Solicitation_Attachments.docx

ATTACHMENTS

1. Performance Work Statement (PWS)

1. Equipment Listing

1. Lists of Acceptable Documents to Establish U.S. Citizenship

1. Contract Administration Plan, Non-Personal Services

Attachment 1: Performance Work Statement (PWS)

PERFORMANCE WORK STATEMENT (PWS)

Getinge Sterilizer & Ultrasonic Washer Maintenance Naval Medical Center Portsmouth

1.0. GENERAL INFORMATION

Naval Medical Center Portsmouth (NMCP), located at 620 John Paul Jones Circle, Portsmouth, VA 23708, has requirements for a non-personal services contract to provide maintenance support and original equipment manufacturer (OEM) parts for designated Government-owned Getinge USA, Inc. (Getinge) sterilization systems. Specific steam sterilizing units, washer/sterilizing units, and labware/surgical instrument washers will be identified in the equipment list (Attachment 2). Maintenance, support, and OEM parts shall be provided for a one (1) year period of performance from 01 October 2017 through 30 September 2018 with four one-year option periods to extend service through 30 September 2022.

1.1. Scope. The Contractor shall provide preventive and corrective maintenance services for all equipment listed in Attachment 2, unless otherwise stated. The Contractor shall maintain the equipment within the original equipment manufacturer’s (OEM) specifications, in accordance with all United States (US), State, and Local laws and regulations, US Navy regulations, instructions, and Joint Commission requirements. All Joint Commission requirements are specified in the Comprehensive Accreditation Manual for Hospitals (CAMH), readily available at www.jointcommission.org. U.S. Navy regulations and instructions will be made available upon request. When product recalls or upgrades are necessary to maintain the equipment in service within the original manufacturer’s specifications, the Contractor shall provide all associated hardware and software updates/upgrades. The Contractor shall not have access to protected health information (PHI) in order to provide the services described herein.

1.1.1. Maintenance shall include unlimited 24x7 telephone support, regularly scheduled preventive maintenance, inspections, calibrations, corrective maintenance tasks, and unlimited emergency responses. Coverage shall be included for all systems listed in Attachment 2, subsystem components, assemblies, corresponding integrated boilers, and water savers (i.e., Contractor is responsible for total maintenance of entire system). The Contractor shall maintain the system such that it meets Navy and Defense Health Agency (DHA) Cybersecurity requirements. All maintenance provisions shall apply to hardware, firmware, and software, as appropriate, unless otherwise stated. The Contractor shall provide all labor, materials, travel, personnel, supervision, freight, and OEM non-refurbished parts for the scheduled (preventive) and unscheduled (corrective) maintenance for all equipment identified in Attachment 2.

1.1.2. The equipment list, see Attachment 2, shall fluctuate over time, as hardware and software eclipse useful life and as new equipment comes off warranty. However, the aggregate requirement and level of effort will remain relatively constant over the life of the contract. Any changes to the equipment list, see Attachment 2, will be executed through a contract modification.

1.1.3. This Contract shall provide scheduled and unscheduled support/service coverage between the hours of 8:00 AM and 5:00PM Eastern Time (ET), Monday through Friday, excluding Federal Government holidays, which are identified online at the following site: https://www.opm.gov/policy-data-oversight/pay-leave/pay-administration/fact-sheets/holidays-work-schedules-and-pay.

1.2. Contracting Officer’s Representative:

1.2.1. The Contracting Officer's duly authorized representative, the Contracting Officer’s Representative, will perform inspection and acceptance of services to be provided.

1.2.2. For the purposes of this clause, HM1 Jason Borsellino, 757-953-5336, email: jason.p.borsellino.mil@mail.mil, is the authorized representative of the Contracting Officer.

2. DEFINITIONS. As used throughout this PWS, the following terms shall have the meaning set forth below:

2.1. Calibration. This activity should be the procedures for the mechanical adjustments of the device to ensure consistent, standardized performance or output as per the original equipment manufacturer recommendations.

2.2. Contracting Officer (KO). A warranted representative of the federal government who has the express authority to enter into, administer, and/or terminate contracts and make related determinations and findings. The KO is the only person authorized to approve changes to any terms, conditions, or requirements of the contract.

2.3. Contracting Officer’s Representative (COR). A Government employee appointed by the KO and responsible for the inspection, evaluation, and acceptance of products and services provided in accordance with the terms and conditions of the contract.

2.4. Corrective Maintenance: Repair, adjustment, calibration, software manipulation and upgrades or other action taken to return a piece of equipment to original manufacturers specifications following a failure, damage, or other incident that causes the product to no longer perform within the original specifications.

2.5. Defense Medical Logistics Standard Support (DMLSS). The automated procurement, maintenance, and supply system utilized to document various material management functions within the command, and throughout the Department of Defense.

2.6. Field Service Report (FSR). Documentation completed by Contractor personnel to officially record all instances of contracted troubleshooting, work, and services conducted on equipment. Specifics on required reporting details can be seen in Section 3.10.2.

2.7. Inspections. The activity of doing functional testing and safety inspections of a medical device at regular intervals to ensure that the equipment is safe for use in accordance with manufacturer’s recommended procedures.

2.8. ISO 9001. The ISO 9000 series is a set of five individual, but related, international standards on quality management and assurance. These standards were developed to effectively document the quality system elements to be implemented in order to maintain an efficient quality system in a company. ISO 9001 is the most comprehensive standard covering design, manufacturing, installation, and servicing systems.

2.9. Original Equipment Manufacturer (OEM). The company which has created a specific model of product/device.

2.10. Preventive Maintenance: Preventive maintenance is used to describe those periodic and “as required” services necessary to maintain equipment in an operating condition which minimizes corrective maintenance, including but not limited to calibration, adjustment, lubrication, updating software for security, safety or system functionality issues, as well as that testing required to maintain a safe environment of care which includes electrical safety testing, output testing, replacement of batteries and other shelf life components on a scheduled basis (which becomes corrective maintenance if the component fails due to lack of preventive maintenance).

2.11. Uptime: Uptime is defined as that time, during the clinical areas’ normal business hours, when the equipment is available for clinical use without restrictions to the quality of the results, and without safety hazards to the staff or visitors.

3. PERFORMANCE REQUIREMENTS:

The Contractor shall provide equipment maintenance services, to include all periodic planned maintenance, unscheduled repairs and OEM parts, in accordance with OEM specifications and in compliance with ISO 9001 standards, to include repairs necessitated by operator error. The Contractor shall possess ISO 9001 certification. A copy of the certification shall be provided upon request. Upon completion of each preventive maintenance visit and each corrective maintenance visit, field service personnel shall submit a signed Field Service Report to the COR for data entry into DMLSS. The Field Service Report shall include all information outlined in Section 3.10.2. of the PWS.

3.1. Service Contractor’s Qualification: The Contractor shall be an Original Equipment Manufacturer (OEM) certified service provider. Contractors shall verify that an individual whom they plan to employ or continue to employ in the United States is authorized to accept employment in the United States, see Attachment 3. Individuals, such as those who have been admitted as permanent residents, granted asylum or refugee status, or admitted in work-related nonimmigrant classifications, may have employment authorization as a direct result of their immigration status.

3.1.1. Field Service Personnel shall be authorized by the OEM-certified service provider to perform the required maintenance services. The Contractor shall ensure that all field engineers possess current OEM-certification level training on all devices encompassed in the equipment list. Service personnel shall have sufficient experience to demonstrate proficiency in maintenance of the product.

3.1.1.1. Experience of at least three (3) years working on a class of equipment, or over one (1) year on the specific make and model is sufficient to indicate experience. Substantially more time may be required based upon the technology involved. Occasional experience with a limited set of equipment does not meet the requirements of this contract.

3.1.1.2. The Contractor shall provide, to the COR, written assurance of the competency of their personnel as well as a list of credentials of approved field service personnel. This assurance shall be provided upon award and when new employees are added. The KO and/or COR may authenticate the training requirements and request training certificates or credentials from the Contractor at any time.

3.1.1.3. Government Right of Refusal: NMCP reserves the right to reject any of the Contractor’s personnel and refuse them permission to enter the premises or work on NMCP equipment. This right may be exercised at any time. The reasons for rejections may include: lack of training and experience, but may also include, but not be limited to: behavior, attire, security concerns, and immigration status.

3.1.1.4. Field engineers shall provide all OEM parts, labor, materials, travel, personnel, supervision, and freight necessary to complete repairs and preventive maintenance on all equipment listed within this contract and shall not invoice NMCP for work performed at the direction of the Contractor.

3.1.1.5. In order to travel freely onto and off of the military installation at Naval Medical Center Portsmouth, Field Service Engineers may have to undergo background checks, the ‘Rapid Gate’ process, and/or the ‘Vendor Mate’ process.

3.1.1.6. Field engineers shall provide services in accordance with the performance requirements specified in this PWS.

3.1.2. Technical documentation: The Contractor shall obtain, have on file, and make available to its field service personnel all operational and technical documentation, which is required to meet the performance requirements of this Contract. This documentation shall include any software needed for or beneficial in speeding up the diagnosis, repair, or calibration of the equipment. The Contractor shall ensure that all Field Service Personnel possess the ability to perform corrective software upgrades and manufacturer recall notices, and are in possession of legally licensed diagnostic software necessary for rapid, efficient, and effective maintenance.

3.1.3. The Contractor Point of Contact (POC). The Contractor shall provide, in writing, the name and telephone number of a primary and alternate, English-speaking, individual to act as their representative for the scheduling and coordination of service calls.

3.2. Preventive Maintenance: Contractor shall ensure that 95% or more of all periodic maintenance is performed within thirty (30) calendar days of the due date, and that 100% of periodic maintenance is performed within sixty (60) calendar days of the due date.

3.2.1. Equipment in Use: If, for reasons beyond the Contractor’s control, equipment is not made available for maintenance for the entire thirty (30) calendar days before the maintenance due date and/or sixty (60) calendar days following the due date, the Contractor shall immediately notify the COR.

3.2.2. Equipment Unable to Locate (UTL). If the Contractor is unable to locate an item within the maintenance window specified, the Contractor shall immediately notify the COR. The Contractor shall arrange the performance via coordination with the COR during circumstances of unexpected delays, at no additional cost to the Government. The COR may determine that the property has been disposed of or is otherwise inactive or unavailable for use and request that the Contracting Officer adjust Attachment 2, accordingly.

3.2.3. Preventive Maintenance Scheduling: For all equipment listed in Attachment 2, the frequency of preventive maintenance will be determined by the Defense Medical Logistics Standard Support property database, dependent on device codes, unless the OEM PM (preventive maintenance) periodicity is more frequent. Preventive maintenance visits shall include complete inspection and testing of the equipment in accordance with maintenance procedures identified in DMLSS and/or manufacturer recommended guidelines. Preventive maintenance visits shall be scheduled with NMCP BIOMED Department at least one month (30 calendar days) in advance.

3.2.4. 100% Preventive Maintenance: Under the circumstances of Sections 3.2.1 or 3.2.2, the COR and Contractor shall arrange a means of complying with the requirements for preventive maintenance at no additional cost to the Government. Equipment determined missing, lost, or stolen shall be exempt from maintenance.

3.3. Corrective maintenance: The Contractor shall provide for any corrective maintenance services necessary to maintain equipment within the original manufacturer’s specifications, and in accordance with any applicable Food and Drug Administration (FDA) requirements. Corrective maintenance shall be provided to equipment with damage resulting from, but not limited to, unintentional operator error, normal wear and tear, component part failures, environmental issues (e.g., water damage), etc.

3.3.1. The Government request for corrective maintenance will be placed by the NMCP BIOMED Department to the Contractor’s POC. Corrective Maintenance shall be completed during the hours identified in Section 1.1.3.

3.3.2. Modifications: The Contractor shall maintain equipment within the original manufacturer’s specifications, and shall make no modifications to the original design.

3.3.3. All “repair by exchange” shall be approved by the NMCP BIOMED Department in advance. “Repair by exchange” refers to completely replacing a piece of equipment or a system, if repairs cannot return the original system to an operational state.

3.3.4. Response time: Within two (2) hours of notification, Contractor personnel shall respond by telephone. If the equipment cannot be restored to the operating condition via telephone, the Contractor personnel shall arrive onsite within twenty-four (24) hours. The onsite response time is measured from the time the Contractor is originally called, not from the time the Contractor returns the call. The Contractor is expected to return the machine to service within 48 hours from the time the Contractor is initially contacted.

3.3.5. Telephone Support: Telephone consultation shall provide instruction in determining operator error, determine the most likely cause of the problem, determine if resolution of the problem requires the dispatch of a FSE, and identify replacement parts likely to be required in order to return the equipment to 100% operational condition, as specified by the OEM.

3.3.6. Software maintenance is within the scope of the contract, including updates and patches as needed, at no additional cost to the Government. The Contractor shall provide software revisions and updates, via field service changes, as required by the FDA or manufacturer announced safety-hazard recalls. Updates shall be performed as soon as possible after release, no later than the first scheduled Preventative Maintenance Inspection following release. Any updates that have been identified as critical, or required for the proper operation of equipment, shall be installed within 30 calendar days of release.

3.3.7. Overtime: Overtime services, defined as worked performed outside of the hours defined in Section 1.1.3., are not part of this contract. If necessary to initiate services beyond 5:00 PM, local time on weekdays, or any times other than those specified in Section 1.1.3., the COR and NMCP BIOMED shall be notified prior to performance and a separate contract must be put into place by NMCP. Accordingly, no overtime shall be billed to the Government under this contract.

3.4. Preventive Maintenance and Repair Schedules. Completed Field Service Reports are required prior to acceptance of any invoice.

3.4.1. Services shall be required based upon the following agreed schedules:

3.5. Parts: The Contractor shall provide coverage for all repair and replacement parts necessary to maintain the equipment, see Attachment 2, within the parameters of the original manufacturer’s specifications.

3.5.1. The Contractor shall supply new, non-refurbished OEM parts, including only OEM-approved lubricants and lubricant wear points, for all repairs necessary to restore equipment to the original manufacturer’s specifications. The Contractor shall, at their expense, replace all worn or defective parts necessary to restore the equipment to 100% operational condition as specified by the OEM.

3.5.2. Replacement parts shall be furnished within the one (1) calendar day of parts ordering. Parts shall be requested by the NMCP BIOMED Department or by the contractor’s field service personnel. The Contractor shall have ready access to unique and/or high mortality replacement parts. All parts supplied shall be compatible with the existing systems.

3.5.3. In the event that replacement parts are required to be shipped, shipping shall be performed with next day air at no additional cost to the Government. If next day air is not available, then the Contractor shall ship by the next fastest means.

3.5.4. Contractor installed replacement parts shall become the property of the Government. The Contractor shall extend to the Government all commercial warranties on replacement parts, consistent with standard industry practices. Replaced items shall be properly disposed of at no additional cost to the Government (Contractor shall pay all “environmental fees”, where required). Freight, postage, and storage charges associated with shipment and receipt of replacement parts, and the return of parts, shall be the responsibility of the Contractor.

3.6. Training: The Contractor shall provide one (1) initial training session for NMCP personnel on the procedures and processes of the Contractor’s maintenance program, immediately upon contract award. This training will provide insight into the OEM-specified procedures for preventive maintenance and frequently observed issues that require corrective maintenance. When requested by the COR, the Contractor shall provide additional training sessions during the contract period, as required.

3.7. 100% Completion During Hours of Work: Work required in the performance of this contract shall be performed during the hours specified in Section 1.1.3., unless otherwise specified. The Contractor shall also provide telephone technical support 24x7, excluding Federal Government holidays. This consulting service shall be provided to avoid undue delays in equipment repairs during after-hours and weekend periods, as applicable. Under no circumstances shall the Contractor assume an inquiry, via telephone or any other means, is authorization to provide services not specifically covered by the terms of the contract.

3.8. Uptime Rate: The Contractor shall maintain an overall uptime rate of 95% or better, for all equipment listed in Attachment 2.

3.8.1. Uptime Calculation: Uptime is calculated on a rolling six (6) month basis. Until the Contractor has at least six (6) months of performance experience at NMCP, the uptime shall be calculated cumulatively for the entire duration of the contract. The following formula will be used to calculate uptime:

Variables Definitions:

U= Possible Equipment Uptime (100%) H= Hours of Coverage per day H1= Begin Coverage Time during each day H2= End Coverage Time during each day A= Number of covered days of the week W = Weeks of Coverage in a Year C= Uptime Commitment (per Section 3.8.)

Known (for this contract, per Section 1.1.3.):

H1= 0800 hours H2= 1700 hours A= 5 days per week W= 52 weeks per year C = 95%

Calculations:

D= Hours of Calculated Downtime (Unknown) T= Total Actual Uptime Percentage (Unknown) Δ= % difference from Uptime Commitment (Unknown)

*Note* - Downtime hours shall fall within the Contractor’s hours of coverage listed in Section 1.1.3. Downtime hours outside of the coverage timeframe listed in Section 1.1.3. shall not be calculated as a metric of contractor performance. Downtime ends once the system is available for full clinical use.

3.9. Recalls and Updates: The Contractor shall provide installation and mandatory updates (software or hardware) within 5 business days for Class I equipment recalls and 30 calendar days for all other classes, upon original manufacturer’s and/or FDA recall or alert notification. The Contractor shall provide documentation of such installation and mandatory updates.

3.10. Service Events: Upon arrival on-site, prior to performing any work, field service personnel shall physically sign in with NMCP BIOMED during normal working hours. The NMCP BIOMED Department is located in Building 250 on the 1st floor. Phone contact can be made via calling 757-953-5336. The COR, BIOMED Technical Liaison, and/or any BIOMED Personnel may accompany the field service person as an observer during any work performed on-site.

3.10.1. Lock Out/Tag Out: The Contractor shall notify BIOMED, via Field Service Report, of problems that result in the equipment being left disabled upon their departure. If equipment is left disabled, a method of physical use prevention of the disabled equipment (i.e., Lockout, removal to BIOMED) shall be implemented in compliance with Occupational Safety and Health Administration (OSHA) and Navy regulations, specifically Title 29 1910.147 of the Code of Federal Regulations and the OPNAVINST 5100.23G Chapter 24, to prevent any patient, staff, or visitor hazards. Where lockout procedures are not possible, tag-out procedures shall be followed in accordance with the above regulations. Additionally, a label shall be adhered to the disabled equipment specifying the equipment is not serviceable. Reference is available at: http://www.public.navy.mil/NAVSAFECEN/Documents/OSH/SafetyOfficer/5100.23G_CH-1_with_updated_links.pdf

3.10.2. 95% Service Event Documentation: Upon completion of each preventive maintenance visit and each corrective maintenance visit, field service personnel shall submit a signed Field Service Report (FSR) to NMCP BIOMED Equipment Repair. The service report shall indicate all problems addressed, devices checked, parts replaced/repaired, parts ordered, and problem resolution or pending action. Each service report shall at a minimum document the following data legibly, in English, and in complete detail:

1. Name of Contractor

2. Name of Contractor personnel performing service

3. Contractor personnel log/control number

4. Equipment identification factors to include: Manufacturer, make, model, serial number and Facility Equipment Control Number (ECN)

5. Description of problem reported by user

6. Date & time of initial trouble call

7. Date & time, beginning and ending, of hours on-site for service call

8. Itemized description of service performed to include, but not be limited to: parts used, problem found, corrective action(s) taken or recommended, communications had with NMCP BIOMED personnel

9. Resolution and/or pending action(s)

10. Estimated total billing cost, if NMCP did not have an existing maintenance agreement:

a. Include the list price of services, labor, travel, and parts

b. Note - This pricing information is not to be confused with an invoice and no separate payments will be made for the services provided. This is a firm fixed price contract, meaning the contract will be reimbursed at an agreed upon monthly rate regardless of the amount of work performed each month.

11. Signatures:

a. Contractor performing service

b. NMCP Biomedical Engineering Technician (BMET) verifying service(s) rendered

3.11. 100% Monthly Reports: The Contractor shall submit monthly management reports on the maintenance and repair activity of all equipment under this Contract to the COR via e-mail. This report shall address total preventive and corrective maintenance work orders generated, numbers completed as a percentage, and numbers outstanding at the end of each month. Report of the previous month’s activity shall be submitted no later than the fifteenth (15th) day of the following month.

3.12. Test equipment: Test equipment calibration shall be traceable to National Institutes of Standards and Technology (NIST). Any efforts conducted without equipment within the calibration intervals is not performance in accordance with this Contract. Upon request by COR, the Contractor shall provide a copy of the current calibration certification of all test equipment to be used, or which has been used, on NMCP equipment.

3.13. Removal of equipment from site: No equipment shall be removed without the approval of the COR and Materials Management Department at NMCP. Property passes for equipment removal shall be obtained by the Contractor via the Materials Management Department at NMCP. Any failure to obtain such passes which results in detainment or prosecution of service Contractor personnel are the sole responsibility of the service Contractor personnel.

3.13.1. Removal Report: Prior to removing the equipment/system from NMCP, the Contractor shall provide a detailed description of removed items in writing on the Contractor’s company letterhead. For associated items/accessories, the Contractor shall provide a detailed written description and quantities of items to be removed. The description shall include, as a minimum, manufacturer’s serial numbers and equipment control number (ECN) of all equipment/items removed. In the event that items/sub-assemblies/accessories are repaired via “Repair by Replacement,” a detailed description of replaced items shall be included upon return of repaired components.

3.13.2. Off-site repairs: No additional charge shall be allowed for work performed off-site, or any additional time required. All charges resulting from a Contractor determined requirement to transport Government-owned property, covered by this contract, to and from an alternate repair location shall be the responsibility of the Contractor. The Contractor shall provide insurance coverage for damage to or loss of equipment while in Contractor or service Contractor’s custody.

3.13.3. Hard Disk and Solid State Drives (HDD & SSD): In regards to patient information’s confidentiality and privacy, Contractor personnel shall not remove equipment containing patient information from NMCP. HDD nor SSD shall never be removed from NMCP.

3.13.4. Return of Government-owned property: Upon completion of any and all regularly scheduled preventative or unscheduled corrective maintenance, the Contractor shall return all equipment owned by the United States Government.

4. SAFETY REQUIREMENTS: The Contractor shall take safety precautions as the COR may determine to be reasonably necessary to protect the lives and health of occupants of buildings in which work is being performed. NMCP shall notify the Contractor of any non-compliance with the foregoing conditions and the action(s) to be taken. The Contractor shall, after receipt of such notice, immediately correct the conditions to which attention has been directed. If a field service engineer refuses to comply promptly, the COR may issue an order stopping all or any part of the work. Under such circumstances, the KO can hold the Contractor in contract default. Nothing in this section shall be construed so as to limit the Contractor responsibilities to comply with any existing law, nor to switch jurisdictions.

5. IDENTIFICATION, PARKING, SMOKING REGULATIONS: Field service personnel shall wear visible photo identification at all times while on the premises of NMCP. It is the responsibility of the field service personnel to park in the appropriate designated parking areas. Information on parking is available from NMCP Security personnel. Smoking is prohibited inside any buildings of NMCP. Possession of weapons, alcohol, or pharmaceuticals that are not over the counter or are not prescribed to the individual/family is prohibited on NMCP premises. Enclosed containers, including tool kits, are subject to search. Violations of NMCP regulations may result in citation answerable in the United States (Federal) District Court. Violation of any policy which results in lost time for the Contractor is the sole responsibility of the Contractor and shall not be charged to the Government.

6. GENERAL LIABILITY INSURANCE: The Contractor shall be required to have liability insurance to cover any actions on the part of the field engineers which result in injury or death to staff, visitors, or other Contractors. Such comprehensive form of policy shall provide coverage of at least $500,000 per occurrence (FAR 28.307-2).

7. PROPERTY DAMAGE LIABILITY INSURANCE: Service vendors are required to have Property Damage Liability coverage of at least $500,000.

8. MODIFICATIONS TO CONTRACT: Only the KO has the authority to obligate the Government, and then only in writing. No modification or instruction from any party shall be construed to authorize the Contractor to take any action for which they expect compensation without written authorization from the KO.

9. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

Performance Objective Performance Standard Acceptable Quality Level Monitoring Method/Performance Assessment PWS Reference

100% of all periodic, preventive maintenance is performed within 60 days of due date.

9.1. Compliance with Applicable Laws: Contractor shall be knowledgeable of and comply with all applicable Federal, State, and local laws, regulations, and requirements regarding the conduct of his business.

9.2. Site Visits. The Government reserves the right to schedule meetings to discuss or resolve issues/problems, as it deems to be critical, at no additional cost to the Government.

9.3. Work Performed by Others. When work performed by the Government or other Contractors is expected to affect the Contractor’s performance of work, the Government shall coordinate with the Contractor and provide necessary information (plans, specifications, etc.) for such work to the Contractor such that the Contractor may make scheduling allowances. The COR shall resolve any schedule conflicts between the Contractor and work performed by the Government or other Contractors. Such actions shall not result in additional cost to the Government under this contract.

9.4. Government Right to Change Standard Operating Procedures. The Government reserves the right to establish and/or change Standard Operating Procedures which shall be binding on the Contractor, i.e., work order procedures, emergency and fire procedures, security procedures and power failures.

9.5. Phase-In Service: Upon award, which should occur prior to expiration of existing service contracts, the Contractor shall have the opportunity to inspect the existing equipment and note any deficiencies. This action shall occur in sufficient time to notify the existing contract holder to correct deficiencies noted (at least 24 business hours prior to expiration of contract). Failure to submit such list in a timely manner shall be considered acceptance of the equipment in the existing condition. The Contractor shall not be eligible to claim expenses to bring the equipment into manufacturers’ specifications.

9.6. Phase Out of Service: Upon expiration or termination of this contract, the Contractor, at the Contractors’ expense, shall provide OEM certifications for all equipment covered under contract at the rates/discounts normally provided to Government customers. If repairs or corrections to the equipment have to be made to obtain such certifications, the contract shall arrange to have those repairs or corrections made at the Contractors’ expense.

10. GOVERNMENT-FURNISHED PROPERTY AND SERVICES.

10.1. The Government will be responsible for maintaining the proper environment, including utilities and site requirements, necessary for the system to function properly, as specified by the OEM.

10.2. The Government will operate the systems in accordance with the instruction manual(s) provided by the OEM.

10.3. Government Responsibility for Damage. The Government shall not be responsible, in any way, for damage to the Contractor’s supplies, material, equipment, or to Contractor’s employees’ personal belongings brought onto the site. The Government will not provide storage space for the Contractor’s equipment.

10.4. Physical Security. The Contractor shall safeguard all Government property provided for Contractor use. The Contractor shall designate an individual and alternate(s) to receipt and account for Government-furnished facilities and equipment. The Contractor shall not remove Government furnished property, if any, from NMCP.

11. CONTRACTOR-FURNISHED ITEMS AND SERVICES.

11.1. The Contractor shall furnish all supplies, materials, repair or replacement parts, tools, equipment software upgrading and labor necessary to efficiently and satisfactorily perform the requirements of this contract.

11.2. The Contractor shall be responsible for the repair/replacement of damaged Government-owned equipment and property due to the negligence of the Contractor or his representatives. All such replacement or repair shall be at the Contractor’s expense and shall be inspected to the satisfaction of the COR.

11.3. The Contractor shall protect all facilities from damage caused by the Contractor and shall repair, at no additional cost to the Government, all damages caused by the Contractor’s activities. During performance of services, Contractor shall keep NMCP safe, neat, clean and orderly. Contractor shall be responsible for all means, methods, techniques, sequences, and procedures of the services. Contractor employees shall demonstrate appropriate behavior and dress at all times.

11.4. Contractor Supplies and Equipment. The Contractor supplies and equipment shall comply with Federal, State, municipal, and industry or OEM specifications.

11.5. Two-way Radios & Cell Phones. The use of Contractor provided two-way radios and cell phones for communication between personnel shall be approved by the Base Communications activity and may not be used in designated areas in NMCP. Contractor shall submit a written request to use the radios to the COR. The request shall detail proposed equipment, operating frequencies, and other particulars in writing. The Government shall not be liable for any damages as a result of not permitting the use of radios within the facility.

11.6. The Contractors personnel shall comply with the Department of Defense (DoD) Information Assurance Policies applicable.

11.7. Contractors are required to maintain a Drug Free Workplace.

12. VULNERABILITY MANAGEMENT.

12.1. For products or systems which have received Authority to Operate (ATO) from DHA HIT, the Contractor shall agree to the following:

12.1.1. The Contractor shall be proactive in working with the Navy to mitigate new threats as they emerge. Vulnerability mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating systems, servers, development platforms, and the application being delivered to the Navy shall be in compliance with all known applicable guidelines. The Contractor shall maintain the system(s) in operational condition with the latest Contractor-validated and approved security patches.

12.1.2. Security scans will be run during Government acceptance testing and during periodic security reviews. A CAT I vulnerability is any vulnerability, the exploitation of which will, directly and immediately result in loss of Confidentiality, Availability, or Integrity. CAT II vulnerabilities are any vulnerability, the exploitation of which has a potential to result in loss of Confidentiality, Availability, or Integrity. The Contractor shall close all discovered vulnerabilities within three (3) months of discovery. The Contractor shall submit to Government detailed explanations for the inability to close discovered vulnerabilities. The Contractor shall submit to Government for approval of any mitigation that addresses any open vulnerabilities.

12.1.3. The Contractor shall maintain system and update to comply with updated Security Technical Implementation Guides (STIGs) as made available by the Government within three (3) months of notification by the Government. The Contractor shall ensure the system(s) is in compliance with the DoD Information Assurance Vulnerability Management (IAVM) program.

12.1.4. The Contractor shall maintain the authorized security configuration and notify the Government within forty eight (48) hours of any major changes for review. The Contractor shall update all ATO-required supporting documentation in the event of a system policy, procedural, logical or technical changes to the system.

12.1.5. The Contractor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to Government for approval.

12.2. Local Privileged and Administrative User/Local System Accounts: The Contractor shall create a single local user account with administrative/root level privileges for purposes of conducting system repairs and maintenance only. This account shall be separate and distinct from the built-in local administrative/root account provided by the Operating System and shall comply with DoD policy. All factors required to complete successful identification, authentication and authorization against the built-in local Administrative/Root level account shall be provided to the NMCP BIOMED Engineering Department.

12.2.1. Complete administrative system rights shall be provided to the government System Administrator for the purpose of conducting device vulnerability scans as needed.

12.3. DHA Business to Business (B2B) Gateway. All Contractor systems that will communicate with Department of Navy (DON) systems shall interconnect through the established DHA Business to Business (B2B) gateway.

12.3.1. If the Contractor elects to communicate with DON systems, the Contractor shall connect to the B2B gateway via a Contractor procured Internet Service Provider (ISP) connection and assume all responsibilities for establishing and maintaining their connectivity to the B2B gateway. This shall include acquiring and maintaining the circuit to the B2B gateway and acquiring a Virtual Private Network (VPN) device compatible with the DHA VPN device. Maintenance and repair of Contractor procured VPN equipment shall be the responsibility of the Contractor.

12.3.2. If the Contractor elects to communicate with DON systems, the Contractor shall configure their network to support access to government systems (e.g., configure ports and protocols for access).

12.3.3. If the Contractor elects to communicate with DON systems, the Contractor shall provide full time connections to a TIER1 or TIER2 ISP. Dial-up ISP connections are not acceptable.

12.3.4. The Contractor shall comply with DoD guidance regarding allowable ports, protocols and risk mitigation strategies prior to accessing DoD/DHA networks. The Contractor shall be required to complete a DISA Form 2875, System Authorization Access Request form (SAAR) and submit it to the Navy Picture Archiving and Communication Systems (PACS) Office for processing. Contractor personnel shall be required to complete applicable DoD cybersecurity training.

12.4. ENTERPRISE-WIDE CONTRACTOR MANPOWER REPORTING APPLICATION (ECMRA)

12.4.1. The Contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this Contract for the Navy via a secure data collection site. The Contractor is required to completely fill in all required data fields using the following web address https://doncmra.nmci.navy.mil.

12.4.2. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://doncmra.nmci.navy.mil.

12.5. Applicable References:

12.5.1. DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT), http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf

12.5.2. NIST SP 800-37 Guide for Applying the Risk Management Framework to Federal Information Systems of February 2010, as amended, http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf

12.5.3. NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations, of 30 April 2013, as amended, SP 800-53

12.5.4. DoD Instruction 8500.01 of 14 March 2014, DoD Cybersecurity, http://www.dtic.mil/whs/directives/corres/pdf/850001_2014.pdf

12.5.5. DHA Administrative Instruction 77 of 28 May 2015, http://www.dtic.mil/whs/directives/corres/ins2.html

12.5.6. DoD Instruction 6025.18-R, DoD Health Information Privacy Regulation, http://www.dtic.mil/whs/directives/corres/pdf/602518r.pdf

12.5.7. DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs, http://www.dtic.mil/whs/directives/corres/pdf/858002_2015_dodi.pdf

12.6. SUPTXT204-9400(1-17) Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information

The following shall be inserted in full text in all solicitations and contracts (including commercial acquisitions) which require contractor unclassified access to federally controlled facilities, sensitive information, IT systems or protected health information. For commercial acquisitions, this text shall be incorporated into either the Statement of Work or Performance Work Statement.

Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information

Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The Deputy Secretary of Defense Directive-Type Memorandum (DTM) 08-006 – “DoD Implementation of Homeland Security Presidential Directive – 12 (HSPD-12)” dated November 26, 2008 (or its subsequent DoD instruction) directs implementation of HSPD-12. This clause is in accordance with HSPD-12 and its implementing directives.

APPLICABILITY

This text applies to contractor employees requiring physical access to any area of a federally controlled base, facility or activity and/or requiring access to a DoN or DoD computer/network/system to perform certain unclassified sensitive duties. This clause also applies to contractor employees who access Privacy Act and Protected Health Information, provide support associated with fiduciary duties, or perform duties that have been identified as National Security Position, as advised by the command security manager. It is the responsibility of the responsible security officer of the command/facility where the work is performed to ensure compliance.

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command’s Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

ACCESS TO DOD IT SYSTEMS

In accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity’s Command Information Assurance Manager.

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation , which is a higher level investigation than the National Agency Check with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s Security Manager and Information Assurance Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the COR shall sign the SAAR-N as the “supervisor”.

The SAAR-N shall be forwarded to the Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that…