2.01b -N0018925QZ727.pdf

SEE ADDENDUM

(No Collect Calls)

N0018925QZ272 05-May-2025

b. TELEPHONE NUMBER

757-651-9195

8. OFFER DUE DATE/LOCAL TIME

02:00 PM 06 May 2025

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA X ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

N001899. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

DAKOTA W. LAUGHLIN

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

1 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.X

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

1301201436

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED ORX

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

NAVSUP FLC NORFOLK CONTRACTING

NORFOLK OFFICE

ATTN: D LAUGHLIN

1968 GILBERT ST, SUITE 600

NORFOLK VA 23511-3392

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE W23A7S 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

FORENSIC TOXICOLOGY DRUG TESTING

GREGORY D. REYNOLDS

LABORATORY FORT MEADE

2490 WILSON STREET

FORT MEADE MD 20755-5235

TEL: FAX:

FAX:

TEL: 757-651-9195 SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

1,000

NAICS:

334516

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF62

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

N0018925QZ272

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 1 Each Beckman Coulter AU5820 Analyzer

FFP

One (1) Beckman Coulter AU5820 immunochemistry screen analyzer system. See Requirements List for more specifications.

FOB: Destination

BRAND NAME/SOLE SOURCE: BN

MFR PART NR: AU5820

PURCHASE REQUEST NUMBER: 1301201436

PSC CD: 6630

NET AMT

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 31-JUL-2025 1 FORENSIC TOXICOLOGY DRUG TESTING

GREGORY D. REYNOLDS

LABORATORY FORT MEADE

2490 WILSON STREET

FORT MEADE MD 20755-5235

FOB: Destination

W23A7S

REQUIREMENTS LIST

REQUIREMENTS LIST

IMMUNOCHEMISTRY SCREENING ANALYZER SYSTEM (BECKMAN COULTER AU 5820)

The Department of Defense (DoD) Drug Testing Program (DTP) has a requirement for one (1) high speed immunochemistry screening analyzer systems (Beckman 5820). The system shall consist of the hardware and software required to process urine specimens with high throughput capacity, maintain the identity of each test performed on each sample, perform urinalysis testing, store the results, transmit the data via an interface to the DoD Drug Demand Reduction Program (DDRP) Laboratory Information Management System (LIMS), and print a report of results on command.

Requirement

One (1) Beckman Coulter AU 5820 system

Delivery Address Army Forensic Toxicology Drug Testing Laboratory (AFTDTL) 2490 Wilson Street Fort Meade, MD 20755-5235

Definitions

Adulterant Testing. Analysis to determine whether or not a urine specimen is valid including, but not limited to, pH, specific gravity, creatinine, nitrites, and chromate tests.

Analyzer. Any single unit of the system that possesses all components necessary to perform urinalysis testing. This can take the form of a standalone analyzer, or a specific module or combinations of modules to perform this function.

Consumable Supplies. Items that are necessary for proper system function that are consumed, or rendered otherwise unusable, during operation of the system or require replenishment on a routine basis. This may include, but is not limited to, acid/base wash solutions, detergents, etc. This does not include immunoassay reagents.

Disposable Supplies. Items that are required to operate the system and requires replacement on a periodic basis due to wear or required replacement based upon samples processed. This may include but is not limited to lamps, probes, tips, pipettes, needles, stirrers, cuvettes, bottles, nozzles, sample cups, etc

DoD Cutoffs. The DoD established concentration of drug in urine (ng/mL) which serves as an administrative break point between a negative (below the cutoff) and a positive (at or above the cutoff) specimen. The current DoD DDRP immunoassay screening cutoff levels and calibrator compounds are:

Immunoassay Screening Cutoff (ng/mL) Amphetamines (Amphetamine/Methamphetamine) 500 Designer Amphetamines (MDMA) 500 Benzodiazepines (Oxazepam) 200 Cannabinoids (Δ9-THC-COOH) 50 Synthetic Cannabinoids (JWH-018) 10 Cocaine Metabolites (Benzoylecgonine) 150 Lysergic Acid Diethylamide (LSD) 0.5 Opioids (Morphine) 2,000 Opioids (6-Acetylmorphine) 10 Opioids (Oxycodone) 100 Opioids (Hydrocodone) 100 Opioids (Fentanyl) 1

LIMS. The DoD Drug Demand Reduction Program Forensic Toxicology Drug Testing Laboratory Information Management System.

Sample Processing Units. All components necessary for processing samples (specimens, controls, calibrators, blanks) on the analyzer. This includes, but is not limited to trays, sample/calibrator/control racks, carriages, tube holders, inserts, adapters, etc.

System. A system is comprised of the components necessary to satisfy all government requirements. A system may be comprised of multiple analyzers.

Warranty Repair Time. Time it takes to restore the system to full service.

Essential Characteristics: Minimum Requirements

1) General Requirements

1. The system shall be capable of randomly performing at least twelve (12) drug tests simultaneously on human urine samples including Cloned Enzyme Donor Immunoassay (CEDIA), Diagnostic Reagent Immunoassay (DRI), Enzyme Multiplied Immunoassay Technique (EMIT), Kinetic Interaction of Microparticles in Solution (KIMS), and Enzyme Immunoassay (EIA) tests for the current DoD urinalysis panel.

2. The system shall be capable of performing validity testing (adulterant testing).

3. The system shall be capable of conducting the required analyses without system modifications.

4. The system may consist of multiple analyzer modules or components to meet the throughput performance requirements of the government.

5. For installation, the system should be capable of fitting through a standard 42-inch doorway.

6. Option systems must meet all of system requirements unless otherwise specified and must be fully compatible with the base system requirements.

7. The electrical requirement is 120-240 VAC, 60 Hz.

8. The system shall utilize commercially available test tubes.

2) System Performance Requirements

1. The system shall be capable of processing at least 4,000 tests per hour (a minimum of 300 samples per hour for a minimum of 12 unique tests) and comply with DoD 1010.16 requirements (https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodi/101016p.pdf) for military drug testing and National Laboratory Certification Program (NLCP) guidelines (https://www.federalregister.gov/documents/2017/01/23/2017-00979/mandatory-guidelines-for-federal-workplace-drug-testing-programs) for federal workplace drug testing.

2. The system shall be designed such that, if any single modular component of the system fails, the throughput of the system shall remain at least 300 samples per hour with a minimum of 12 unique tests per sample.

3. The system shall be capable of operating for a minimum of eighteen (18) hours per day, for five (5) days per week, with an expected life cycle of at least seven (7) years.

4. The system shall allow authorized users to modify configurations for reagents, calibrators, controls, testing parameters, test channels, and statistical analysis modules.

5. The system shall include sufficient sample processing units (i.e. racks, trays, inserts, adaptors, etc.) to hold at least 6,000 samples during pre- and post-processing storage.

6. The system shall include an uninterrupted power supply (UPS) that will provide sufficient power for the system to complete the operation in progress and allow the operator sufficient time to properly shut down the system without loss of data.

7. The system shall require a maximum work area of no greater than 25 feet by 12 feet (300 sq ft). This includes all workspace required for the system, for technicians to perform operations at or above the required throughput, for preventive and corrective maintenance, and for ancillary equipment while meeting all environmental conditions for optimal operation of the system.

8. The system shall include all hardware, software, and firmware capable of unambiguously identifying the sample throughout the testing process, and to maintain the results of each sample without confusion with other samples or other tests being conducted on the same sample.

9. The system shall have barcode reader capability (Code 3 of 9 and Code 128) which ensures the sample and data are uniquely identified. The barcode reader shall accurately read an 11-character alpha-numeric identifier printed on a label (using a 300 DPI printer) and placed on the sample tube. The system shall be capable of testing a sample even if it is unable to read the barcode.

10. The system shall permit the user to define the nominal cutoff value (i.e., a value that distinguishes a negative from a positive sample).

11. The system shall provide refrigeration for the reagent reservoirs.

12. The system shall have reagent reservoir capacity to process 1,600 samples for a minimum of 12 tests without refill.

13. The system shall be capable of being safely operated without operator contact with hazardous materials.

3) Warranty and Maintenance Requirements

1. The Contractor shall provide a commercial warranty with terms at least as favorable to the Government as the most favorable terms offered to any other purchaser.

2. The warranty coverage shall include semi-annual preventive maintenance of the entire system.

3. The system shall be within manufacturer service life (i.e., parts and maintenance available) for a minimum of 7 years from the date of installation.

4. Contractor shall provide information on service and maintenance plan options for all proposed equipment.

4) User Security Access Requirements

1. The system shall include software with multiple password protected security access levels to data files and parameters. Security access levels shall either be configured by the laboratory or by the contractor upon request during the warranty period to meet the requirements of the government.

2. The system shall include a minimum of two (2) security access levels: Operator and Supervisor/Administrator.

3. The system shall include an audit trail capable of tracking the date, time, and edits (including values before and after the edit). The audit trail information shall be capable of being transmitted across the interface to the LIMS.

5) LIMS Interface Requirements

1. The contractor shall provide all necessary hardware and software to interface the system with the existing military drug testing LIMS through the laboratory’s Data Innovations Instrument Manager v8.17.20 or Greater.

Each Lab utilizes DI Instrument Manager and we want to keep this as an Essential Characteristic.

2. The contractor shall provide to the government or its designated representative the operational and technical support to interface the system with the existing military drug testing LIMS until successful validation is complete. This support shall be provided for the duration of the warranty period.

3. The contractor shall provide initial responses to the government’s questions about the system/LIMS interface within 3 business days of receipt. This support shall be provided for the duration of the warranty period.

4. Successful completion and validation of the interface shall occur no later than 30 days after installation of the first system. The implementation of the interface is required as part of the system installation for subsequent laboratories.

5. The contractor shall provide full user guide documentation and interface specifications (including hardware and software specifications) to the government.

6. If the system/computer controller has a macro or a programming language, the vendor shall provide documentation on the language to include a manual on all macro/program language commands and syntax.

7. The system/LIMS interface should provide a means to identify the sequence in which all samples, standards, controls, and blanks were loaded, run, processed, and results transmitted via the interface to the LIMS (i.e., date/time/unique identifier stamp).

8. The system/LIMS interface should accept test requests from the LIMS to include discrete sample testing requests as well as a batch/sample organization of test requests.

9. The system/LIMS interface should have the ability to package and send test results in real time; identifiers will include Laboratory Accession Number (LAN) and batch number.

10. The System/LIMS interface should print results upon command.

6) Other Contract Requirements

1. The Contractor shall complete a site survey of each laboratory site at least two months prior to delivery to verify utilities (power, water, sewer, ventilation, heating, air conditioning) and other requirements are available and meet the contractor’s specification prior to installation. All associated costs to meet this requirement shall be included in contractor proposals within the cost of the system.

2. Upon award, the Contractor shall provide a tentative scheduling timeline for site surveys, delivery, installation, and validation/check-out at each site, however, the contractor must agree to work within the scheduling timeline approved by the government.

3. The Contractor shall deliver, setup, install, and validate performance of all system components prior to government acceptance of the system.

4. The Contractor shall provide all cables needed to interface the system to the LIMS. Any additional equipment, identified during installation or during the first year of operation, necessary for optimal operation shall be provided to the government at no additional cost.

5. The Contractor shall provide the technical support necessary to set-up and configure the system to operate optimally with all reagent kits and meet the stated throughput requirements.

6. The Contractor shall provide a list of which vendor reagents by drug class are compatible with the contractor’s system.

7. The Contractor shall provide a list of all consumable supplies and their estimated replenishment frequencies, based upon the government’s defined annual workload of 1 million specimens per a lab.

8. The Contractor shall provide a list of all disposable supplies and their estimated replacement frequencies, based upon the government’s defined annual workload of 1 million specimens per a lab.

9. The Contractor shall preclude backorders of necessary material required to operate the systems by maintaining sufficient availability of the materials required to support the 6 laboratory sites.

10. The Contractor shall provide supplies in accordance with the material requirements and specifications of the original equipment manufacturer (OEM).

11. The Contractor shall provide supplies that are new, not refurbished/reissued, and free of defect in manufacture or workmanship unless approved by the Government.

12. The Contractor shall replace, at no cost to the Government, any supplies returned by the laboratories due to defects in manufacture, workmanship, or shipment from the contractor's origination site.

13. The Contractor shall immediately notify the laboratories and contracting office of any recall notification of materials found to be defective.

14. The Contractor shall be responsible for repairs associated with damage to a system due to defective contractor-supplied materials used in the routine maintenance and operation.

15. The Contractor shall not assume a verbal or written inquiry as authorization to provide services not specifically covered by the terms of the contract.

16. The Contractor shall provide documentation of ISO 9001 or ISO 13485 certification with the proposal and maintain certification for the duration of the warranty period.

17. The Contractor shall provide Operator Training onsite at each DoD laboratory in association with system installation and will accommodate the number of laboratory personnel requiring training. The number of laboratory personnel requiring training should not exceed 15 people per laboratory. After training, government personnel shall be capable of carrying out normal system operation.

18. The Contractor shall provide an Operator Training Manual with the proposal and with each system.

19. The Contractor shall provide Training Course Descriptions with the proposal.

20. Determine barcode read accuracy per 100,000 reads provide this information as raw data and in graphic format to the government.

21. The Contractor should provide documentation of carryover study data with the proposal. At a minimum, the studies shall show the system’s profile of carryover from at least 10 replicates of a series of positive urine samples at 100X, 1,000X, 10,000X, and 100,000X the cutoff concentrations for each drug class as listed in the Definitions (DoD Cutoffs). This information shall be provided as raw data and in graphic format.

7) The system shall be compliant with the Food and Drug Administration (FDA) requirements to market and deliver medical products for use in the United States of America, even should delivery be requested outside of the United States. The claims made for the product shall comply with the regulations of the FDA with respect to products for marketing and delivery of a medical product for use in the United States of America, even should delivery be requested outside of the United States. The system shall be installed in compliance with OSHA requirements.

8) Vendor shall be an Original Equipment Manufacturer (OEM) authorized dealer, authorized distributor or authorized reseller for the proposed equipment/system such that OEM warranty and service are provided and maintained by the

OEM. All software licensing, warranty and service associated with the equipment/system shall be in accordance with the OEM terms and conditions.

9) Upon delivery, the vendor shall be responsible for uncrating the unit/system and transporting it through the facility to the location of intended use for installation. If interim storage is required, the vendor shall arrange the storage.

Enhancing Factors

1. The system should be capable of performing more than twelve (12) tests simultaneously without reduction of sample throughput.

2. The system should be capable of performing supplemental reflex testing. The reflex test should report the timestamp (or other sequence identifier) based on the physical order of the samples.

3. The system should be equipped with reagent reservoir capacity to process more than 5,000 samples for a minimum of twelve (12) tests without requiring refill.

4. The system should have more than ten (10) and preferably more than twenty (20) open channels.

5. The system instrument database should be capable of capturing at least five (5) discreet analytical runs for a single sample that is labeled with the same identifier.

6. The system should permit on-screen review of calibration and quality control information in real-time.

7. The system should automatically transmit all quality control and reagent information (i.e., lot numbers, expiration dates, etc) to the LIMS.

8. The system should permit either single point or multipoint best fit curve calibration.

9. The system should permit drug analyses in qualitative and semi-quantitative modes. Specimens and controls shall be compared to the calibration for determination of drug presence in quantitative and semi-quantitative modes. All data needed to perform these functions shall be transmitted to the LIMS.

10. The system should have automated startup, shutdown, and maintenance procedures, such that the operator does not have to return to the system to input individual instructions/commands.

11. The system should have an integrated wash function and perform cuvette integrity checks (when applicable).

12. The system should have an audible and visual alarm to alert the operator of operational failures. The alarm notification should be captured in the data printout and saved to the database.

13. The system should be capable of operating at no less than the minimum sample throughput (described above) for

95% of each laboratory’s production hours each month (i.e., at least 19 of 20 workdays per month).

14. The system/LIMS interface should have bidirectional, real-time data transfer capability and batch processing functionality.

15. The system/LIMS interface should be robust enough to withstand government security scanning and patch management by Information Assurance (IA) and continue to transmit test requisitions and sample test results.

16. The system/LIMS interface should transmit data between the analyzer system and the interface via TCP/IP-Ethernet.

17. The system/LIMS interface should allow real-time transmission of all Calibration, Quality Control, individual sample test results data, and all applicable error codes (flags) to the LIMS.

18. The system/LIMS interface should allow processing of samples even if the LIMS is offline. If the LIMS is off line, the interface should save test results until LIMS is available and then allow result transmission.

19. The system should allow full data review if data is stored in a vendor supplied database.

20. The required Operator and Supervisor/Administrator security levels should have permissions as follows:

i) Level 1 – Operator

(1) Able to operate the system for calibration/processing/reprocessing samples and controls

(2) Able to acknowledge alarms and warnings but, not able to clear alarm logs

(3) Able to perform user maintenance procedures

(4) Not able to change configuration options

ii) Level 2 – Supervisor/Administrator

(1) All Operator attributes

(2) Able to add/change reagents

(3) Able to perform database backups and export data

(4) Able to modify configurations for reagents, calibration, controls, testing parameters, and statistical analysis modules

(5) Able to configure user access for Level 1

(6) Able to access all modes, configurations, and parameters

(7) Able to clear alarm logs

21. The system should include more than 2 security access levels.

22. The system/LIMS interface should be capable of transmitting and receiving system control commands.

23. The system/LIMS interface should have redundant capacity; the failure of a single component of the interface should not prevent the operation of the interface or should allow the recovery of the interface within two (2) hours.

24. The system/LIMS interface should be capable of operating over a wide area network (WAN).

25. The LIMS Interface Software will be capable of installation onto a DHA Hardened Microsoft 2016 Server or

Greater Operating System.

26. The temperature of the reagent compartments and the charge status of the UPS can be monitored remotely using an

Ethernet connection.

27. The system audit trail should be capable of tracking the user.

28. The system should be capable of utilizing barcode labels in current use at the 6 DoD lab sites without modification to the system or labels.

29. The warranty response time should ensure that a service technician is capable of on-site response within 12 business hours of notification of a system malfunction.

30. The warranty repair time should not exceed 24 business hours from notification of a system component failure.

31. Permit the use of two- and three-component reagent assay kits. The use of a combination of two and three component reagent assay kits must maintain the required throughput.

32. Require no more than 2 technicians per 8-hour shift to achieve the specified throughput.

33. Be capable of storing a minimum of 1,000,000 test results. It shall also provide utilities to backup and restore the database within 24 hours.

34. The system/LIMS interface should occur through an encryption or authentication communication.

Defense Health Agency (DHA) Medical Device and Equipment (MDE) Cybersecurity/Risk Management Framework (RMF) Continuous Monitoring/Cybersecurity Maintenance Contracting Requirements

RMF Continuous Monitoring/Cybersecurity Maintenance:

For the purposes of this contract, MDE is defined as any system, device, or software intended for use in, or in direct support of, the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, or equipment used in the direct support of the medical mission.

The vendor shall agree to comply with References listed in Section: 2 Cybersecurity Regulations and Guidance.

1. Warranty and Post-Warranty Service Maintenance Agreement Cybersecurity Requirements/Continuous

Monitoring/Risk Management.

1.1. In accordance with SEC. 524B. of the ‘Consolidated Appropriations Act, 2023’ titled ENSURING CYBERSECURITY OF DEVICES, the vendor shall design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure, and make available postmarket updates and patches to the device and related systems on a reasonably justified regular cycle, or as soon as possible for critical vulnerabilities that could cause uncontrolled risks. The vendor shall disclose if patching can be accomplished by the government, or if a specialized support is required to maintain a compliant cybersecurity posture.

1.2. Continuous monitoring requires software updates/upgrades, patch management, application of DoD required security configurations via Security Technical Implementation Guides (STIGs), vulnerability scanning, and remediation of discovered vulnerabilities.

1.3. The vendor shall establish and maintain a test/laboratory environment that includes all contract/ordered equipment, to include 3rd party components that fall under the authorization boundary, and/or included in this contract/order, to support the RMF/Cybersecurity requirements. The vendor test lab shall be used for all self-assessment activities, Independent Verification and Validation (IV&V) compliance testing, and post Authority to Operate (ATO), or RMF Approval (herein referred to as Approval) actions for as long as the system is supportable by the vendor. Supportable is defined as serviceable by a qualified Service Engineer or Original Equipment Manufacturer (OEM).

1.4. The vendor shall update all ATO or approved products required supporting documentation in the event of a system policy, procedural, logical or technical changes to the system or device.

1.5. The vendor shall maintain the authorized security configuration and notify the government for approval prior to instituting changes to devices installed within the DHA network. A major upgrade such as major software or hardware revision must be reassessed for RMF Compliance, or addition to the approved products list. Minor upgrades must be assessed by the Government to determine if a reauthorization is required. The Vendor shall support reauthorizations due to both major and minor upgrades.

1.6. The vendor shall ensure its device or system is in compliance with the DoD IAVM program upon each deployment.

1.7. The vendor shall ensure any deployment post acceptance (including rebuilds) deploys with a fully-patched, approved version. Prior to final acceptance and installation, the vendor shall coordinate running Nessus and SCAP scans, or the vendor prescribed alternative procedures required to validate the configuration, with the site and the assigned DHA Cybersecurity Analyst to verify compliance. Any deviations from the approved configuration shall require the vendor to bring the system into compliance prior to final acceptance, and putting the system in operation.

1.8. The vendor shall maintain the system or device and update to comply with updated STIGs made available by the Government within three (3) months of notification by the Government.

1.9. The vendor shall provide vulnerability and configuration scan results using Nessus and the DHA policy to the Government monthly, providing raw scan results and administrative reports no later than the tenth (10 th

) calendar day of each month.

1.10. The vendor shall close all discovered vulnerabilities, or shall submit to the Government for approval Plans of Actions and Milestones (POA&M) outlining mitigation and timelines for closing any open vulnerabilities within one (1) month of discovery.

1.11. The vendor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to the Government for approval.

1.12. The vendor shall use the Government-approved method for remote access administration (DHA B2B) of the system or device.

2. Cybersecurity Regulations and Guidance

The vendor shall use and comply with the most recent published versions of the following references, as well as all regulations or guidance referenced within those publications:

(a) United States Law

(i) The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

(ii) The Federal Information Security Management Act (FISMA)

(iii) The E-Government Act of 2002

(iv) H.R.2617—Consolidated Appropriations Act, 2023

(b) OMB

(i) Circular A-130

(ii) Guidance M-05-24, Implementation of Homeland Security Presidential Directive

(HSPD) 12—Policy for a Common Identification Standard for Federal Employees and Vendors

(c) National Institute of Standards and Technology (NIST)

(i) NIST Special Publication (SP) 800-37 Rev. 2—Guide for Applying the RMF to Federal Information Systems

(ii) NIST SP 800-39—Managing Information Security Risk: Organization, Mission and Information System View

(iii) NIST SP 800-53 Rev. 5—Security and Privacy Controls for Federal Information Systems and Organizations

(iv) NIST SP 800-60—Volume 1 Revision 1: Guide for Mapping Types of Information and Information Systems to Security Categories

(d) Federal Information Processing Standards (FIPS)

The following publications are located at

(i) FIPS Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic

Modules

(ii) FIPS PUB 199, Standards for Security Categorization of Federal Information and

Information Systems

(iii) FIPS PUB 200, Minimum Security Requirements for Federal Information and

Information Systems

(iv) FIPS PUB 201-3, Personal Identity Verification of Federal Employees and Vendors

(e) DoD

(i) DoD Instruction 5200.02, DoD Personnel Security Program (PSP)

(ii) DoD Instruction 8500.01, Cybersecurity

(iii) DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK)

Enabling

(iv) DoD Instruction 8510.01, RMF

(v) DoD Instruction 8551.01, Ports, Protocols, and Services Management (PPSM)

(vi) DoD Instruction 8580.02, Security of Individually Identifiable Health Information in

DoD Health Care Programs

(vii) DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in DoD Health Care Programs

(viii) DoD Directive 5400.11, DoD Privacy Program

Additional requirements for Information Assurance (IA):

1. The system, including all contractor and sub-contractor-provided hardware and software, shall undergo Information

Assurance (IA) Certification and Accreditation (C&A) for the Drug Demand Reduction Program (DDRP) Enclave.

The system shall successfully receive Authority to Operate (ATO) or Access and Incorporate (A&I) into the DDRP Enclave Accreditation Boundary. If the C&A process identifies issues which would lead to denial of ATO, or failure to meet A&I requirements contractor shall remedy the issues to the satisfaction of the government within six

(6) months of notification. If the C&A or A&I process identifies issues which would lead to denial of Interim Authority to Operate (IATO), contractor shall remedy the issues to the satisfaction of the government within six (6) months of notification. The vendor shall meet with the government to provide a plan to address the issues identified.

The vendor shall provide a monthly status report on the progress addressing the issues.

2. The contractor shall comply with the enclosed other contracting requirements. As part of the proposal, the contractor shall submit the enclosed Medical Device and Equipment Risk Assessment questionnaire.

3. Remote Connectivity or Remote Administration of any kind into a DOD Drug Screening/Testing Lab is strictly prohibited. Vendor must perform all IT administration on-site.

4. Contractor will be responsible for complying with all current and future versions of the DISA Security Technical Implementation Guides (STIGS) for Hardware and Software that supports vendor’s system

5. Vendor is responsible to perform Operating System Upgrades as required by DOD.

6. Vendor will allow DOD Vulnerability Scanner to Scan Workstation and Peripheral Devices for Information

Assurance and Vulnerability Analysis.

7. Vendor is responsible to ensure continued compliance with Information Vulnerability Security Alerts, Security

Patches and Security Compliance Settings to maintain acceptable IA Posture inside the DDRP Enclave. Vendor will perform all Patches, Security Configurations, Upgrades required within 30 Days of notification of a Vulnerability discovered.

8. Vendor shall comply will all requirements of the Defense Health Agency (DHA) Cyber Logistics (CyberLOG) Cybersecurity/Risk Management Framework (RMF).

CLAUSES INCORPORATED BY REFERENCE

52.203-3 Gratuities APR 1984 52.203-12 Limitation On Payments To Influence Certain Federal

Transactions

JUN 2020

52.204-7 System for Award Management NOV 2024 52.204-9 Personal Identity Verification of Contractor Personnel JAN 2011 52.204-13 System for Award Management Maintenance OCT 2018 52.204-16 Commercial and Government Entity Code Reporting AUG 2020 52.204-18 Commercial and Government Entity Code Maintenance AUG 2020 52.204-26 Covered Telecommunications Equipment or Services--

Representation.

OCT 2020

52.204-29 Federal Acquisition Supply Chain Security Act Orders-- Representation and Disclosures.

DEC 2023

52.209-10 Prohibition on Contracting With Inverted Domestic Corporations

NOV 2015

52.211-6 Brand Name or Equal AUG 1999 52.212-1 Instructions to Offerors--Commercial Products and

Commercial Services

SEP 2023

ADDENDUM TO 52.212-1

ADDENDUM TO 52.212-1

All quotes shall be submitted via email by 8:00 AM Philadelphia, PA time on 06 May 2025 to Dakota Laughlin at dakota.w.laughlin.civ@us.navy.mil.

CLAUSES INCORPORATED BY REFERENCE

52.212-4 Contract Terms and Conditions--Commercial Products and

Commercial Services

NOV 2023

52.229-11 Tax on Certain Foreign Procurements--Notice and Representation

JUN 2020

52.232-39 Unenforceability of Unauthorized Obligations JUN 2013 52.242-13 Bankruptcy JUL 1995 52.247-34 F.O.B. Destination JAN 1991 252.203-7000 Requirements Relating to Compensation of Former DoD

Officials

SEP 2011

252.203-7002 Requirement to Inform Employees of Whistleblower Rights DEC 2022 252.204-7003 Control Of Government Personnel Work Product APR 1992 252.204-7004 Antiterrorism Awareness Training for Contractors JAN 2023 252.204-7012 (Dev) Safeguarding Covered Defense Information and Cyber

Incident Reporting (DEVIATION 2024-O0013 REVISION 1)

MAY 2024

252.204-7015 Notice of Authorized Disclosure of Information for Litigation Support

JAN 2023

252.204-7018 Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services

JAN 2023

252.209-7004 Subcontracting With Firms That Are Owned or Controlled By The Government of a Country that is a State Sponsor of Terrorism

MAY 2019

252.211-7003 Item Unique Identification and Valuation JAN 2023 252.211-7008 Use of Government-Assigned Serial Numbers SEP 2010 252.223-7006 Prohibition On Storage, Treatment, and Disposal of Toxic or

Hazardous Materials

SEP 2014

252.225-7001 Buy American and Balance of Payments Program FEB 2024 252.225-7002 Qualifying Country Sources As Subcontractors MAR 2022 252.225-7048 Export-Controlled Items JUN 2013 252.225-7052 Restriction on the Acquisition of Certain Magnets, Tantalum, and Tungsten.

MAY 2024

252.225-7972 (Dev) Prohibition on the Procurement of Foreign-Made Unmanned Aircraft Systems (DEVIATION 2024-O0014)

AUG 2024

252.225-7973 (Dev) Prohibition on the Procurement of Foreign-Made Unmanned Aircraft Systems - Representation (DEVIATION 2024- O0014)

AUG 2024

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports

DEC 2018

252.232-7010 Levies on Contract Payments DEC 2006 252.237-7010 Prohibition on Interrogation of Detainees by Contractor

Personnel

JAN 2023

252.243-7002 Requests for Equitable Adjustment DEC 2022 252.244-7000 Subcontracts for Commercial Products or Commercial

Services

NOV 2023

252.247-7023 Transportation of Supplies by Sea OCT 2024

CLAUSES INCORPORATED BY FULL TEXT

52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS AND VIDEO

SURVEILLANCE SERVICES OR EQUIPMENT (NOV 2021)

The Offeror shall not complete the representation at paragraph (d)(1) of this provision if the Offeror has represented that it "does not provide covered telecommunications equipment or services as a part of its offered products or services to the Government in the performance of any contract, subcontract, or other contractual instrument" in paragraph (c)(1) in the provision at 52.204-26, Covered Telecommunications Equipment or Services-- Representation, or in paragraph (v)(2)(i) of the provision at 52.212-3, Offeror Representations and Certifications- Commercial Products and Commercial Services. The Offeror shall not complete the representation in paragraph (d)(2) of this provision if the Offeror has represented that it "does not use covered telecommunications equipment or services, or any equipment, system, or service that uses covered telecommunications equipment or services" in paragraph (c)(2) of the provision at 52.204-26, or in paragraph (v)(2)(ii) of the provision at 52.212-3.

(a) Definitions. As used in this provision-

Backhaul, covered telecommunications equipment or services, critical technology, interconnection arrangements, reasonable inquiry, roaming, and substantial or essential component have the meanings provided in the clause 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

(b) Prohibition.

(1) Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L.

115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. Nothing in the prohibition shall be construed to--

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(2) Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L.

115-232) prohibits the head of an executive agency on or after August 13, 2020, from entering into a contract or extending or renewing a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This prohibition applies to the use of covered telecommunications equipment or services, regardless of whether that use is in performance of work under a Federal contract. Nothing in the prohibition shall be construed to--

(i) Prohibit the head of an executive agency from procuring with an entity to provide a service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection arrangements; or

(ii) Cover telecommunications equipment that cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.

(c) Procedures. The Offeror shall review the list of excluded parties in the System for Award Management (SAM) (https://www.sam.gov) for entities excluded from receiving federal awards for "covered telecommunications equipment or services."

(d) Representations. The Offeror represents that--

(1) It [ ___ ] will, [ ___ ] will not provide covered telecommunications equipment or services to the Government in the performance of any contract, subcontract or other contractual instrument resulting from this solicitation. The Offeror shall provide the additional disclosure information required at paragraph (e)(1) of this section if the Offeror responds "will" in paragraph (d)(1) of this section; and

(2) After conducting a reasonable inquiry, for purposes of this representation, the Offeror represents that--

It [ ___ ] does, [ ___ ] does not use covered telecommunications equipment or services, or use any equipment, system, or service that uses covered telecommunications equipment or services. The Offeror shall provide the additional disclosure information required at paragraph (e)(2) of this section if the Offeror responds "does" in paragraph (d)(2) of this section.

(e) Disclosures.

(1) Disclosure for the representation in paragraph (d)(1) of this provision. If the Offeror has responded "will" in the representation in paragraph (d)(1) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment--

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the original equipment manufacturer (OEM) or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(ii) For covered services--

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the Product Service Code (PSC) of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(1) of this provision.

(2) Disclosure for the representation in paragraph (d)(2) of this provision. If the Offeror has responded "does" in the representation in paragraph (d)(2) of this provision, the Offeror shall provide the following information as part of the offer:

(i) For covered equipment--

(A) The entity that produced the covered telecommunications equipment (include entity name, unique entity identifier, CAGE code, and whether the entity was the OEM or a distributor, if known);

(B) A description of all covered telecommunications equipment offered (include brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); and

(C) Explanation of the proposed use of covered telecommunications equipment and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

(ii) For covered services--

(A) If the service is related to item maintenance: A description of all covered telecommunications services offered (include on the item being maintained: Brand; model number, such as OEM number, manufacturer part number, or wholesaler number; and item description, as applicable); or

(B) If not associated with maintenance, the PSC of the service being provided; and explanation of the proposed use of covered telecommunications services and any factors relevant to determining if such use would be permissible under the prohibition in paragraph (b)(2) of this provision.

(End of provision)

52.212-2 EVALUATION--COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES (NOV 2021)

(a) The Government will award a contract resulting from this solicitation to a responsible contractor with respect to performance as well as a fair and reasonable price.

(b) A written notice of award or acceptance of an offer, mailed or otherwise furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contract without further action by either party. Before the offer's specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS--COMMERCIAL PRODUCTS AND

COMMERCIAL SERVICES (DEVIATION 2025-O0003/ DEVIATION 2025-O0004) (MAR 2025)

The Offeror shall complete only paragraph (b) of this provision if the Offeror has completed the annual representations and certification electronically in the System for Award Management (SAM) accessed through https://www.sam.gov. If the Offeror has not completed the annual representations and certifications electronically, the Offeror shall complete only paragraphs (c) through (v) of this provision.

(a) Definitions. As used in this provision --

"Covered telecommunications equipment or services" has the meaning provided in the clause 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment.

"Economically disadvantaged women-owned small business (EDWOSB) concern" means a small business concern that is at least 51 percent directly and unconditionally owned by, and the management and daily business operations of which are controlled by, one or more women who are citizens of the United States and who are economically disadvantaged in accordance with 13 CFR part 127, and the concern is certified by SBA or an approved third-party certifier in accordance with 13 CFR 127.300. It automatically qualifies as a women-owned small business eligible under the WOSB Program.

"Forced or indentured child labor" means all work or service-

(1) Exacted from any person under the age of 18 under the menace of any penalty for its nonperformance and for which the worker does not offer himself voluntarily; or

(2) Performed by any person under the age of 18 pursuant to a contract the enforcement of which can be accomplished by process or penalties.

"Highest-level owner" means the entity that owns or controls an immediate owner of the offeror, or that owns or controls one or more entities that control an immediate owner of the offeror. No entity owns or exercises control of the highest level owner.

"Immediate owner" means an entity, other than the offeror, that has direct control of the offeror. Indicators of control include, but are not limited to, one or more of the following: Ownership or interlocking management, identity of interests among family members, shared facilities and equipment, and the common use of employees.

"Inverted domestic corporation" means a foreign incorporated entity that meets the definition of an inverted domestic corporation under 6 U.S.C.