Solicitation_Attachments,_Revision_1.docx

ATTACHMENTS

1. Performance Work Statement (PWS)

a. PWS Enclosure 1 - Weekly MTF Monitoring Process* *The enclosed plan represents the current monitoring process. The quoter shall propose a plan to provide proactive monitoring of system performance. The quoter’s plan will be incorporated into the resultant contract and will replace the currently weekly monitoring process.

1. Military Treatment Facility (MTF) Listing

1. Business Associate Agreement

1. Lists of Acceptable Documents to Establish U.S. Citizenship

1. CAP (Indefinite Delivery, Firm Fixed Price)

Attachment 1: Performance Work Statement (PWS) Anesthesia Recording and Monitoring Devices (ARMD) Medical Equipment Hardware and Software Maintenance

1. DEFINITIONS

ARMD. Abbreviation of “Anesthesia Recording and Monitoring Devices”

Clinically Interfaced Workstation. Each individual PC workstation located at the MTF in which the Contractor’s software interfaces with clinical devices for automatic data capture at the bedside and as described in Paragraph 3.2.

Commercial Hardware. Third-party commercial hardware other than the Contractor’s hardware, including but not limited to PC workstations, servers, wireless networking equipment, and mounting hardware, as described in Paragraph 3.2.

Component. Contractor provided devices: servers and the software they serve out, all storage and archive devices, workstations (diagnostic, review and quality control), hard copy devices, the network and other network peripherals (if provided and installed by the Contractor), Contractor provided ARMD interfaces to Government furnished devices and systems (e.g., HL7).

Component Failure. Any component malfunction which renders the component unable to perform its intended function and requires corrective maintenance, alignment, calibration, or replacement. Any component which is comprised of subcomponents (e.g., workstation comprised of monitors, CPU, keyboard, etc.) shall be treated as a single entity. Therefore, failure of any subcomponent (e.g., a monitor) shall constitute failure of the component (e.g., the workstation).

CoN. Abbreviation of “Certificate of Networthiness”

COR. Acronym of “Contracting Officer’s Representative”

Core System. Subset of the System that includes the following components: servers and the software they serve out (including Web servers), all intermediate storage and long-term archive devices, network switches (if vendor provided).

Core System Failure. Any emergency situation in which any one or multiple components comprising the core system requires immediate corrective maintenance. Such a failure may be brought on by failure of a single or multiple core system components such that system performance parameters defined herein are not being met.

CPU. Abbreviation of “Central Processing Unit”

CPT. Abbreviation of “Current Procedural Terminology” Documentation. The Operator's User Manual(s) and related materials provided by DMI.

DoD. Abbreviation of “Department of Defense”

DIACAP. Acronym of “DoD Information Assurance Certification and Accreditation Process”

DIP Acronym of “DIACAP Implementation Plan”

FAQ. Abbreviation of “Frequently Asked Questions”

HL7. Health Level 7

IA. Abbreviation of Information Assurance

ICD. Abbreviation of International Statistical Classification of Diseases.

IAVA. Abbreviation of Information Assurance Vulnerability Alerts

Information Assurance. Measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation.

JTR. Abbreviation of “Joint Travel Regulations”

Licensed Software. The Contractor’s Medical Incorporated Software and Interface Software.

MTF. Abbreviation of “Military Treatment Facilities”

New Versions/Modules. Any new software product(s), releases or new modules offered by the Contractor for which the Contractor customarily charges a fee to its customers. New Versions/Modules are not included in the definitions of Updates hereunder and are not included in this Contract.

Normal Working Hours. The MTFs are normally open for service Monday through Friday between the hours of 7 AM and 5 PM, excluding host national and federally observed holidays. Since the MTFs are located globally, normal working hours apply to the local time zone.

PC. Abbreviation of “Personal Computer.”

POC. Abbreviation of “Point Of Contact”

Proper Working Order. Operating within Original Equipment Manufacturers (OEM) specifications as designed, produced, delivered and accepted.

Response Time. The timeframe between when the Government POC places the service call to the Contractor and the time when the Contractor responds to the call.

RMF. Abbreviation of “Risk Management Framework”

Software. All clinical information systems software developed by the vendor and delivered to Government in association with the operation of the ARMD Innovian system including any Software Updates for the foregoing, other than the Interface Software.

System. System shall be defined as the integrated network of all Contractor provided ARMD components.

TO. Abbreviation of “Task Order”

Updates. Updates are software patches released by the OEM to address specific deficiencies, vulnerabilities, or to activate specific functionalities.

2. SCOPE

2.1. The Government has a requirement for maintenance and sustainment services for the ARMD installed as a result of the ARMD tri-service initiative that resulted in the deployment to MTFs worldwide. The anesthetic record plays an important role in patient safety and provides important information used for quality assurance initiatives. Anesthesia records also document the information required to produce accurate third-party billing for anesthesia services. To enhance the rapid and legible gathering of a highly detailed and accurate anesthetic record, ARMD electronically record and document all patient physiologic parameters, medications delivered, important demographics including allergies, patient height and weight, and anesthesia provider actions at the point of care in real time. In addition, this capability along with an overview of total operating room activity provides a remarkable resource for management and leadership authority in optimizing operative services. Furthermore, ARMD can be expanded to encompass similar functions in Pre-Anesthesia Screening, Post-Anesthesia Recovery Unit, and Intensive Care Unit settings.

2.2. The Contractor shall provide all personnel, equipment, tools, vehicles, materials, supervision, transportation/travel and services necessary to effectively, economically, and satisfactorily to provide the services described herein. Service events will include preventive maintenance, as defined in Enclosure 1, corrective maintenance, and emergency maintenance activities necessary to keep the ARMD in good (proper) working order. For the purposes of this contract, the ARMD is inclusive of all hardware, firmware and software (to include non-clinical Contractor software installed on MTF workstations). Services are required worldwide at the locations specified in Attachment 2; however, any DoD facility is considered within the scope of this contract.

2.3. Throughout the contract period, locations and hardware may be added or removed. The Contractor will be notified of changes as soon as possible. Once a location or hardware is added or removed, the task order will be modified and the unit price will be adjusted accordingly. To remain within scope of the TO, the added location(s) or hardware shall represent not more than 20% of the total TO price.

2.3.1. As the Military Health System (MHS) Genesis Electronic Health Record (EHR) is deployed throughout the MHS, the ARMD will be taken out of service. Current DoD-owned ARMD hardware may be reused by the Contractor in the sustainment of remaining hardware when/if it becomes available.

2.3.1.1. MHS EHR deployment is scheduled for April 2017 at Fort Lewis, Naval Hospital Oak Harbor, and Naval Hospital Bremerton. These locations are not included in Attachment 2. These locations will be priced as options that will be exercised if MHS EHR deployment is delayed.

2.3.2. There is a tentative plan in place to refresh the hardware portion of the ARMD across the MHS over the next 2 years. The new hardware will have a warranty period. As hardware is replaced, the sustainment for hardware under this contract will no longer be required.

3. DESCRIPTION OF SERVICES

3.1. The Contractor shall provide maintenance and support coverage for the modules and components of the ARMD. The Contractor shall cause the Licensed Software to operate in all material respects in conformity with the Documentation under normal use during the contract performance period. The Contractor shall provide updates in addition to help desk support. When updates to hardware or software are required, the Contractor shall coordinate with DoD and Service/National Capital Region (NCR) program managers prior to installation.

3.2. The modules and components of the ARMD are defined below:

3.3. All Software Updates and Versions/Modules added to the ARMD throughout the contract performance period shall be governed by the appropriate software license terms. In particular, the Contractor shall update annually medical diagnostic codes provided by the Government such as CPT codes or ICD codes.

3.3.1. The Contractor shall be responsible for on-going testing of Operating System (OS) and application software patches for stability within the ARMD environment. A list of tested and acceptable patches and any applicable notes, directions or comments for the user shall be posted to the Contractor’s website (see Paragraph 3.3.2. below) by the fifth (5th) calendar day each month. If any of the listed OS and application software patches causes the system to become inoperable, the Contractor shall correct the deficiency consistent with the language stated in Paragraph 3.13. The Contractor shall ensure the tested and acceptable patches are provided within seven (7) calendar days’ notice of an IAVA.

3.3.1.1. If an OS or application software patch cannot be approved, the Contractor shall be responsible for modifying the ARMD, if necessary, to meet IA requirements, as defined in DoDI 8500.01 and DoDI 8510.01, links to both are provided below, in a future scheduled software release version of ARMD.

3.3.2. The Contractor shall maintain a website that allows the Government to access approved IAVA patches. In addition, the website shall include any documentation that is provided as a result of the deliverables in the ARMD tri-service initiative. The Contractor shall publish the web address to the widest audience possible to ensure the end users are aware of the address and the information contained on the website. The Government reserves the right to provide information regarding ARMD to the Contractor to be placed on the website to assist the end users. The Government will provide the information to be placed on the website by the last day of the month. The Contractor shall post the information to their website by the fifth (5th) calendar day of the month.

3.3.3. The Contractor shall assist the Government in preparing documentation and developing mitigation plans to address identified annual IA review issues and meeting all DoD IA requirements. There may be instances where the Government will require IA review more often if vulnerabilities are identified by the Services. In addition, the Contractor shall assist in the implementation of the software resolutions to include performing updates to the RMF documentation.

3.4. To maintain continuity, the Contractor shall ensure all ARMDs are using the same version of software and employ software configuration management principles. The Government will allow a reasonable amount of time, via a mutually agreed upon schedule, for the Contractor to retrofit any changes to the software to maintain consistent versions of the software. Any change or update of software shall include migration of existing data from the previous software version to the updated software version.

3.5. The Contractor shall provide a technical support staff which is available to answer questions regarding the operation and/or use of the Licensed Software by telephone without additional charge to the Government. After reasonable efforts to remotely resolve operational issues with the ARMD, the Contractor shall provide technical support on-site without charge to the Government.

3.6. The Contractor shall maintain records regarding all maintenance support provided by its personnel on the ARMD. The Contractor shall make this information electronically available to the Government, as requested, and agrees to treat the information on all such records as confidential.

3.7. The Contractor shall ensure maintenance spares and spare parts for the ARMD can be obtained within twenty-four (24) hours of any reported failures.

3.8. With respect to the Commercial Hardware listed in Paragraph 3.2., the Contractor shall provide appropriately qualified and experienced service personnel for service or repair work on such hardware and software. The Contractor shall supply replacement or additional parts, accessories or equipment, if required in connection with such services or work. Refurbished parts may be used. These parts shall comply fully with the performance and reliability standards of new parts and carry the same warranty as new parts. The Contractor shall not alter the covered Hardware that (i) would violate a safety standard mandated by law or government regulation, or mandated or recommended by any applicable industry code, or (ii) would not accord with the installation requirements and directives of the manufacturer. The Government will conduct user level preventive maintenance and testing of the covered hardware as required by the manufacturer or as is common industry practice before each use to ensure the covered hardware is operating properly. The Government shall perform routine maintenance and cleaning of the covered hardware on a regular basis as suggested by the manufacturer’s service manual.

3.9. Reserved.

3.10. Maintenance Service Support. The size and complexity of the site shall dictate the level of service support required. The Contractor shall utilize personnel who are fully qualified and knowledgeable on the maintenance of the ARMD to provide maintenance services on the ARMD.

3.11. Scheduled Maintenance

3.11.1. The Contractor shall submit a maintenance plan as a deliverable under each task order placed against the contract. The maintenance plan is due to the MTF System Administrator and Biomedical Staff thirty (30) calendar days after TO award. The Contractor shall notify the COR when this requirement is complete.

3.11.1.1. Maintenance plans shall include at least the following information: the number of and skill set of on-site maintenance staff, scheduled calibration and preventive maintenance program details, as defined in Enclosure 1, repair maintenance program details, archive system maintenance program details, application maintenance plan details, database maintenance plan details, HL7 maintenance plan details, repair parts program details, technical support resources description, facilities requirements for maintenance, training, and maintenance program support. Included in this deliverable is scheduled maintenance plan for each MTF that has accepted the ARMD.

3.11.2. Scheduled maintenance shall include execution of the maintenance plan as addressed in Paragraph 3.11.1.1.

3.11.3. To the maximum extent possible, scheduled maintenance shall be performed on individual components of the system so as not to affect the operation of the entire system.

3.11.4. The Contractor shall perform any scheduled services which will result in system downtime at times outside of the normal working hours (see definition). The Contractor shall perform all other scheduled services which will NOT result in system downtime at times convenient to the Government. All services shall be coordinated with the MTF representative.

3.12. Corrective Maintenance

3.12.1. The Contractor shall provide on-site hardware, firmware and software corrective maintenance service for all component and system failures, to include software problem analysis, associated reprogramming and corrected software documentation.

3.12.2. The Contractor shall affect repairs in the most expedient manner with minimum interruption to the operation of the system.

3.12.3. An emergency corrective maintenance call is defined as a failure of a component when no back up is available, or a failure of the system that prevents the site from accomplishing its normal workload with the remainder of the system. Placement of such an emergency corrective maintenance call marks commencement of downtime and response time measurement.

3.12.3.1. Once the Contractor service representative arrives on site to fulfill an emergency corrective maintenance action on a core system component(s), for all calls placed during normal working hours, the service representative shall remain on site, at no additional charge to the Government, until all repairs are completed, all integrated system performance parameters are met, and the system is available for clinical use.

3.12.3.2. For corrective maintenance action calls placed outside normal working hours, the service representative shall remain on site until all repairs are completed, all integrated system performance parameters are met, and the system is available for clinical use.

3.12.4. All other corrective maintenance calls that do not meet the requirements of the “emergency” call shall be defined as “routine” corrective maintenance calls.

3.13. Response Time

3.13.1. The Contractor shall be available twenty-four (24) hours a day every day of the year to respond to the Government’s issues. The Contractor shall be cognizant of the varying time zones around the world where the ARMD is being used. The contract employee(s) responding to the Government’s call must be competently skilled to provide at least Tier 1 service, as defined in Paragraph 3.13.2.1.

3.13.2. The Government’s definition for the level of contractor support is defined below:

3.13.2.1. Tier I: Help desk services provided within four (4) hours of notification by the customer.

3.13.2.2. Tier II: System Engineer support via remote connection. This is the primary level of support for any issue identified with a Severity Level of III, IV or V. Refer to definitions below.

3.13.2.3. Tier III: The Contractor shall provide on-site support for any identified issue that cannot be resolved at the Tier I or Tier II after four (4) hours of being contacted. Tier III support shall be the primary level of support for any issues identified with a Severity Level of I or II. Refer to definitions below.

3.13.3. For the purposes of this contract, the definition for each Severity Level is defined below:

3.13.3.1. Catastrophic (Severity Level I): Any failure within an active surgery; any failure which results in the population of an incorrect patient identifier; any failure which results in an immediate threat to patient health; or 50% or more of workstations affected.

3.13.3.2. Severe (Severity Level II): Any failure which prevents performance of surgery planned within twenty-four (24) hours; any failure which results in the potential threat to patient health, any failure which results in the potential population of an incorrect patient identifier; or 25-50% of workstations affected.

3.13.3.3. Major (Severity Level III): No effect on patient health, but potential to affect surgery planned more than twenty four (24) hours later.

3.13.3.4. Minor (Severity Level IV): no potential effect on planned surgery.

3.13.3.5. Cosmetic (Severity Level V): changes to the appearance of the ARMD.

3.14. The Contractor shall ensure the hardware and software for every ARMD in the MTF is in proper working order 99% of the time which equates to 361 days of the year (362 days during leap year) on each Task order. The remaining four (4) days of the year are allocated for scheduled and unscheduled downtime at each MTF. Refer to Paragraph 1 for the definition of proper working order and refer to Paragraph 4 for the performance measures.

3.15. Exclusions/Limitations. The Contractor shall not be held liable for the items listed below:

3.15.1. Maintenance Service for Commercial Hardware not listed in Paragraph 3.2., or Third-Party Products the Government chooses to use in conjunction with the ARMD.

3.15.2. Maintenance Service for any New Versions/Modules that have not been licensed under a primary Contractor’s license.

3.15.3. Repairs for any of the following:

3.15.3.1.The Government's failure to properly procure, configure, maintain, and install any Commercial Hardware not identified in Paragraph 3.2. and used in conjunction with the ARMD.

3.15.3.2. Damages caused by computer viruses unless caused by a failure on the part of the Contractor to mitigate identified information assurance vulnerabilities with a known patch.

3.15.3.3. Failure of electrical power, power surge, temperature, humidity, neglect, or any failure of the facilities to meet the Contractor’s specifications.

3.15.3.4. Reserved

3.15.3.5. The Government's modification of the ARMD without the Contractor’s written consent.

3.15.3.6. Failure to provide reasonable and timely access to the Government's system or unreasonably or materially impeding access to the Government's system.

3.15.3.7. Use of any supplies, parts or equipment not meeting the manufacturer’s specifications.

3.15.3.8. Operator, user error or Government maintainer, including but not limited to, any corruption of the database data whether occurring during routine use, upgrading or maintenance service. The Contractor shall demonstrate the Government caused the error discussed in this paragraph.

3.15.3.9. The Government’s failure to implement reasonable and adequate disaster recovery procedures including, but not limited to, backups and validation performed on a periodic basis and those required prior to any update, maintenance or database conversion.

3.16. The Contractor shall not use third-party tools without an IA approval of the appropriate Service. A third-party tool is defined as any type of software that has not been approved by the Government (e.g., Google Chrome).

3.17. Under no circumstances shall the Contractor remove permanent media storage device (i.e. hard-drive) from the government facility. Such permanent media storage devices may contain Protected Health Information (PHI) and or Personally Identifiable Information (PII). The Contractor shall not remove such devices whether it is the permanent media storage device itself or an ARMD component that contains a permanent media storage device during maintenance and support of the ARMD system under this contract.

3.18. Remote Diagnostics

3.18.1. The Contractor shall possess the ability to provide system connectivity, diagnostic software and technical support services which utilize remote diagnostics for troubleshooting, repairing, and configuring the ARMD.

3.18.2. Remote capabilities shall be able to reach all central system components in the ARMD (i.e. servers and the software they serve, archive controller, archive devices, network infrastructure, network managed workstations) through a common (single) telecommunications access line.

3.18.3. Telemaintenance methods shall also include the use of telephonic contact with Government site support staff and users.

3.18.4 All Remote diagnostics shall be conducted in accordance with the most current Defense Information Systems Agency (DISA) requirements for Business to Business (B2B) connections.

3.18.4.1. Contractor personnel accessing DoD Systems through the DISA B2B Gateway must comply with DoD 8570.01-M, Information Assurance Workforce Improvement Program requirements for Information Assurance Technical (IAT) Level II. A copy of this directive can be obtained via the following link: http://www.dtic.mil/whs/directives/corres/pdf/857001m.pdf. Compliance requires possession and maintenance of one of the following certifications: Cisco Certified Network Associate (CCNA) Security, Global Industrial Cyber Security Professional (GICSP), Global Information Assurance Certification (GIAC), Security Essential Certification (GSEC), Computing Technology Industry Association (CompTIA) Security plus Continuing Education (CE), or Systems Security Certified Practitioner (SSCP).

3.19. Risk Management Framework (RMF) re-accreditation of existing ARMD System (Draeger Innovian)

3.19.1. The Contractor shall comply with DoDI 8500.01, Cybersecurity, DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Systems, and Special Publication (SP) 800-37, Guide for Applying the Risk Management Framework (RMF) to Federal Information Systems, National Institute of Standards and Technology. A copy of the DoDI instructions may be obtained via these links: http://www.dtic.mil/whs/directives/corres/pdf/850001_2014.pdf and http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf. A copy of SP 800-37 may be obtained at http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf

3.19.2. The Contractor shall address security controls at the individual Control Correlation Identifier (CCI) level. Response to CCIs shall reference supporting document and location within the document.

3.19.3. Supporting Documents. The Contractor shall provide documentation with detailed supporting statements for CCI responses. The following is a list of required documents:

a. Architecture Diagram

b. Data Flow Diagram

c. Detailed Hardware/Software List

d. Access Control Policy

e. Audit Policy

f. Ports, Protocols, and Services Document

g. Privacy Impact Assessment

h. System Description Document

i. Other documents may be required depending on the responses to the CCI’s

3.19.4. The Contractor shall provide results from vulnerability scans using Nessus (in .nessus format)

3.19.5. The Contractor shall support Independent Verification & Validation (IV&V) at the contractor’s site or a designated MTF to be determined.

3.19.5.1. The Contractor shall configure the system for IV&V testing in accordance with, and comply with DISA Security Technical Implementation Guides (STIG) and provide DISA STIG Checklists for system components identified from review of the Hardware/Software list and Nessus scans.

3.19.5.2. The Contractor shall remediate or mitigate vulnerabilities discovered during IV&V and provide supporting documentation that vulnerability is remediated or mitigated.

3.19.6. The Contractor shall provide ongoing RMF system maintenance. Security patches must be validated, then provided for application to all system components. System documentation must be reviewed and updated at least annually or when changes to the system occur.

3.19.7. The Contractor shall support monthly Nessus scans as part of a Continuous Monitoring Strategy.

3.19.8. The Contractor shall remediate or mitigate vulnerabilities discovered during monthly Nessus Scans and provide supporting documentation showing the vulnerability is remediated or mitigated.

3.19.10. The Contractor shall obtain and or maintain an Authority to Operate (ATO) and an Authority to Connect (ATC) in accordance with DoD policy.

3.20. Reports

3.20.1. Monthly Reports. The Contractor shall provide a monthly report for all trouble tickets to the COR by the fifth (5th) calendar day each month. The report shall be meaningful and informative, and include the raw data supporting the report in an Excel spreadsheet. The report shall include at least information about open tickets, closed tickets, and outstanding tickets. The information provided regarding the tickets should be in narrative form and not reported as a number or percentage. The information in this report shall be sufficient for the Government to fully understand the issues reported by the MTFs and the Contractor’s actions. An analysis of the data is required and shall include any trends or patterns as well as proposed reasonable solutions.

3.21. Service Reports

3.21.1. All reports of service (scheduled and corrective maintenance) shall be documented and validated by the MTF representative, and a copy provided to the COR and Service Project Manager (PM).

3.21.2. The Contractor shall maintain a consolidated Microsoft (MS) Excel spreadsheet depicting all of the services rendered under this contract. At a minimum, the spreadsheet record shall include: (a) date and time notified, (b) date and time of arrival onsite, (c) description of malfunction or service to be performed, (d) model number/serial number and location of the equipment, (e) time spent to repair, (f) parts used/replaced, and (g) parts cost, (h) description of service performed, (i) name of government POC, (j) name of Contractor service engineer, (k) telemaintenance methods used, if any, (l) designation of user error if appropriate. Additional information may be required by each Service. A copy of this spreadsheet shall be provided to the COR by the fifth (5th) calendar day each month. The Contractor shall also provide service reports to the Contracting Officer upon request.

3.21.3. The Contractor shall maintain historical service records on each component of the system which shall be provided electronically to the Government upon request.

4. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

4.1. This QASP serves as the principal basis for assessing the overall quality of the Contractor’s performance. It provides the methodology by which the Contractor's performance will be monitored to determine compliance with required performance objectives and to determine if acceptable quality levels have been met. The plan is designed so that surveillance is limited to that which is necessary to verify that the Contractor is performing at an acceptable level.

4.2. Performance Requirements Summary Table:

Comprehensiveness

Comprehensiveness

4.3. If performance is within acceptable levels, it will be considered to be satisfactory. If not, overall performance may be considered unsatisfactory.

4.4. The COR provides an annual report on Contractor Performance (CPARS or other annual report). The Contractor’s failure to achieve satisfactory performance under the contract/task order, reflected in the COR’s annual report, may result in termination of the contract/task order and may also result in the loss of future Government contracts/task orders. The Contractor’s failure to achieve satisfactory performance under the contract/task order may result in the non-exercise of available options.

4.5. For each item that does not meet acceptable levels, the Government may issue a Contract Discrepancy Report (CDR). CDRs will be forwarded to the Contracting Officer with a copy sent to the Contractor. The Contractor must reply in writing within five (5) calendar days of receipt identifying how future occurrences of the problem will be prevented. Based upon the Contractor’s past performance and plan to solve the problem, the Contracting Officer will determine if any further action will be taken.

4.6. In accordance with contract clause FAR 52.212-4, the Contractor will be incentivized to provide quality products in a timely manner since the Government can require the Contractor, at no additional cost, to replace or correct work that fails to meet contract requirement.

5. ENTERPRISE-WIDE CONTRACTOR MANPOWER REPORTING APPLICATION (ECMRA)

5.1. The Contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this Contract for the Navy via a secure data collection site. The Contractor is required to completely fill in all required data fields using the following web address https://doncmra.nmci.navy.mil.

5.1.2. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://doncmra.nmci.navy.mil.

6. STATUS OF FORCES AGREEMENTS. Status of Forces Agreements (SOFAs) between the United States and foreign countries govern the rights and obligations of the United States armed forces in those countries.

6.1. For work performed in Japan:

6.1.1. U.S.-Japan bilateral agreements govern the status of contractors and employees, criminal jurisdiction, and taxation;

6.1.2. USFJ (U.S. Forces Japan) and component policy, as well as U.S.-Japan bilateral agreements, govern logistic support and base privileges of contractor employees;

6.1.3. The Commander, USFJ, is primarily responsible for interpreting the SOFA and local laws applicable to U.S. Forces in Japan and for requirements in support of USFJ; and

6.1.4. A copy of the SOFA is available at the following website: http://www.usarj.army.mil/cmdstaffs/sja/doc/sofa_201601.pdf.

6.2. For work performed in Korea:

6.2.1. U.S.-Korea bilateral agreements govern the status of contractors and employees, criminal jurisdiction, and taxation;

6.2.2. USFK (U.S. Forces Korea) and component policy, as well as U.S.-Korea bilateral agreements, govern logistics support and base privileges of contractor employees;

6.2.3. The Commander, USFK, is primarily responsible for interpreting the SOFA and local laws applicable to U.S. Forces in Korea and for requirements in support of USFK; and

6.2.4. A copy of the SOFA is available at the following website: http://www.usfk.mil/About/SOFA/.

7. THEATER AND COUNTRY CLEARANCE REQUIREMENTS

7.1. The Contractor shall ensure all U.S. citizen or U.S. resident contractor employees and sub-contractor employees performing services under this contract comply with the training and Theater/Country Clearance requirements listed in the Government Foreign Clearance Guide for the country in which they will be employed. The requirements can be found at https://www.fcg.pentagon.mil/fcg.cfm. Verification of the training shall be made available to the KO or COR upon request.

7.2. The Contractor shall follow specific guidance for the combatant command in whose area the Contractor will be performing services or delivering supplies. This guidance is contained on the respective combatant commander’s operational contract support webpage, which is linked to the procedures at http://www.acq.osd.mil/dpap/pacc/cc/areas_of_responsibility.html, at the weblink for the combatant command for the area in which the contractor will be performing services or delivering items. These pages list prevailing regulations, policies, requirements, host nation laws, orders/fragmentary orders, combatant commander’s directives, unique clauses, and other considerations necessary for contract performance in, or delivery of items to, that combatant commander’s area of responsibility.

8. A204-9400(1-17) CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY CONTROLLED FACILITIES, SENSITIVE INFORMATION, INFORMATION TECHNOLOGY (IT) SYSTEMS OR PROTECTED HEALTH INFORMATION (JAN 2017)

Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The Deputy Secretary of Defense Directive-Type Memorandum (DTM) 08-006 – “DoD Implementation of Homeland Security Presidential Directive – 12 (HSPD-12)” dated November 26, 2008 (or its subsequent DoD instruction) directs implementation of HSPD-12. This clause is in accordance with HSPD-12 and its implementing directives.

APPLICABILITY

This clause applies to contractor employees requiring physical access to any area of a federally controlled base, facility or activity and/or requiring access to a DoN or DoD computer/network/system to perform certain unclassified sensitive duties. This clause also applies to contractor employees who access Privacy Act and Protected Health Information, provide support associated with fiduciary duties, or perform duties that have been identified as National Security Position, as advised by the command security manager. It is the responsibility of the responsible security officer of the command/facility where the work is performed to ensure compliance.

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command’s Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

ACCESS TO DoD IT SYSTEMS In accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity’s Command Information Assurance Manager.

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation , which is a higher level investigation than the National Agency Check with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s Security Manager and Information Assurance Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR-N as the “supervisor”.

The SAAR-N shall be forwarded to the Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

INTERIM ACCESS

The Command's Security Manager may authorize issuance of a DoD CAC and interim access to a DoN or DoD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

DENIAL OR TERMINATION OF ACCESS

The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

CONTRACTOR’S SECURITY REPRESENTATIVE

The contractor shall designate an employee to serve as the Contractor’s Security Representative. Within three work days after contract award, the contractor shall provide to the requiring activity’s Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractor’s Security Representative. The Contractor’s Security Representative shall be the primary point of contact on any security matter. The Contractor’s Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL SECURITY POSITIONS OR PERFORMING SENSITIVE DUTIES

Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Contractor employees under this contract are recognized as Non-Critical Sensitive [ADP/IT-II] positions when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DoD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and Protected Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC or T3 or T3R equivalent investigation to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The investigation consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

• SF-86 Questionnaire for National Security Positions (or equivalent OPM investigative product)

• Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

• Original Signed Release Statements

Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the Command’s Security Manager upon arrival to the command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy Command’s Information Assurance Manager. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The SAAR-N shall be forwarded to the Navy Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the Command Security Manager. The Command’s Security Manager will review the submitted documentation for completeness prior to submitting it to the Office of Personnel Management (OPM); Potential suitability or security issues identified may render the contractor employee ineligible for the assignment. An unfavorable determination is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The Command’s Security Manager will forward the required forms to OPM for processing. Once the investigation is complete, the results will be forwarded by OPM to the DoD Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Authorization Request (VAR) via the Joint Personnel Adjudication System (JPAS) or a hard copy VAR directly from the contractor’s Security Representative. Although the contractor will take JPAS “Owning” role over the contractor employee, the Navy Command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT Position Category per SECNAV M-5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee’s performance under the contract.

BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO OR PERFORMING NON-SENSITIVE DUTIES Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc. ...) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

• Must be either a US citizen or a US permanent resident with a minimum of 3 years legal residency in the United States (as required by The Deputy Secretary of Defense DTM 08-006 or its subsequent DoD instruction) and

• Must have a favorably completed National Agency Check with Written Inquiries (NACI) or T1 investigation equivalent including a FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the Contractor’s Security Representative must submit for all employees each of the following:

• SF-85 Questionnaire for Non-Sensitive Positions

• Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

• Original Signed Release Statements

The contractor shall ensure each individual employee has a current favorably completed National Agency Check with Written Inquiries (NACI) or T1 equivalent investigation, or ensure successful FBI fingerprint results have been gained and investigation has been processed with OPM Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

* Consult with your Command Security Manager and Information Assurance Manager for local policy when IT-III…