N62645-15-R-1008.pdf

SEE ADDENDUM

(No Collect Calls)

N62645-15-R-1008 05-Jun-2015

b. TELEPHONE NUMBER

301-619-1086

8. OFFER DUE DATE/LOCAL TIME

01:00 PM 06 Jul 2015

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA X ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

N626459. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

BRIAN D. MILLER

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.X

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

N6264515RCP3501

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED ORX

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

NAVAL MEDICAL LOGISTICS COMMAND

693 NEIMAN STREET

FORT DETRICK MD 21702-9239

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE N63439 16. ADMINISTERED BY

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

NAVAL OPHTHALMIC SUPPORT & TRAINING ACT

STEVEN HOSTETLER

160 MAIN ROAD, STE 350 (BLDG 1794)

YORKTOWN VA 23691-9984

TEL: 757-887-7562 FAX:

FAX:

TEL: SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

NAICS:

339112

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF48

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

N62645-15-R-1008

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 1 Each

OPTICAL FABRICATION ASSEMBLY LINE

FFP

FOB: Destination

MILSTRIP: N6264515RCP3501

PURCHASE REQUEST NUMBER: N6264515RCP3501

ADDITIONAL MARKINGS: ATTN: MR HOSTETLER, N63439-5027-3501,

TP3,ACN: N63439-140001

NET AMT

INSTRUCTIONS TO OFFERORS

DoD established the Naval Medical Logistics Command (NMLC) as the Executive Agent for a complete optical fabrication assembly line including lens generators and lens blockers for Naval Ophthalmic Support and Training

Activity (NOSTRA). Within the Navy, NOSTRA is the command responsible for performing these objectives.

The North American Industry Classification System (NAICS) code for this requirement is 339112. The Small

Business Administration (SBA) standard size for this NAICS code in number of employees is 500. All qualified offerors are invited to submit a proposal.

This section specifies the format and content that offerors shall use in response to this solicitation. Offerors shall submit a proposal that is legible and comprehensive enough to provide the basis for a sound evaluation by the

Government. Any proposal which does not provide, as a minimum, that which is required within this solicitation may be determined to be substantially incomplete and not warrant any further consideration. The Government intends to award a firm fixed priced (FFP) contract.

Delivery

The Contracting Officer reserves the right to adjust the start date of the contract based on the actual award date.

Period for Acceptance of Offers

The period for acceptance of offers is one hundred twenty (120) days after the closing date of the solicitation.

Pre-Contract Costs

The Contractor will not be reimbursed for any costs incurred prior to the effective date of the contract.

Site Visit

The Government will be providing industry the opportunity for a site visits to NOSTRA. The site visit will be 15

June 2015. Only two (2) employees per company can attend the site visit.

The site visit will consist of the following

Tour of the area will begin at 9:00am.

Vendors should arrive by 8:30 am.

No questions will be asked during the site visit.

NOSTRA

To access NOSTRA offerors will utilize Gate three (3), Pass and ID Office.

The address to use for directions to NOSTRA is as follows:

o 2019 Longfellow Rd. Yorktown, VA. 23691

Vendors will have to escorted once through the gates at NOSTRA. Call 757/ 887-7329 for escort prior to entering the gate.

All personnel will need a driver’s license to gain access to base.

Vehicles are subject to inspection so please allow additional time to pass through the gate.

If a rental vehicle is being used then the Security Office may need to see your rental agreement in addition to the driver’s license.

To gain access to NOSTRA table #1 must be completed and returned to brian.d.miller1.civ@mail.mil no later than 10:00 am local time on 11 June 2015, Subject: N62645-15-R-1008.

Table #1

Last Name First name Middle Name Company

Vendors will park in the front of the building in the marked “visitor” spaces.

Please wear appropriate attire for site visit.

Questions

Any questions must be addressed to brian.d.miller1.civ@mail.mil by email only no later than 2:00 pm local time on

17 June 2015. No phone calls will be accepted.

Proposals

All proposals should be submitted to Brian Miller at brian.d.miller1.civ@mail.mil.

Subject line should read: Solicitation # N62645-15-R-1008

Emails shall be no larger than 10MB

Proposals may be submitted as MS Word, MS Excel or Adobe PDF attachments only.

All Offerors shall provide the following company details on their cover page:

Complete company name and address

Company Point of Contact (POC)

Email

Phone Number

CAGE Code

DUNS number

Place of Manufacture

Technical Approach

The contractor shall submit sufficient documentation to allow for an evaluation of the Technical Approach for a complete optical fabrication assembly line including lens generators and lens blockers for Naval

Ophthalmic Support and Training Activity (NOSTRA) and meet the Statement of Requirements.

The total number of the pages, excluding a cover letter, for Technical Approach is fifty (50) pages. If the

Technical Approach contains more than the mandated page count then only the first fifty (50) pages will be evaluated.

Conformance to the Information Assurance (IA) requirements for the Department of the Navy mailto:brian.d.miller1.civ@mail.mil

Offerors shall complete and submit in its entirety the C&A Questionnaire for the Department of Navy with their proposal. The C&A questionnaire can be found at http://www.med.navy.mil/sites/nmlc/Pages/default.aspx. On the home page, click the Requests for

Proposals (RFPs) link on the left hand side of the site. Scroll to the bottom of the page where the questionnaire information is located and click the link to compete the questionnaire. In addition the

Department of Navy has an IA section that follows the Statement of Requirements.

Past Performance

Offerors may provide recent and relevant contracts for the same or similar items and other references for up to five (5) data points within the last three (3) years. Past performance older than three (3) years will be considered not recent. The Government reserves the right to consider other past performance information at its disposal, in addition to any information obtained from the references provided above.

The data shall for each reference shall include:

o Organization/Location o Valid POC with phone number and email o Contract Number o Contract Date o Total Contract Value o Description of the requirement

The total number of the pages submitted for past performance shall not exceed seven (7) pages, excluding a cover. If past performance contains more than seven (7) pages, only the first seven (7) pages will be evaluated.

Price

Adequate price competition is expected for this acquisition. Offerors shall submit a pricing spreadsheet for all components related to this requirement.

The proposed price will be evaluated by the Government and must be determined to be fair and reasonable for award.

Offerors shall provide acknowledgement of the solicitation and all amendments. The solicitation and all amendments shall be acknowledged through instructions in Block 11 of the SF 30. Signed copies of the cover page are acceptable. It is not necessary to submit the entire amendment.

Completed DFARS 252.209-7992 provision.

Offerors shall be registered in the System for Award Management (SAM) database at time of award.

Registration is free and can be completed on-line at https://www.sam.gov/portal/public/SAM/.

Small Business Subcontracting Plan:

o If applicable (for other than small business concern offerors under the assigned NAICS code herein), the offeror shall submit a subcontracting plan in accordance with FAR Clause 52.219-9 and DFARS

Clause 252.219-7003 (for reference see FAR 19.704 and DFARS 219.704). The subcontracting plan requirement is not applicable to small business concerns qualified as such under the NAICS code assigned to this solicitation. Master subcontracting plans can be included as an appendix to the subcontracting plan.

o The Contracting officer will review the subcontracting plan for acceptability. If an offeror fails to negotiate a subcontracting plan acceptable to the Contracting Officer within the time limit prescribed by the Contracting Officer, the offeror will be ineligible for award.

o If the offeror believes there are no subcontracting possibilities, the offeror shall submit documentation sufficient to support its position.

Offerors shall include all costs associated with DIACAP as a part of CLIN 0001.

Discussions

The Government intends to evaluate proposals and award a single contract without discussions with offerors. The

Government reserves the right to conduct discussions if the Contracting Officer later determines them to be necessary.

http://www.med.navy.mil/sites/nmlc/Pages/default.aspx https://www.sam.gov/portal/public/SAM/

STATEMENT OF REQUIREMENTS

SYSTEM REQUIREMENTS

The Naval Ophthalmic Support and Training Activity (NOSTRA) has a requirement for an automated optical lens fabrication system. The system shall include the following subsystems: Surface Layout Blocking System, Lens

Generating Sytem, and Microseparator Coolant System. The system shall include an automated conveyor system that connects all of the specified subsystems.

The system shall be capable of providing a throughput of at least 175 trays (350 lenses) per hour for a 7 hour shift. The system throughput shall represent 175 trays initiated and completed per hour. The system shall allow for a workflow queue of at least 263 trays to prevent bottlenecking.

Installation shall include removal of the old conveyor system, changes to all electrical and plumbing requirements, testing and adjustments. The proposal shall be a turn-key solution, including any necessary facility modification.

The system shall fit in a 53’ x 40’ floor space and allow for tray flow and parts return functions. Room diagram for the “New System Layout” is provided in Attachment I.

System shall include all manufacturer warranties (up to one (1) year) and operator manuals. On-site operator and maintenance training shall be provided on all equipment. In addition, manufacturer shall guarantee spare parts availability.

SURFACE LAYOUT BLOCKING SYSTEM

The system shall include at least six (6) lens blocking units, to be located at the beginning of the assembly line.

The units shall be capable of utilizing alloy components to adhere a lens to a block.

The units shall be capable of processing two lenses concurrently for left and right lenses.

The units shall be capable of blocking all plastic and mineral lens materials, including but not limited to polycarbonate and high index materials.

The units shall be able to accommodate lens diameters up to at least 85mm. The units shall utilize multiple blocking rings to accommodate for variation in lens thickness; the units shall be able to automatically recognize the size of the blocking ring and notify the operator of any errors.

The units shall be capable of automatically adjusting prism angle, prism basis, and blocking chuck axis.

The units shall be capable of automatically verifying lens position.

The units shall be able to perform prismatic blocking.

The units shall be able to utilize high melting point lead and cadmium free alloys.

The units shall include software with an Optical Manufacturing Association (OMA) compliant interface.

The units shall include a barcode scanner to import lens data.

LENS GENERATING SYSTEM

The system shall include five (5) fully automated CNC (Computer Numerical Controlled) lens generator units. The system shall be able to automatically load lenses from trays from the conveyor system and return completed lenses to tray on conveyor system.

The units shall include software with an Optical Manufacturing Association (OMA) compliant interface.

The units shall be able to process all lens formats and materials, including but not limited to, CR-39, Hi-index, and polycarbonate.

The units shall be able to process lens blanks up to 85 mm diameter.

The units shall be able to generate concave curvatures up to 14.5 diopters and convex curvatures up to -

30.0 diopters.

The units shall be able to auto-calibrate.

The units shall be able to perform high speed cribbing and milling required for specification accuracy and smooth surface after cut.

The units shall produce generated lenses that are immediately ready for polishing.

The units shall allow user access to clean and maintain the equipment.

The units shall be able to automatically remove and dispose of any swarf material from the generator.

The units shall include a temperature monitor.

The units shall include a user interface that will allow the user to manually enter, monitor, or modify information.

MICROSEPARATOR COOLANT SYSTEM

This requirement shall include a microseparator coolant system. The system shall be able to manage fluid and debris waste from the lens generators.

The system shall be able to accommodate digital, conventional or mixed production fabrication and all organic material processing.

The system shall include chip compacting and bulk chip separation capabilities. The chip compactor assembly must separate, compact and dewater bulk chips and reduce waste volume.

The system shall be able to process materials remotely from the generators, if necessary due to layout of the entire production system.

The system shall include an automatic water makeup subsystem and an automatic coolant metering subsystem.

The system shall allow for easy recovery of de-blocked lens without interfering with production.

The system shall include debris containers for handling chip and debris waste.

The system shall be included as a turn-key solution, to include all required installation and setup. The solution shall include all necessary piping and utility hookups.

OTHER SYSTEM REQUIREMENTS

The conveyor system shall allow for clear walkways around the configuration without gates. The walkways shall provide access to all pieces of equipment.

The system shall be designed to withstand exposure to water and polish residue.

The conveyor system shall allow for a lag time of 10 minutes between the blocking units and the lens generating units to allow for alloy curing.

The layout of the system shall account for the installed base on equipment that will be remaining at the site.

All of the following equipment, except for the automated Dynamic Tower System, may be relocated, if necessary. This equipment includes:

o 2 Semi-automatic lens tapers (Practical Systems Inc.)

o 1 Alloy reclaim tank (Satisloh) o 1 Ultrasonic cleaning and drying unit (Branson Omni 2000) o 1 SGX tabletop foam tool generator (Gerber-Coburn) o 5 Automated Dynamic Tower System (P@P Picking Systems) o 15 Toro X-2S Polishers (Satisloh)

The conveyor system shall integrate with the installed base of automated Dynamic Tower System (Model

USA-003A) by P@P Picking Systems. The Dynamic Tower System shall be included in the production line process after the blocking units and the generating units. The conveyor system shall receive optical tool(s) from the tool towers based on the specifications assigned to the job and place the tool(s) on the tray with the assigned lens(es). The conveyor system shall include a return track that will return the tool(s) to the tool towers after completion of the job. The Dynamic Tower Systems are fixed and shall not be relocated.

The conveyor system shall output the trays at the location of the lens polishers. The end of the conveyor system shall allow for appropriate storage and manual distribution of trays to the polishers.

The return track shall integrate with the installed Satisloh ALO 2.0 tool washing unit. The tool washing unit has an independent automatic conveyor loader belt. The return track shall include a tool drying capability that will air dry the washed tools prior to return to the tool tower.

The conveyor system shall include an additional output lane to deliver trays that require an additional/alternative process (i.e. foam-tool generator). This capability shall be initiated via sensor detection and gates.

The conveyor system shall have Emergency stop system in accordance with OSHA standards.

ENHANCING FACTORS

Installation of the complete system should be completed within a fourteen (14) day time period.

The blocking and generating units should be able to utilize or be adapted to utilize 43 mm V-style chuck blocks.

BASIS OF AWARD

This is a best value tradeoff procurement. The Government may elect to award to other than the lowest priced, based on the evaluation of the non-priced factors and the best value to the Government. Technical Approach is more important than Information Assurance and Past Performance. Information Assurance and Past Performance, when combined is more important than Price. Technical Approach, Information Assurance and Past Performance, when combined, are more important than price. Since awards will be made on a best value basis, the Contracting Officer reserves the right to award to other than the lowest priced offeror providing the prices are determined to be reasonable.

The rating scales for Technical Approach, Conformance to IA Requirements and Past Performance are listed following the evaluation criteria within this section. Proposals shall include sufficiently detailed information to enable evaluation based on the following factors:

Technical Approach

The government will evaluate each offer to determine the ability to meet the requirements of the solicitation as described in the Statement of Requirements.

Conformance to IA Requirements

The government will evaluate the capability of the proposed system to meet the Information Assurance

(IA) requirements for the Department of Navy. This evaluation will be based on the information provided in the completed IA documentation.

Past Performance

The government will evaluate the offeror's recent relevant past performance record as to (1) the functional performance of the proposed or similar systems that the offeror has delivered to previous customers, and

(2) the quality and timeliness of the technical assistance that the vendor has supplied to its customers following the initial fielding of those systems.

The Past Performance evaluation will result in an assessment of the offeror’s probability of meeting the solicitation requirements. The government is likely to randomly select references provided for contact and does not commit to contact every reference.

The government reserves the right to consider other past performance information at its disposal, in addition to any information obtained from the references provided above. It is the responsibility of the offerors to ensure names and phone numbers of points of contact are verified and accurate.

Price Adequate price competition is expected for this acquisition. The offeror will be evaluated for reasonableness and completeness.

Reasonableness: The offeror’s proposed price will be evaluated separately to determine the degree to which the total proposed prices represents a fair and reasonable price. The offeror’s total price will be used to evaluate price reasonableness.

Completeness: The offeror's price proposal will be examined to ensure that all items required in the

Instructions to Offeror’s have been submitted and are complete.

RATING SCALES

Combined Technical/Risk Rating. The combined technical/risk rating includes consideration of risk in conjunction with the strengths, weaknesses, and deficiencies in determining technical ratings. The Technical Approach factor will be evaluated using the combined Technical/Risk Rating table.

Rating Description

Outstanding

Proposal meets requirements and indicates an exceptional approach and understanding of the requirements. Strengths far outweigh any weaknesses. Risk of unsuccessful performance is very low.

Good

Proposal meets requirements and indicates a thorough approach and understanding of the requirements. Proposal contains strengths which outweigh any weaknesses. Risk of unsuccessful performance is low.

Acceptable

Proposal meets requirements and indicates an adequate approach and understanding of the requirements. Strengths and weaknesses are offsetting or will have little or no impact on contract performance. Risk of unsuccessful performance is no worse than moderate.

Marginal

Proposal does not clearly meet requirements and has not demonstrated an adequate approach and understanding of the requirements. The proposal has one or more weaknesses which are not offset by strengths.

Risk of unsuccessful performance is high.

Unacceptable Proposal does not meet requirements and contains one or more deficiencies. Proposal is unawardable.

Conformance to Information Assurance requirements

Each offeror’s Information Assurance proposals will be evaluated based on the following ratings:

Rating Definition

Acceptable IA meets Navy requirements based on the information provided and can be approved through the cybersecurity process.

Unacceptable

IA does not meet Navy requirements and contains one or more deficiencies and cannot be approved through the cybersecurity process.

Past Performance Confidence Assessment Ratings

Each offeror will be assigned a Confidence Assessment Rating. There are two aspects to the past performance evaluation. The first is to evaluate the offeror’s past performance to determine how relevant a recent effort accomplished by the offeror is to the effort to be acquired through the source selection. Aspects of relevancy include similarity of complexity; dollar value, contract type, and degree of subcontract/teaming. The second aspect of the past performance evaluation is to determine how well the contractor performed on the contracts.

The following describes the Past Performance Relevancy Rating:

Rating Definition

Relevant Past performance information that is related to the services required under this solicitation.

Not Relevant Past performance information that is not related to the services required under this solicitation.

The past performance evaluation results in an assessment of the offeror’s probability of meeting the solicitation requirements. The past performance evaluation considers each offeror's demonstrated recent and relevant record of performance in supplying products and services that meet the contract’s requirements. One performance confidence assessment rating is assigned for each offeror after evaluating the offeror's recent past performance, focusing on performance that is relevant to the contract requirements.

Performance Confidence Assessment Rating

Rating Description

Substantial Confidence

Based on the offeror’s recent/relevant performance record, the

Government has a high expectation that the offeror will successfully perform the required effort.

Satisfactory Confidence

Based on the offeror’s recent/relevant performance record, the

Government has a reasonable expectation that the offeror will successfully perform the required effort.

Limited Confidence

Based on the offeror’s recent/relevant performance record, the

Government has a low expectation that the offeror will successfully perform the required effort.

No Confidence

Based on the offeror’s recent/relevant performance record, the

Government has no expectation that the offeror will be able to successfully perform the required effort.

Unknown Confidence

(Neutral)

No recent/relevant performance record is available or the offeror’s performance record is so sparse that no meaningful confidence assessment rating can be reasonably assigned.

OTHER CONTRACTING REQUIREMENTS

All Department of the Navy (DON) information systems as defined in Department of Defense Directive (DoDD)

8500.1 shall be certified and accredited (C&A) for operation. C&A is attained via the Defense Information

Assurance Certification and Accreditation Process (DIACAP) and is applicable to all DON-owned or controlled information systems that receive, process, store, display or transmit Department of Defense (DoD) information, regardless of Mission Assurance Category (MAC) classification or sensitivity, except, per DoDD 8500.1 Paragraph

2.3; IT that is considered Platform Information Technology (PIT). Regardless of whether the system or device is considered PIT or whether it is determined that it requires a full accreditation, the following DIACAP artifacts shall be included with your proposal; System Identification Profile (SIP), DIACAP Implementation Profile (DIP), and

Plan of Actions and Milestones (POA&M). Completion of this form in its entirety will satisfy the requirement for the SIP, DIP and POA&M.

The contractor shall establish appropriate administrative, technical, and physical safeguards to protect all government data, to ensure the confidentiality, integrity, and availability of government data under their control. At a minimum, this shall include provisions for personnel, electronic, and physical security.

Navy PIT Designation

Certain medical technologies may be designated as PIT by the Navy Operational Designated Accrediting Authority

(ODAA); however the PIT designation itself does not constitute an Approval to Operate (ATO). The PIT system will require a PIT Risk Analysis (PRA). The DIACAP SIP, DIP, POA&M and Risk Analysis documents are required in order to complete a PRA. Contractors will be required to scan the PIT system for vulnerabilities prior to delivery.

According to DoDD 85001, Paragraph E2.1.16.4; PIT refers to computer resources, both hardware and software, that are physically part of, dedicated to, or essential in real time to the mission performance of special-purpose systems. Medical technologies, and specifically medical imaging and monitoring systems are considered special-purpose mission technologies according to this definition.

The PIT designation issued by the ODAA may be used by the Program Manager (PM) to complete a PRA in order to prove compliance with C&A requirements, but is cautioned that the appropriate IA controls must still be built into the IT to comply with acquisition requirements. The contractor shall work with Navy

Program Managers to ensure their systems meet these requirements.

The Contractor will be required to propose an acceptable approach to selecting IA controls starting from the baseline set on DoD Instruction 8500.2 B, commensurate with the system’s Mission Assurance

Category (MAC) and Confidentiality Level. For medical devices and systems the MAC level assigned is typically MAC III sensitive.

If the system or device is determined to be PIT, the Contractor shall support Navy Medicine IA representatives in creation of the PIT designation request packages to include all relevant configuration, software and IA data. The following documents will assist is creating the PIT designation request package;

o Digital Imaging and Communications in Medicine (DICOM) Conformance Statement (if applicable) o Food and Drug Administration (FDA) Certification (510k) o Integrating the Healthcare Enterprise (IHE) Integration Statement o International Organization for Standardization (ISO) Statement (if applicable) o Manufacturer Disclosure Statement for Medical Device Security (MDS2) o A full system diagram to include any PIT to PIT or other interconnections

DIACAP

For those systems that do not meet the requirements for designation as PIT, the contractor shall comply with

DIACAP requirements as specified by the DoD that meet appropriate DoD and Navy IA requirements. The contractor shall initiate the process by providing the required documentation necessary to receive an ATO. The contractor shall make their device or system delivered against this contract available for C&A testing and initiate the process well in advance of a contract. The requirements shall be met before the contractor's system is authorized to access DoD data or interconnect with any DoD network that receives, processes, stores, displays or transmits DoD data. An ATO, at a minimum, will be required before a device or system is installed. The contractor shall ensure that the proper contractor support staff is available to participate in all phases of the DIACAP process. They include but are not limited to;

Completing and maintaining all documentation necessary to obtain and maintain an ATO.

Attending and supporting DIACAP and C&A meetings with Navy IA representatives.

Supporting/conducting the vulnerability mitigation process to comply with IA controls listed in DoD

Instruction 8500.2.

Supporting the C&A Team during system security testing.

Contractors must confirm that their systems are locked down prior to initiating C&A testing.

Post-Accreditation Review

An annual IA review shall be conducted that comprehensively evaluates existing policies and processes to ensure procedural consistency and that the IS continues to operate in the manner to which it was accredited. The annual review process should account for the analysis of projected policy needs, and produce a plan for development or implementation of new policies or processes.

Personnel Security and User Access Control

The contractor shall comply with DoDD 8500.1, “Information Assurance (IA)”, DoD Instruction (DODI) 8500.2

“Information Assurance (IA) Implementation”, DoDD 5400.11, “DoD Privacy Program”, DoD 6025.18-R, DoD

Health Information Privacy Regulation and DoD 5200.2-R, “Personnel Security Program Requirements”.

Contractor responsibilities for ensuring personnel security include, but are not limited to meeting the following requirements:

Follow the Privacy Office guidelines for submittal of IT security clearances and ensure all contractor personnel are designated as IT-I, IT-II or IT-III where their duties meet the criteria of the position sensitivity designations.

Because of the unique circumstances presented by DoD and DON networks, personnel security requirements shall be followed to ensure appropriate precautions are taken prior to allowing vendor personnel access to the network.

Any vendor personnel that will be accessing the medical device/system while installed on the hospital network will be required to have a National Agency Check (NAC) completed. Typically, this requires an investigation to support a “Public Trust Position” and requires the person(s) to complete and submit a Standard Form 85P (SF85P), Questionnaire for Public Trust Positions, via the Electronic Personnel Security Questionnaire (EPSQ). Questions relating to SF85Ps and the EPSQ process may be directed to 1-888-282-7682 or online at http://www.dss.mil/index.htm. Contractor personnel accessing equipment connected to the hospital network will be http://www.dss.mil/index.htm required to complete a System Authorization Access Request-Navy (SAAR-N) (form OPNAV 5239/14). Copies of this form can be obtained from the Navy PACS Office. Additionally, contractor personnel are required to complete the annual DoD IA training requirements.

The contractor shall initiate, maintain and document personnel security investigations appropriate to the individual’s responsibilities and required access to Sensitive Information (SI).

Immediately report to the appropriate Navy POC and deny access to any automated information system (AIS), network, or information if a contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate Navy representative for security reasons.

Ensure that all contractor personnel receive IA training before being granted access to DoD AIS’s.

Access to the medical devices will be limited to authorized users as determined by local policy. Vendors whose systems do not yet meet the requirement for CAC authentication must indicate their willingness to do so, and offer a timeline for compliance.

Operating Systems To ensure that medical systems attain data confidentiality, integrity, and availability levels consistent with best industry practices, the use of current Operating Systems (OS) is highly recommended. Therefore preference may be given to systems that employ modern operating systems, including closed source, open source, or proprietary. Medical systems will employ whenever possible, operating systems that are fully supported by the manufacturer and are commercially available.

Domain Name System Realm/Directory Services Contractor will be required to provide technical evidence, if applicable, whether client/server topology based medical systems can integrate with Directory Services and support LDAP authentication.

Local Privileged and Administrative User/Local System Accounts Contractor shall create a single local user account with administrative/root level privileges for purposes of conducting system repairs and maintenance only. This account shall be separate and distinct from the built-in local administrative/root account provided by the Operating System and shall comply with DoD policy. All factors required to complete successful identification, authentication and authorization against the built-in local Administrative/Root level account shall be provided to the MTF Biomedical Engineering Department.

Complete administrative system rights shall be provided to the government System Administrator for the purpose of conducting device vulnerability scans as needed.

Navy Business to Business (B2B) Gateway

All contractor systems that will communicate with DON systems will interconnect through the established Military

Health System (MHS) Business to Business (B2B) gateway. For all Web applications, contractors will connect to the

DISA-established Web DMZ.

Contractors will connect to the B2B gateway via a contractor procured Internet Service Provider (ISP) connection and assume all responsibilities for establishing and maintaining their connectivity to the B2B gateway. This will include acquiring and maintaining the circuit to the B2B gateway and acquiring a FIPS-

140-2 Virtual Private Network (VPN)/Firewall device compatible with the MHS VPN device.

Maintenance and repair of contractor procured VPN equipment shall be the responsibility of the contractor.

Contractors shall configure their network to support access to government systems (e.g., configure ports and protocols for access).

Contractors shall provide full time connections to a TIER1 or TIER2 ISP. Dial-up ISP connections are not acceptable.

Contractors will comply with DoD guidance regarding allowable ports, protocols and risk mitigation strategies

Prior to accessing DON, all contractors will be required to complete a DISA Form 2875 System Authorization

Access Request form (SAAR) and submit it to NMLC, Code 03, Imaging Informatics Division for processing. The contractor will be required to complete applicable DoD IA training.

IPv6

The proposed system shall be Internet Protocol version 6 (IPv6) capable or the vendor must provide a detailed project, migration or planning documentation to show when the proposed system shall be IPv6 capable.

Minimum IPv6 capabilities include:

Conformant with the IPv6 standards profile contained in the DoD IT Standards Registry (DISR);

Maintaining interoperability in heterogeneous environments with IPv4;

Commitment to upgrade as the IPv6 standard evolves;

Availability of vendor IPv6 technical support.

The contractor must be able to demonstrate or provide documentation to prove that their product is IPv6 capable. As described in the DISR IPv6 standards profile, application vendors are expected to scan and test their code for IPv6 compliance and provide a letter of compliance indicating to what degree they comply. The letter shall be in vendor format and describe the standards used for testing and the results of the scans. IPv6 'capable' is defined as having the capability of receiving, processing and forwarding IPv6 packets and/or interfacing with other IPv6 capable systems/devices and in a manner similar to IPv4. In order to demonstrate IPv6 compliance, the vendor should submit the following documentation:

Provide a diagram showing IPv6 core configuration, to include IPv6 addressing, internal network connectivity and topology, external network connectivity, and IPv6 traffic flow;

Submit a list of core components to include vendor/manufacturer IPv6 compliance;

Submit a report that illustrates testing of IPv6 compliance, to include test scripting, logs and results.

Information Assurance Vulnerability Management (IAVM)

IAVM is focused on maintaining a secure platform as new vulnerabilities and exploits are discovered and released through various software developers and security agencies. The core tool of successful IAVM is the Information

Assurance Vulnerability Alert (IAVA). The DoD releases IAVAs for local action on the various platforms across the enterprise network. Each Navy Healthcare Facility is responsible for managing their local network. Most DoD

IAVAs originate from a real world event such as a patch release or vulnerability notification from a software vendor

(e.g. Windows or Sun patch release), or a US-CERT released from the CERT Coordination Center at Carnegie

Mellon University. To have an effective IAVM program, vendors must be proactive in monitoring emerging threats.

Some recommended sources for IAVM support are:

General Vulnerability alerts, all platforms: http://www.cert.org/nav/index_red.html

Microsoft security resources: http://www.microsoft.com/technet/security/bulletin/notify.mspx

SUN Microsystems Security resources: http://sunsolve.sun.com/pub-cgi/show.pl?target=security/sec

As part of the IAVM program, the contractor shall provide a primary and secondary point of contact for compliance actions. The point of contact shall provide, upon receipt of a vulnerability message, an acknowledgement of that receipt. The vendor shall thoroughly test all mitigations for the vulnerability, and upon applying the mitigation to the system, report compliance. Receipt and compliance messages shall occur within the stipulated time window, as stated in the vulnerability message or other official notification.

Any vendor interested in meeting this requirement shall have a documented process to demonstrate an organizational culture embracing security throughout the system lifecycle. The processes shall clearly demonstrate security’s role in the product development phase, and the processes the vendor employs to react to vulnerabilities, validate required patches, communicate status and required actions to their customers, and the follow up service support to address patch implementation.

Health Insurance Portability and Accountability Act (HIPAA) http://www.cert.org/nav/index_red.html http://www.microsoft.com/technet/security/bulletin/notify.mspx http://sunsolve.sun.com/pub-cgi/show.pl?target=security/sec

The contractor shall comply with the HIPAA Act of 1996 (Public Law 104-191) requirements, specifically the administrative simplification provision s of the law and the associated rules and regulations published by the

Secretary, Health and Human Services (HHS). This includes the Standards for Electronic Transactions, the

Standards for Privacy of Individually Identifiable Health Information and the Security Standards.

Business Associate Agreement

In accordance with DoD 6025.18-R “Department of Defense Health Information Privacy Regulation” the Contractor meets the definition of Business Associate. Therefore, a Business Associate Agreement is required to comply with both the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security regulations. This clause serves as that agreement whereby the Contractor agrees to abide by all applicable HIPAA Privacy and Security requirements regarding health information as defined in this clause, and DoD 6025.18-R and DoD 8580.02-R, as amended. Additional requirements will be addressed when implemented.

(a) Definitions. As used in this clause generally refer to the Code of Federal Regulations (CFR) definition unless a more specific provision exists in DODI 6025.18-R.

Individual has the same meaning as the term ``individual'' in 45 CFR 164.501 and 164.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

Protected Health Information has the same meaning as the term ``protected health information'' in 45 CFR

164.501, limited to the information created or received by The Contractor from or on behalf of The Government.

Electronic Protected Health Information has the same meaning as the term “electronic protected health information” in 45 CFR 160.103.

Required by Law has the same meaning as the term ``required by law'' in 45 CFR 164.501 and 164.103.

Secretary means the Secretary of the Department of Health and Human Services or his/her designee.

Security Rule means the Health Insurance Reform: Security Standards at 45 CFR part 160, 162 and part

164, subpart C.

Terms used, but not otherwise defined, in this Clause shall have the same meaning as those terms in 45 CFR

160.103, 164.501 and 164.304.

(b) The Contractor shall not use or further disclose Protected Health Information other than as permitted or required by the Contract or as Required by Law.

(c) The Contractor shall use appropriate safeguards to prevent use or disclosure of the Protected Health

Information other than as provided for by this Contract.

(d) The Contractor shall use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits in the execution of this Contract.

(e) The Contractor shall mitigate, to the extent practicable, any harmful effect that is known to the

Contractor of a use or disclosure of Protected Health Information by the Contractor in violation of the requirements of this Contract.

(f) The Contractor shall report to the Government any security incident involving protected health information of which it becomes aware.

(g) The Contractor shall report to the Government any use or disclosure of the Protected Health

Information not provided for by this Contract of which the Contractor becomes aware of.

(h) The Contractor shall ensure that any agent, including a subcontractor, to whom it provides Protected

Health Information received from, or created or received by the Contractor on behalf of the Government agrees to the same restrictions and conditions that apply through this Contract to the Contractor with respect to such information.

(i) The Contractor shall ensure that any agent, including a subcontractor, to whom it provides electronic

Protected Health Information, agrees to implement reasonable and appropriate safeguards to protect it.

(j) The Contractor shall provide access, at the request of the Government, and in the time and manner designated by the Government to Protected Health Information in a Designated Record Set, to the Government or, as directed by the Government, to an Individual in order to meet the requirements under 45 CFR 164.524.

(k) The Contractor shall make any amendment(s) to Protected Health Information in a Designated Record

Set that the Government directs or agrees to pursuant to 45 CFR 164.526 at the request of the Government or an

Individual, and in the time and manner designated by the Government.

(l) The Contractor shall make internal practices, books, and records relating to the use and disclosure of

Protected Health Information received from, or created or received by the Contractor on behalf of, the Government, available to the Government, or at the request of the Government to the Secretary, in a time and manner designated by the Government or the Secretary, for purposes of the Secretary determining the Government’s compliance with the Privacy Rule.

(m) The Contractor shall document such disclosures of Protected Health Information and information related to such disclosures as would be required for the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

(n) The Contractor shall provide to the Government or an Individual, in time and manner designated by the

Government, information collected in accordance with this Clause of the Contract, to permit the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

General Use and Disclosure Provisions

Except as otherwise limited in this Clause, the Contractor may use or disclose Protected Health Information on behalf of, or to provide services to, the Government for treatment, payment, or healthcare operations purposes, in accordance with the specific use and disclosure provisions below, if such use or disclosure of Protected Health

Information would not violate the Privacy Rule, the Security Rule, DoD 6025.18-R or DoD 8580.02-R if done by the Government.

Specific Use and Disclosure Provisions

(a) Except as otherwise limited in this Clause, the Contractor may use Protected Health Information for the proper management and administration of the Contractor or to carry out the legal responsibilities of the Contractor.

(b) Except as otherwise limited in this Clause, the Contractor may disclose Protected Health Information for the proper management and administration of the Contractor, provided that disclosures are required by law, or the Contractor obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the information has been breached.

(c) Except as otherwise limited in this Clause, the Contractor may use Protected Health Information to provide Data Aggregation services to the Government as permitted by 45 CFR 164.504(e)(2)(i)(B).

(d) Contractor may use Protected Health Information to report violations of law to appropriate Federal and

State authorities, consistent with 45 CFR 164.502(j)(1).

Obligations of the Government

Provisions for the Government to Inform the Contractor of Privacy Practices and Restrictions

(a) Upon request the Government shall provide the Contractor with the notice of privacy practices that the

Government produces in accordance with 45 CFR 164.520, as well as any changes to such notice.

(b) The Government shall provide the Contractor with any changes in, or revocation of, permission by

Individual to use or disclose Protected Health Information, if such changes affect the Contractor's permitted or required uses and disclosures.

(c) The Government shall notify the Contractor of any restriction to the use or disclosure of Protected

Health Information that the Government has agreed to in accordance with 45 CFR 164.522.

Permissible Requests by the Government

The Government shall not request the Contractor to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy Rule if done by the Government, except for providing Data Aggregation services to the Government and for management and administrative…