliability and connectivity, Contractor will replace roughly 470 existing 5GHz Wi-Fi modules with upgraded models, improving monitoring accuracy and performance.

(d) Installation of New Nodes and Additional Monitoring Points. The proposal includes the installation of additional nodes (maximum 8), as well as the addition of new monitoring points (up to a total of 700) to expand coverage and meet the growing needs of WRNMMC’s critical environments.

Below is a list of the most common equipment expected for Walter Reed National Military Medical Center.

5GHz Wi-Fi transmitter. These transmitters are designed for 1 input from an included PT-100 platinum RTD with a wire length of 6 feet. Reads from -200 to +100 degrees C with typical accuracy over span of 0.4 degrees and a resolution of 0.07 degrees. LCD display cover.

5GHz Wi-Fi transmitter. Transmitter has an integrated temperature sensor with a range of -15 to +60C. LCD display cover.

5GHz Wi-Fi transmitter. Transmitters have integrated temperature and relative humidity sensors. Temperature range: -20 to +60C; RH range: 0-100%RH, non-condensing. LCD display cover.

5.2 Special Qualifications: None.

PART 6

6.0 INFORMATION TECHNOLOGY & SECURITY

6.1 All work under this contract is: Unclassified.

6.2 The TIER 1 or TIER 2 levels and position sensitivity designation for positions under this contract is: Tier II.

6.2.1 TIER II: Non-critical sensitive position (A position where an individual is responsible for systems design, operation, testing, maintenance, and/or monitoring that is carried out.)

6.3 Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal information requirements: N/A.

6.4 Training: N/A.

6.4.2 User requirements: All contractor employees that require access to DHA IT must comply with the requirements of DHA-Procedural Instruction 8140.01, Acceptable Use of DHA IT, to include those contract employees with privileged access.

6.5 Cybersecurity Requirements for Non-DoD IT or Covered Contractor IS: N/A.

6.5.15. The contractor shall mitigate supply chain risk to the government by complying with DFARS 252.239-7018 and only utilizing unified capability equipment identified on the DODIN Unified Capabilities Approved Products List (https://aplits.disa.mil/processAPList), unless granted a waiver in accordance with DODI 8100.04, DOD Unified Capabilities (UC).

6.6 Risk Management Framework (RMF) for DoD IT: All IS, Platform Information Technology (PIT) and IT Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with DoDI 8510.01, Risk Management Framework (RMF) for DoD IT and comply with annual Federal Information Security Modernization Act (FISMA) security control testing. IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) 1253, implement a corresponding set of security controls from the NIST SP 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

6.6.1 All systems subject to RMF must present evidence of authorization in the System Security Plan, Security Assessment Report) a Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has a DoD RMF or equivalent DoD Component PIT system accreditation decision that is current within 3 years within 5 business days of CO request. Evidence of FISMA compliance must be presented in the form of a POA&M. Systems must have and maintain an Authority to Operate (ATO) or Authority to Operate with Conditions (ATO-C) by contract award.

6.6.2 The contractor shall implement security controls in accordance with NIST implementation and validation requirements specified in the NIST SP 800-37 Risk Management Framework (RMF) and DoDI 8510.01, Risk Management Framework (RMF).

6.6.3 The contractor shall configure the information system in accordance with Defense Information Agency (DISA) Security Requirements Guides (SRGs) and security technical implementation guides (STIGs).

6.6.4 The contractor shall ensure that the information system conforms to the requirements of DoDI 8551.01 “Ports, Protocols, and Services Management (PPSM)”.

6.6.5 The contractor shall ensure that the information system shall authenticate all entities as specified in DoDI 8520.03 “Identity Authentication for Information Systems” prior to granting access.

6.6.6 The contractor shall Public Key (PK) enable the information system, implementing digital signature and encryption requirements specified in DoDI 8520.02, “Public Key Infrastructure (PKI) and Public Key (PK) Enabling”.

6.6.7 The contractor will be responsible for compliance with the Joint Force Head Quarters – Department of Defense Information Network issuances and IA Vulnerability Management (IAVM) issuances by ensuring that the issuances are assessed, implemented and maintained throughout development and sustainment in accordance with specified timelines.

6.6.8 The contractor shall support reciprocity, by providing all directed information in NIST security documents to the government.

6.6.9 The contractor shall implement system level protection and detection capabilities that are consistent with their contract for NIST Security requirements that meet DoD and DHA Cybersecurity Architectures.

6.6.10 Cyber Incident Reporting Requirement: The contractor shall comply with the incident management requirements of Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B, “Cyber Incident Handling Program”.

6.6.11 Information security continuous monitoring (ISCM): ISCM is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. ISCM is a critical part of the risk management process to ensure that IS and PIT operations remain within an acceptable level of risk despite any changes that occur. The Contractor shall maintain ongoing monitoring, analysis and incident response procedures for all ARRT and PIT systems under this requirement in accordance with NIST SP 800-137.

6.6.12 The contractor shall mitigate supply chain risk to the government by complying with DFARS 252.239-7018 and only utilizing unified capability equipment identified on the DODIN Unified Capabilities Approved Products List (https://aplits.disa.mil/processAPList), unless granted a waiver in accordance with DODI 8100.04, DOD Unified Capabilities (UC).

6.7. Facility Related Control Systems: The DHA’s Facilities Enterprise (FE) Program Management Office (PMO) establishes the processes for acquisition, installation and sustainment of FRCS in DHA Facilities. Requirements for cybersecurity of FRCS are developed and specified by the FHA FE FRCS PMO. The scope of PIT and Control Systems within the DoD includes building control systems such as Heating Ventilation and Air Conditioning, Utility Management Control System, Electronic Security Systems, Fire Alarm Systems, and other assets. The application of IT cybersecurity strategies is migrating into PIT and Control Systems in response to emerging threats. The requirements within this scope apply to all versions of Design-Build (DB); Design-Bid-Build (DBB); and facilities Sustainment, Restoration and Modernization (SRM) projects as well as Initial Outfitting (IO) requirements activities.

6.7.1 Applicability: Contractors shall agree to the DHA Cybersecurity requirements as outlined for those project-specific FRCS Systems selected from Military Standard (MIL-STD) 1691, (https://home.facilities.health.mil/military-standard-milstd-1691-equipment) and identified in the DBB design process, D-B RFP development, SRM procurement documentation, or IO requirements unless an exception has been granted for a system by the Government prior to project award or procurement order issuance.

6.7.2 Cybersecurity Design: Failure to meet the design requirements may result in Government non-acceptance of submittals or termination of the procurement delivery order for cause, in accordance with project documentation and FAR 52.212-4(m).

6.7.2.1 The contractor shall comply with Unified Facilities Criteria (UFC) 4-010-06 Cybersecurity of Facility-Related Control Systems, UFGS 25-05-11 Cyber Security for Facility-Related Control Systems and referenced standards to develop a Cybersecurity program for their FRCS products to be installed in DoD facilities. The UFC system is prescribed by MIL-STD 3007 and provides planning, design, construction, sustainment, restoration, and modernization criteria, and applies to the Military Departments, the Defense Agencies, and the DoD Field Activities in accordance with Under Secretary of Defense Acquisition, Technologies, and Logistics Memorandum dated 29 May 2002. UFC will be used for all DoD projects and work for other customers where appropriate.

6.7.2.2 Contractors shall comply with the National Information Assurance Partnership (NIAP) Common Criteria Cybersecurity Evaluation and Validation Scheme (CCEVS) evaluation (https://www.niap-ccevs.org) which is published on the NIAP-CCEVS Products Compliance List. The NIAP-certified products have been assessed from a security perspective, helping to reduce the existence of potential vulnerabilities. Contractors are required to continually maintain their products, mitigate vulnerabilities, and distribute fixes to licensed users.

6.7.2.3 The contractor agrees to comply with security regulations and guidance listed in Attachment 3, Cybersecurity Regulations and Guidance, and all RMF requirements. The contractor shall establish appropriate administrative and technical safeguards to ensure the confidentiality, integrity, and availability of Government data under their control.

6.7.3 Funding of FRCS System/Device Requirements: Projects requiring new or replacement FRCS, or upgrade/extension of existing devices/systems, employ either SRM, DB, or DBB acquisition strategies. Many FRCS are categorized as Real Property and are project funded. Others are categorized through Military Standard 1691 as Personal Property (PP) requiring IO funding. The IO effort should preferably, and where feasible, be embedded in the SRM, DBB or DB contract through Contract Line Items or another vehicle. This will optimize coordination of project-funded infrastructure design/construction with FRCS device/system design, installation, testing and commissioning. Where the project delivery team (PDT) determines that acquisition of PP devices/systems will be through IO action entirely separate to the SRM, DBB, or DB contract, the same RMF-related activities are required. These activities shall be fully integrated into the project master schedule.

6.7.3.1 Pricing for Cybersecurity: If there are any additional costs associated with any element of the Cybersecurity lifecycle including a test/laboratory environment, the Contractor shall provide those costs as follows:

6.7.3.1.1 All costs to assist the Government to achieve a new ATO and maintain it during the equipment’s warranty shall be included in the initial quote/offer price for SRM, and in the proposal for DB/DBB projects.

6.7.4 FRCS Cybersecurity Requirements: The contractor shall provide a POC responsible for the cybersecurity of the contractor device or system, throughout the lifecycle of the product. The contractor shall provide Subject Matter Experts to support all assessments of contracted products and materials.

6.7.4.1 The contractor shall establish and utilize a test/laboratory environment that duplicates all contractor fielded equipment/product that falls within the FRCS system/device authorization boundary. The contractor shall ensure that all fielded equipment/product is maintained during the construction/installation period of performance, and for fifteen (15) years post acceptance or as long as the contractor commercially supports the equipment/product, whichever is longer.

6.7.4.2 The contractor’s test/laboratory environment shall be used to submit to the Government, either through the RFP response, procurement order offer/quote, or construction submittal process, with all sections of the FRCS Risk Assessment Questionnaire and a Nessus vulnerability assessment report.

6.7.4.3 Contractors must provide a fully credentialed Nessus scan of the laboratory environment utilizing the DoD policy template with the submission. In addition, Nessus scans shall be provided within ten (10) days of a request from the Government POC to ensure a continuous monitoring program. Nessus scanner must be procured by the contractor, at their own cost, in order to comply with RMF requirements. The contractor shall request the latest versions through the CO.

6.7.4.4 Contractors shall notify the assigned Government POC FRCS analyst of any updates/changes to the system and attain Government approval from the Military Treatment Facilities (MTFs) Change Control Board prior to installation. This should include operating system updates/patches; contractor application and database upgrades, updates, and patches; other software/firmware updates/patches; and addition/removal of components.

6.7.4.5 The contractor shall comply with DoDI 8500.01 Cybersecurity, Enclosure 3, paragraph 9.b.(11), requiring all cybersecurity products and IA-enabled products that require use of the product’s cybersecurity capabilities will comply with the evaluation and validation requirements of Committee on National Security Systems Policy 11, National Policy Governing the Acquisition of IA and IA-Enabled Information Technology Products, June 2013, as amended.

6.7.4.6 The contractor shall comply with DoDI 8510.01, Enclosure 6, para 2.f(6)(a), ensuring systems must be reassessed for reauthorization prior to the Authorization Termination Date. Government Program Offices or appropriate facilities organizations plan for this activity. The results of an annual cybersecurity review or a negative change to the system or environment at any time (i.e., a change increasing the residual risk) may result in a need for reauthorization prior to the regular three-year reauthorization.

6.7.4.7 If the FRCS is Internet Protocol capable, the proposed system shall be Internet Protocol Version 6 (IPv6) capable or the contractor shall provide a detailed project, migration or planning documentation to show when the proposed system shall be IPv6 capable. The contractor shall be able to demonstrate or provide documentation to prove that their product is IPv6 capable.

6.7.4.7.1 Minimum IPv6 capabilities include:

(a) Conformant with the IPv6 standards profile contained in the DoD IT Standards Registry (DISR);

(b) Maintaining interoperability in heterogeneous environments with IPv4;

(c) Commitment to upgrade as the IPv6 standard evolves;

(d) Availability of contractor IPv6 technical support.

6.7.4.8 The contractor shall notify the Government POC and CO POCs in writing with any inabilities to comply with DoD security requirements. The contractor will provide anticipated costs and timelines required to address any vulnerabilities in question.

6.7.5 Post Award Requirements: Contractor provided network infrastructure components (e.g. switches, routers, etc.) shall be standardized to the existing MTF network infrastructure where possible and shall be listed on the DoD Information Network Approved Products List (APL) (https://aplits.disa.mil). Operating systems and firmware shall be the most current government approved version approved for infrastructure components, workstations, and servers.

6.7.5.1 As technology requirements change and compliance requirements transition, the contractor shall maintain their solution and incorporate new system/device capabilities and requirements into their proposed design. Contractors should at a minimum provide documentation that details what changes/requirements cannot apply to the current version and provide a schedule when the capabilities will be incorporated into future versions to ensure continued compliance and functionality.

6.7.5.2 The contractor’s installed device or system shall pass pre-validation technical screening including fully credentialed vulnerability scans utilizing Nessus, Security Content Automation Protocol scans, and STIGs checklists within 6 months of construction submittal acceptance, or procurement contract award, and prior to related commissioning activity or acceptance testing. All resulting documentation will be provided by the contractor to the Government POC for review. The contractor shall mitigate or remediate all Very High, High, and Moderate severity vulnerabilities discovered during the RMF Assessment process according to the associated POA&M.

6.7.5.2.1 Successful pre-validation technical screening must meet the Cybersecurity criteria listed below:

(a) No unmitigated Very High or High severity, vulnerabilities as described in the appropriate DISA STIGs located on https://public.cyber.mil/stigs/.

(b) No unmitigated Moderate severity, vulnerabilities described in the appropriate DISA STIGs located on https://public.cyber.mil/stigs/.

(c) No unmitigated Very High or High severity vulnerabilities from Nessus vulnerability scans.

(d) No unmitigated Moderate severity vulnerabilities from Nessus vulnerability scans.

6.7.5.2.2 The contractor will provide the following documentation on their system/device:

(a) Manufacturer name/model, version, and functionality description

(b) Product specifications

(c) Technology Architecture Diagram (System topology)

(d) Provide Hardware, Software, and Firmware Inventory

(e) Provide Ports Protocols and Services that are required for System functionality

(f) Provide a data flow diagram with detailed topology (include any required interfaces to other Systems)

(g) Complete a DD Form 2930, Privacy Impact Assessment

6.7.5.3 In DBB and DB contracts, the contractor shall submit requests for the templates and any additional technical documentation through the standard RFI process. Completed documents shall be provided to the Government though the standard Submittal process for Government Approval. For SRM projects and IO requirements, the contractor shall submit a request for the templates and any technical documentation within twenty (20) days of contract award. The required schedule for requests and responses is identified in the timeframes below for each acquisition strategy. Attachment 4, FRCS Responsibility Matrix, provides a Responsibility Matrix overview of the project roles and responsibilities.

6.7.5.4 For all devices/systems requiring an ATO:

(a) For SRM projects and IO requirements, the contractor shall not make any delivery and shall not receive payment for the until the Government POC has approved the self-assessment of the test/laboratory environment. The contractor must receive written confirmation from the CO that the system/device has successfully completed a self-assessment and that the contractor may proceed with delivery. Delivery may take place prior to this milestone only if written permission is provided by the CO.

(b) For DBB and DB MILCON-funded FRCS, the contractor proceeds at his own risk if the contractor has not received Government approval that the system/device has successfully completed a self-assessment. Once the system/device has been installed, commissioning or acceptance testing shall not proceed until the Government POC, with contractor support and mitigation, has completed a successful self-assessment of the installation, and the Independent Verification & Validation (IV&V) has been scheduled (if required). An IV&V cannot be scheduled until all documentation requirements and technical requirements have been completed to the Government POC’s satisfaction. Additionally, all required POA&Ms must have been identified, and been appropriately mitigated to reduce the risk to the Government network and PHI/PII/For Official Use Only data housed within the system.

6.7.5.5 A contractor’s technical solution that requires an Assessment and Authorization shall be able obtains a recommendation of ATO from a Government-appointed third-party validator within twelve (12) months of the successful installation self-assessment.

6.7.6 Cybersecurity Assessment: The contractor’s solutions shall be configured to allow Endpoint protection, allow unattended credentialed scans, and allow patching without contractor intervention.

6.7.6.1 The contractor solution shall comply with DoD Instruction 8582.01, “Security of Non-DoD Information Systems Processing Unclassified NonPublic DoD Information. Devices and systems must be configured in such a way that allows the updating of malware definition signatures on a scheduled basis. Scanning shall encompass the entire system (file system, operating system, and real-time processes) by default. In cases where scanning of the entire system may negatively affect its operation, the contractor shall provide a detailed list of exclusions with justifications. The contractor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support either the full security suite or the individual components (e.g. Data Loss Prevention, Intrusion Prevention System, Antivirus, etc.) without performance degradation of the contractor device or system. In cases where the operation of security applications is not technically achievable, the contractor shall provide detailed justification and a POA&M describing steps towards mitigations or compliance with this requirement.

6.7.6.2 The contractor shall ensure that the selected FRCS system/device is capable of supporting configuration control allowing the FRCS to be fully managed…