N62645-18-Q-0004.docx

N6264518Q0004

Section SF 1449 - CONTINUATION SHEET

GENERAL CONTRACT INFORMATION

MINIMUM/MAXIMUM CONTRACT VALUE

The minimum contract value for all orders issued against this contract is $1,000.00. The maximum contract value for all orders issued against this contract is $6,900,000.00.

CONTRACTING OFFICER’S REPRESENTATIVE

The Contracting Officer's duly authorized representative will perform inspection and acceptance of supplies/services to be provided.

For the purposes of this clause, David Baker, 301-619-7487, email: david.d.baker26.civ@mail.mil is the authorized representative of the Contracting Officer.

Inspection and acceptance will be performed at the assigned location according to the performance work statement.

CONTRACTOR SUPPORT

Notice: Navy Use Of Support Contractor For Contract Closeout Functions

Naval Medical Logistics Command (NMLC) uses two private contractors in support of the contract closeout process. Those companies are Contracting Resources Group (CRG) of Federal Hill, MD, doing business under the authority of the Small Business Administration’s 8(a) program and the Ability One Program, doing business under the authority of the Javits-Wagner O’Day Act (41 U.S.C. § 47).

The contract closeout process includes activities such as processing deobligation modifications, obtaining contractor and requiring activity concurrence, preparing the DD-Form 1594 (Contract Completion Statement), and preparing closed files for archiving. Support contractors may perform additional administrative duties, including filing and processing simple administrative modifications. Performing these functions require the contractor employees to have access to the contract file. Therefore, information the Contractor provides to the Government or information already in the possession of the Government may be viewed by these support contractors in the course of performing contract close-out functions. The information that may be made available to the contractor may include pricing and technical responses and performance information.

NMLC has signed Non-Disclosure Agreements with each support contractor employee and has required both contractors to provide a Conflict of interest Mitigation Plan to ensure these employees are firewalled from all business development activity.

By signature of this contract, the quoter consents to access of their business sensitive/confidential or proprietary data by the Government’s support contractor personnel in order to perform close out services.

TASK ORDERS

Task orders may be placed by any warranted contracting officer serving at the Naval Medical Logistics Command.

The ordering period for issuance of task orders is 01 January 2018 through 31 December 2019.

Task orders will be awarded on a firm fixed price basis.

Task orders issued against this contract will be placed through electronic commerce including email in accordance with the terms and conditions of the contract. Oral orders are not authorized. Task orders will be issued on a DD Form 1155 or a SF 1449.

The delivery date of any task order shall be no later than 31 December 2019.

Each task order will contain at a minimum the following information:

a. The date of order

b. Contract number and order number

c. Description of the requirement

d. Pricing information

e. The delivery date

f. Accounting and appropriations data

g. Payment office address

h. Invoicing and acceptance instructions

i. Any other pertinent data

ADDENDUM TO 52.212-1

INSTRUCTIONS FOR SUBMITTING A QUOTE:

1. SUBMISSION

a) Electronic Files. The quote shall be submitted via email to the following addresses: nicholas.j.carroll15.civ@mail.mil and derek.m.marriott.civ@mail.mil

b) Electronic files shall not contain classified data. Each quote volume described below shall be prepared as a separate, single file clearly marked with the volume title. Do not use compressed file formats. Submissions shall be virus free.

2. CONTENT REQUIREMENTS

a) Utilize the “Quote Table of Contents” below to organize the electronic quote files.

QUOTE TABLE OF CONTENTS

1. SF 1449/SF 30

NOTE: Page 1 of the SF 1449 and all Amendments (SF 30) must be signed by an authorized representative, which indicates agreement of a 60-day acceptance period.

2. Contract Administrative Data

3. Representation and Certifications

4. Software License Terms

1 PDF file containing Volume I, Administrative/Business

1. Subcontracting Plan

1 PDF file containing the Volume II, Small Business Subcontracting Plan

1. Pricing Workbook

2. Breakdown to support proposed overall pricing Excel Workbook(s) containing Volume III, Pricing

3. QUOTES SHALL BE PREPARED AND SUBMITTED AS FOLLOWS:

3.1. VOLUME I: ADMINISTRATIVE/BUSINESS – (1 PDF file).

3.1.1. Solicitation/Contract/Order For Commercial Items (SF 1449) and Amendments (SF 30). Page 1 SF 1449 with signature of a corporate officer authorized to negotiate for the company in Block 30a, acknowledgement of all amendments, (SF 30) with signature in Block 15B, and agreement of 60 days acceptance period.

3.1.2. Contract Administration Data. Provide points of contact (POCs) for administration of any resulting contract. These POCs shall be available during normal business hours and other than normal business hours. The POC for other than normal business hours will be contacted only in the event of emergencies. Accordingly, the named individual(s) should possess sufficient corporate authority to effectively deal with emergency situations. The telephone number(s) provided should be functional at all times. If there are different POCs for different conditions, such as weekdays, weekends, holidays, etc., please furnish all and explain as follows:

3.1.3. Representations And Certifications.

3.1.3.1. Ensure your representations and certifications are updated at the System for Award Management (SAM) https://www.sam.gov/portal/public/SAM.

3.1.3.2. Include one completed copy of the following, as applicable (if completed via SAM, including completed copies is not necessary):

3.1.3. Software License Terms. For all software furnished under this contract, the offeror shall provide a copy of the software licensing agreement or any terms and conditions that apply to the software.

3.2. VOLUME II: SMALL BUSINESS SUBCONTRACTING PLAN – (1 PDF file).

3.2.1. Submission of a small business subcontracting plan is required. The subcontracting plan shall be in accordance with FAR Clause 52.219-9 and DFARS Clause 252.219-7003, including alternates and deviations (for reference, see FAR 19.704 and DFARS 219-704). The subcontracting plan requirement is not applicable to small business concerns qualified as such under the NAICS code assigned to this solicitation.

3.2.1.1. The Department of Defense (DOD) has established small business goals as an assistance to assure small business receives a fair proportion of DOD awards. The small business subcontracting goal for this requirement is 5% of the total contract value.

3.2.1.2. The Government recognizes that these goals are stated as a percentage of the total contract value for the small business participation plan; whereas, the goals included in the subcontracting plan (FAR Clause 52.219-9) are stated in terms of a percentage of total subcontract dollars.

3.3. VOLUME III: PRICE – (Excel Workbook(s))

3.3.1. Pricing shall be submitted using the attached Excel workbook titled “Pricing Workbook,” see attached for a copy of the workbook along with instructions for its completion.

3.3.2. Provide a breakdown to support the overall proposed total price. This can be provided in a separate Excel workbook or by adding a tab(s) to the “Pricing Workbook.”

(End of addendum)

ARMD Refresh - Air Force MTFs

FFP

ARMD Hardware and Software Refresh for Department of the Air Force Military Treatment Facilities (MTFs)

NET AMT

0001AA

ARMD Refresh - Yokota

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Air Force MTF Yokota.

FOB: Destination

NET AMT

0001AB

ARMD Refresh - Andrews

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Air Force MTF Andrews.

NET AMT

0001AC

ARMD Refresh - Eglin

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Air Force MTF Eglin.

NET AMT

0001AD

ARMD Refresh - Langley

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Air Force MTF Langley.

NET AMT

0001AE

ARMD Refresh - Lackland

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Air Force MTF Lackland.

NET AMT

0001AF

ARMD Refresh - Elmendorf

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Air Force MTF Elmendorf.

NET AMT

0001AG

ARMD Refresh - Keesler

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Air Force MTF Keesler.

NET AMT

0001AH

ARMD Refresh - Travis

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Air Force MTF Travis.

NET AMT

0001AJ

ARMD Refresh - Misawa

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Air Force MTF Misawa.

NET AMT

0001AK

ARMD Refresh - Lakenheath

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Air Force MTF RAF Lakenheath.

NET AMT

0001AL

ARMD Refresh - Nellis

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Air Force MTF Nellis.

NET AMT

0001AM

ARMD Refresh - Wright-Patterson

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Air Force MTF Wright-Patterson.

NET AMT

0001AN

ARMD Refresh - Aviano

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Air Force MTF Aviano.

NET AMT

0001AP

ARMD Refresh - USAF Academy

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Air Force MTF USAF Academy.

NET AMT

0001AQ

ARMD Refresh - Incirlik

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Air Force MTF Incirlik.

NET AMT

0001AR

ARMD Refresh - Osan

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Air Force MTF Osan.

NET AMT

0001AS

ARMD Refresh - ARMOA Lab

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Air Force MTF ARMOA Lab.

NET AMT

ARMD Refresh - Army MTFs

ARMD Hardware and Software Refresh for Department of the Army Military Treatment Facilities (MTFs)

NET AMT

0002AA

ARMD Refresh - Fort Campbell

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Fort Campbell.

NET AMT

0002AB

ARMD Refresh - Fort Wainwright

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Fort Wainwright.

NET AMT

0002AC

ARMD Refresh - West Point

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF West Point.

NET AMT

0002AD

ARMD Refresh - Fort Bliss

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Fort Bliss.

NET AMT

0002AE

ARMD Refresh - Fort Gordon

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Fort Gordon.

NET AMT

0002AF

ARMD Refresh - Fort Bragg

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Fort Bragg.

NET AMT

0002AG

ARMD Refresh - Landsuhl

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Fort Landsuhl.

NET AMT

0002AH

ARMD Refresh - Fort Riley

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Fort Riley.

NET AMT

0002AJ

ARMD Refresh - Fort Benning

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Fort Benning.

NET AMT

0002AK

ARMD Refresh - Fort Stewart

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Fort Stewart.

NET AMT

0002AL

ARMD Refresh - Fort Eustis

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Fort Eustis.

NET AMT

0002AM

ARMD Refresh - Fort Meade

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Fort Meade.

NET AMT

0002AN

ARMD Refresh - Fort Irwin

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Fort Irwin.

NET AMT

0002AP

ARMD Refresh - Fort Hood

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Fort Hood.

NET AMT

0002AQ

ARMD Refresh - Fort Leonard Wood

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Fort Leonard Wood.

NET AMT

0002AR

ARMD Refresh - Seoul Korea

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Seoul Korea.

NET AMT

0002AS

ARMD Refresh - Fort Levenworth

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Fort Levenworth.

NET AMT

0002AT

ARMD Refresh - Tripler

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Tripler.

NET AMT

0002AU

ARMD Refresh - Fort Carson

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Fort Carson.

NET AMT

0002AV

ARMD Refresh - BAMC

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Brooke Army Medical Center.

NET AMT

0002AW

ARMD Refresh - USAISR

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Institute for Surgical Research.

NET AMT

0002AX

ARMD Refresh - Fort Polk

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Fort Polk.

NET AMT

0002AY

ARMD Refresh - WRAIR

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Army MTF Walter Reed Army Institute of Research.

NET AMT

ARMD Refresh - Navy MTFs

ARMD Hardware and Software Refresh for Department of the Navy Military Treatment Facilities (MTFs)

NET AMT

0003AA

ARMD Refresh - Sigonella

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Sigonella.

NET AMT

0003AB

ARMD Refresh - Rota

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Rota.

NET AMT

0003AC

ARMD Refresh - Camp Lejeune

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Camp Lejeune.

NET AMT

0003AD

ARMD Refresh - San Diego

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Sane Diego.

NET AMT

0003AE

ARMD Refresh - Okinawa

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Okinawa.

NET AMT

0003AF

ARMD Refresh - Guam

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Guam.

NET AMT

0003AG

ARMD Refresh - Guantanamo Bay

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Guantanamo Bay.

NET AMT

0003AH

ARMD Refresh - Jacksonville

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Jacksonville.

NET AMT

0003AJ

ARMD Refresh - Naples

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Naples.

NET AMT

0003AK

ARMD Refresh - Lemoore

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Lemoore.

NET AMT

0003AL

ARMD Refresh - Camp Pendleton

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Camp Pendleton.

NET AMT

0003AM

ARMD Refresh - Pensacola

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Pensacola.

NET AMT

0003AN

ARMD Refresh - Beaufort

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Beaufort.

NET AMT

0003AP

ARMD Refresh - Twentynine Palms

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Twentynine Palms.

NET AMT

0003AQ

ARMD Refresh - Cherry Point

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Cherry Point.

NET AMT

0003AR

ARMD Refresh - Yokosuka

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Yokosuka.

NET AMT

0003AS

ARMD Refresh - Portsmouth

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Portsmouth.

NET AMT

0003AT

ARMD Refresh - Kandahar

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Kandahar.

NET AMT

0003AU

ARMD Refresh - Iwakuni

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Navy MTF Iwakuni.

NET AMT

ARMD Refresh - NCR MTFs

ARMD Hardware and Software Refresh for National Capital Region (NCR) Military Treatment Facilities (MTFs)

NET AMT

0004AA

ARMD Refresh - Walter Reed

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Walter Reed National Miliatry Medical Center.

NET AMT

0004AB

ARMD Refresh - Fort Belvoir

The Contractor shall provide ARMD Hardware, Software, and Professional Installation Services in accordance with the attached Peformance Work Statement for Fort Belvoir.

NET AMT

RMF - All Sites

Risk Management Framework (RMF) for all Sites/Services

NET AMT

PERFORMANCE WORK STATEMENT

Anesthesia Recording and Monitoring Devices (ARMD) Medical Equipment Hardware and Software Refresh

1. Definitions

ARMD. Abbreviation of “Anesthesia Recording and Monitoring Device”

ATO. Abbreviation for “Authorization to Operate” The official management decision issued by an Authorizing Official or Policy Approving Authority to authorize operation of an information system and to explicitly accept the residual risk to agency operations (including mission, functions, image or reputation), agency, assets, or individuals.

ATC. Abbreviation for “Approval to Connect” The official management decision given by a senior organizational official to authorize connection of an information system to an enclave and to explicitly accept the risk to organizational operations (including mission, functions, image or reputation), organizational assets, individuals, other organization and the Nation based on the implementation. Systems that are authorized by a non-Air Force (AF) Authorizing Official (AO) (such as DHA AO) but is hosted within the Air Force Information Networks must complete the process to acquire an approval to connect.

B2B. Abbreviation of “Business to Business” Gateway that securely connects and provides Commercial partners access to DoD systems and networks.

Clinically Interfaced Workstation. Each individual PC workstation located at the MTF in which the Contractor’s software interfaces with clinical devices for automatic data capture at the bedside and as described in Paragraph 3.2.

Commercial Hardware. Third-party commercial hardware other than the Contractor’s hardware, including but not limited to PC workstations, servers, wireless networking equipment, and mounting hardware, as described in Paragraph 3.2.

Component. Contractor provided devices: servers and the software they serve out, all storage and archive devices, workstations (diagnostic, review and quality control), hard copy devices, the network and other network peripherals (if provided and installed by the Contractor), Contractor provided ARMD interfaces to Government furnished devices and systems (e.g., HL7).

Component Failure. Any component malfunction which renders the component unable to perform its intended function and requires corrective maintenance, alignment, calibration, or replacement. Any component which is comprised of subcomponents (e.g., workstation comprised of monitors, CPU, keyboard, etc.) shall be treated as a single entity. Therefore, failure of any subcomponent (e.g., a monitor) shall constitute failure of the component (e.g., the workstation).

COR. Abbreviation of “Contracting Officer’s Representative”

Core System. Subset of the System that includes the following components: servers and the software they serve out (including Web servers), all intermediate storage and long-term archive devices, network switches (if Contractor provided).

CPU. Abbreviation of “Central Processing Unit”

CPT. Abbreviation of “Current Procedural Terminology”

Documentation. The Operator's User Manual(s) and related materials provided by the Contractor.

DoD. Abbreviation of “Department of Defense”

DON. Abbreviation of “Department of Navy”

DHA. Abbreviation of “Defense Health Agency”

EOL. Abbreviation of “End of Life”

EHR. Abbreviation of “Electronic Health Record”

FAQ. Abbreviation of “Frequently Asked Questions”

Health Care Delivery Services. As defined in DHA Administrative Instruction 077 Selection of Security Controls, provide and support the delivery of health care to its beneficiaries. This includes assessing health status, planning health services, ensuring quality of services and continuity of care, and managing clinical information and documentation. The minimum Security Categorization (SC) for health care delivery services information that contains personally identifiable information/protected health information (PII/PHI) is as follows: SC = {(confidentiality, Moderate), (integrity, High), (availability, Moderate)}.

HL7. Abbreviation of “Health Level 7”

IA. Abbreviation of “Information Assurance”

IAW. Abbreviation of “In Accordance With”

IAVM. Abbreviation of “Information Assurance Vulnerability Management”

ICD. Abbreviation of “International Statistical Classification of Diseases”

IAVA. Abbreviation of “Information Assurance Vulnerability Alerts”

Information Assurance. Measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation.

IS. Information System

IV&V. Abbreviation of “Independent verification and validation”

JTR. Abbreviation of “Joint Travel Regulations”

Licensed Software. The Contractor’s Medical Incorporated Software and Interface Software.

MTF. Abbreviation of “Military Treatment Facility”

New Versions/Modules. Any new software product(s), releases or new modules offered by the Contractor for which the Contractor customarily charges a fee to its customers. New Versions/Modules are not included in the definitions of Updates hereunder and are not included in this Contract.

Normal Working Hours. The MTFs are normally open for service Monday through Friday between the hours of 7 AM and 5 PM, excluding host national and federally observed holidays. Since the MTFs are located globally, normal working hours apply to the MTF local time zone.

OEM. Abbreviation of “Original Equipment Manufacturer”

OS. Abbreviation of “Operating System”

PC. Abbreviation of “Personal Computer”

PIT. Abbreviation of “Platform Information Technology”

POC. Abbreviation of “Point Of Contact”

Proper Working Order. Operating within Original Equipment Manufacturers (OEM) specifications as designed, produced, delivered and accepted.

Response Time. The timeframe between when the Government POC places the service call to the Contractor and the time when the Contractor responds to the call.

RMF. Abbreviation of “Risk Management Framework”

Software. All clinical information systems software developed by the Contractor and delivered to Government in association with the operation of the ARMD Innovian system including any Software Updates for the foregoing, other than the Interface Software.

SAAR. Abbreviation of “System Authorization Access Request.” Record names, signatures and other identifiers for the purpose of validating the trustworthiness of individuals requesting access to Department of Defense (DoD) systems and information.

System. System shall be defined as the integrated network of all Contractor provided ARMD components.

TO. Abbreviation of “Task Order”

Updates. Software patches released by the OEM to address specific deficiencies or vulnerabilities.

US CERT – Abbreviation for United States Computer Emergency Response Team

VPN. Abbreviation of “Virtual Private Network”

2. SCOPE

2.1. The Government has a requirement for a hardware/software refresh of its currently installed base of Draeger Innovian Anesthesia Recording and Monitoring Device (ARMD) systems as a result of the current Hardware and OS software EOL for all MHS ARMDs deployed under BPA Contract N62645-08-A-0020, September 2008.

The Contractor shall provide the software, hardware, and professional installation services necessary for the new hardware to operate with the current Innovian Version 5 with full system functionality. If there are any changes made to the data dictionary, a new copy of the data dictionary shall be provided to the Government. This is to allow the Government to continue their ability to create customized reports. This hardware refresh will include hardware replacements for MDS-IT workstations and Servers that are currently past their end of life-cycle date, December 2016. This hardware refresh will virtualize the 3 servers that make up the Innovian System into a single physical server. New workstations and servers will operate with the most current operating systems with full system functionality and requirements that meet DHA, Navy, Army, and Air Force Information Assurance requirements. The new servers shall be Energy Star rated.

2.2. The Contractor shall provide all personnel, equipment, tools, vehicles, materials, supervision, transportation/travel and services necessary to effectively, economically, and satisfactorily provide the services described herein.

2.3. The Contractor shall provide all personnel, equipment, tools, vehicles, materials, supervision, transportation/travel and services necessary to effectively, economically, and satisfactorily provide the services described herein.

2.4. The Contractor shall provide Original Equipment Manufacturer (OEM) warranty for the proposed equipment/systems. All software licensing, warranty and service associated with the equipment/system shall be in accordance with the OEM terms and conditions.

2.5. As the Military Health System (MHS) Genesis Electronic Health Record (EHR) is deployed throughout the MHS, the ARMD will be taken out of service and these systems/sites will not be upgraded. BETA testing of the new MHS EHR is to begin in 2017 with anticipated deployment continuing through 2023. The current schedule is subject to change and may result in some MTFs not requiring refresh as initially planned.

3. DESCRIPTION OF SUPPLIES/SERVICES

3.1.

The Contractor shall provide all software, hardware, and professional installation services necessary at each Military Treatment Facility listed in Table 3.2.3 for a successful hardware/software refresh of all MHS ARMDs. During the hardware/supporting software refresh, the Contractor will coordinate and maintain a consolidated deployment schedule with Army, AF, Navy and NCR ARMD Project Managers input. To identify and resolve risks affecting upgrades, the Contractor will conduct pre-deployment project calls with MTF, and project calls with the MTF during the upgrade process. A successful upgrade will be validated by individual site Project Managers who will verify that all upgraded ARMD’s are operational and in service.

3.2.

The components of the ARMD requiring refresh include clinical workstations, a database server, application server, and an HL7 server, reflected in Table 3.2.1. Each MTF currently has one physical server for each of these components; however, this hardware upgrade will virtualize the database, application, and HL7 servers onto a single physical server. An estimated snapshot of current clinical workstations and MTF’s requiring upgrade are listed for each MTF in Table 3.2.3 below. The servers shall be Energy Star rated. The workstations do not have an energy efficiency requirement.

Table 3.2.1 Description of Current Hardware

Table 3.2.2 Example Description of Refresh Hardware

INVNAPP

INVNHL7

X3550 M5, Xeon 6C E5-2620v3… (VA Single Site Server)

Table 3.2.3 MHS Upgrade Requirements

Air Force MTFs

ARMY MTFs

Navy MTFs

NCR MTFs

3.3. The Contractor shall comply with DoD Risk Management Framework (RMF) requirements for DoD Information Systems. RMF for DoD Information Technology (IT) provides a process that integrates security and risk management activities into the system development life cycle and is applicable to all DoD controlled information systems that receive, process, store, display or transmit Department of Defense (DoD) information. IT products, services and Platform Information Technology (PIT) are not authorized for operation through the full RMF process. These types of IT must be securely configured in accordance with applicable DoD policies and security controls and undergo special assessment of their functional and security-related capabilities and deficiencies. The following RMF artifacts shall be included with your proposal; Hardware and Software listing, Architecture document, Privacy Impact Assessment (PIA) and Ports Protocol Services (PPS).

3.4. The Contractor shall comply with DoDI 8500.01, Cybersecurity and DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Systems and Special Publication 800-37, Guide for Applying the Risk Management Framework (RMF) to Federal Information Systems, National Institute of Standards and Technology.

A copy of the DoDI instructions may be obtained via these links: http://www.dtic.mil/whs/directives/corres/pdf/850001_2014.pdf and http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf A copy of SP 800-37 may be obtained at http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf

3.4.1. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect all government data, to ensure the confidentiality, integrity, and availability of government data under their control. At a minimum, this shall include provisions for personnel, electronic, and physical security.

3.4.2. The Contractor shall be required, at a minimum, to address the IA Security Controls with a Security Categorization (SC): Confidentiality: Moderate, Integrity: High Availability: Moderate based on the Health Care Delivery Services Information Type identified by DHA Administrative Instruction 077 (AI-077). DHA AI-77 can be obtained at https://info.health.mil/cos/admin/pubs/DHA%20Administrative%20Instructions%20Signed/DHAAI077.pdf#search=DHA%2DAI%2077

3.5. The Contractor shall comply with RMF requirements as specified by the DoD that meet appropriate DoD and Component specific requirements. The Contractor shall initiate the process by providing the required documentation necessary to receive an ATO. The Contractor shall make their device or system delivered against this contract available for Independent Verification and Validation (IV&V) testing. The requirements shall be met before the Contractor's system is authorized to access DoD data or interconnect with any DoD network that receives, processes, stores, displays or transmits DoD data. An ATO, at a minimum, will be required before a device or system is installed. The Contractor shall ensure that the proper Contractor support staff is available to participate in all phases of the RMF process. They include but are not limited to;

· Completing and maintaining all documentation necessary to obtain an ATO and/or additional documentation needed to obtain and maintain an Approval to Connect (ATC).

· Attending and supporting RMF and cybersecurity meetings with the IV&V representatives

· Supporting/conducting the vulnerability mitigation process to comply with security controls listed in NIST SP 800-53. A copy of this publication may be obtained via this link: http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf.

· Supporting the IV&V Team during system security testing

· Contractors must confirm that their systems are locked down prior to initiating IV&V testing

· Contractors must support continuous monitoring by proactively, monitoring, testing and releasing OS and application (i.e. Adobe) patches and notify the Government within 30 calendar days of the patch being released of the status if the patch can or cannot be installed, and anticipated dates for when they will be approved. If the patch cannot be installed, the Contractor shall provide sufficient justification for not installing the patch and will provide compensating controls.

· All Contractor validated and approved patches up to and including the date of install must be loaded on the system prior to going live. All patching of the system after go live will be the responsibility of the site, in coordination with the Contractor.

3.6. The Contractor shall complete an annual cybersecurity review that comprehensively evaluates existing policies and processes to ensure procedural consistency and that the IS continues to operate in the manner to which it was accredited. The annual review process should account for the analysis of projected policy needs, and produce a plan for development or implementation of new policies or processes.

3.7. The Contractor shall comply with DoDD 5400.11-R, “DoD Privacy Program”, DoD 8580.02-R, DoD Health Information Security Regulation and DoD 5200.2, “DoD Personnel Security Program (PSP)”. The Contractor shall ensure that personnel accessing information systems have the proper and current information assurance certification to perform information assurance functions IAW DoD 8570.01-M, “Information Assurance Workforce Improvement Program”. Contractor responsibilities for ensuring personnel security include, but are not limited to following the Privacy Office guidelines for submittal of IT security clearances and ensure all Contractor personnel are designated as IT-I, IT-II or IT-III where their duties meet the criteria of the position sensitivity designations. Copies of the policies mentioned in this paragraph may be obtained via the following links: http://www.dtic.mil/whs/directives/corres/pdf/540011r.pdf, http://www.dtic.mil/whs/directives/corres/pdf/858002_2015_dodi.pdf, http://www.cac.mil/docs/52000.2R.pdf, and http://www.dtic.mil/whs/directives/corres/pdf/857001m.pdf.

3.8. Prior to accessing DoD networks, personnel security requirements shall be followed to ensure appropriate precautions are taken prior to allowing Contractor personnel access to the network. Any Contractor personnel that will be accessing the medical device/system while installed on the hospital network will be required to have a National Agency Check (NAC) completed. Typically, this requires an investigation to support a “Public Trust Position” and requires the person(s) to complete and submit a Standard Form 85P (SF85P), Questionnaire for Public Trust Positions, via the Electronic Personnel Security Questionnaire (EPSQ). Questions relating to SF85Ps and the EPSQ process may be directed to 1-888-282-7682 or online at http://www.dss.mil/ Contractor personnel accessing equipment connected to the hospital network will be required to complete a System Authorization Access Request (SAAR) or System Authorization Access Request Navy (SAAR-N) (form OPNAV 5239/14) depending on individual Service requirements. Copies of the SAAR form may be obtained at http://www.dtic.mil/whs/directives/forms/eforms/dd2875.pdf and the SAAR-N form may be obtained from https://navalforms.documentservices.dla.mil/formsDir/_OPNAV_5239_14_7631.pdf. Additionally, contractor personnel are required to complete the annual DoD Cyber Awareness training requirements.

3.8.1. The Contractor shall initiate, maintain and document personnel security investigations appropriate to the individual’s responsibilities and required access to Sensitive Information (SI).

3.8.2. The Contractor shall immediately report to the appropriate DoD POC and deny access to any automated information system (AIS), network, or information if a Contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate DoD representative for security reasons.

3.8.3. Access to the medical devices will be limited to authorized users as determined by local policy. Contractors whose systems do not yet meet the requirement for CAC authentication must indicate their willingness to do so, description of authentication method that will used until requirement has been met, offer a timeline for compliance and complete an Authentication Security Plan (ASP) to achieve PKI Compliance.

3.9. To ensure that medical systems attain data confidentiality, integrity, and availability levels consistent with best industry practices, the use of current Operating Systems (OS) is highly recommended. Medical systems will employ whenever possible, operating systems that are fully supported by the manufacturer and are commercially available.

3.10. Since the ARMD will be integrated into a Microsoft Active Directory Domain, Contractor shall allow for the use of Domain ADMIN accounts with administrative/root level privileges for purposes of conducting system repairs and maintenance. This account shall be separate and distinct from the built-in local administrative/root account provided by the Operating System and shall comply with DoD policy. All factors required to complete successful identification, authentication and authorization against the systems domain will be required. Complete administrative system rights shall be provided to the government System Administrator’s Domain ADMIN account for the purpose of conducting device vulnerability scans as needed.

3.11. Medical systems that make use of a file system under direct control of an operating system instance whether physical and/or virtual shall provide the appropriate anti-malware safeguards consistent with current security practices. Exemption from this requirement is applicable to medical systems which make use of a proprietary file system and/or operating system for which no commercially available antimalware application exists. Systems shall be configured as to allow for the update of malware definition signatures on a scheduled basis. Scanning shall encompass the entire system (filesystem, operating system, realtime processes), by default. In cases where the scanning of the entire system may negatively affect the operation of the system, the Contractor shall provide a detailed list of exclusions with justifications.

3.12. All Contractor systems that will communicate with DoD systems will interconnect through the established Military Health System (MHS) Business to Business (B2B) gateway. For all Web applications, the Contractor shall connect to the DISA-established Web DMZ. The Contractor shall connect to the B2B gateway via a Contractor procured Internet Service Provider (ISP) connection and assume all responsibilities for establishing and maintaining their connectivity to the B2B gateway. This will include acquiring and maintaining the circuit to the B2B gateway and acquiring a FIPS-140-2 Virtual Private Network (VPN)/Firewall device compatible with the MHS VPN device. Maintenance and repair of Contractor procured VPN equipment shall be the responsibility of the Contractor. The Contractor shall configure their network to support access to government systems (e.g., configure ports and protocols for access). The Contractor shall provide full time connections to a TIER1 or TIER2 ISP. Dial-up ISP connections are not acceptable. Requirements of Paragraph 3.8. must be followed to access DoD networks.

3.13. The hardware/supporting software upgrade shall be Internet Protocol version 6 (IPv6) capable or the Contractor must provide a detailed project, migration or planning documentation to show when the proposed system shall be IPv6 capable.

Minimum IPv6 capabilities include:

· Conformant with the IPv6 standards profile contained in the DoD IT Standards Registry (DISR);

· Maintaining interoperability in heterogeneous environments with IPv4;

· Commitment to upgrade as the IPv6 standard evolves;

· Availability of Contractor IPv6 technical support.

The Contractor must be able to demonstrate or provide documentation to prove that their product is IPv6 capable. As described in the DISR IPv6 standards profile, application Contractors are expected to scan and test their code for IPv6 compliance and…