N62645-19-R-0046.docx

N6264519R0046

Section SF 1449 - CONTINUATION SHEET

GENERAL CONTRACT INFORMATION

CONTRACTING OFFICER’S REPRESENTATIVE

The Contracting Officer’s duly authorized representative will perform inspection and acceptance of servcies to be provided.

For the purpose of this clause, Richard Fulmer, 301-619-4099, email: richard.b.fulmer.civ@mail.mil is the authorized representative of the Contracting Officer.

Inspection and acceptance will be performed at the assigned location according to the Performance Work Statement.

START-UP PERIOD

It is intended to make award of the resultant contract in time to allow up to a thirty (30) day start-up period in advance of the actual commencement of the performance period. The contractor shall make all necessary preperations, during this start-up period, to assume full responsibility for contract performance as of the contract start date. It is noted that invoicing by the contractor will begin as of the commencement of services and no reimbursement will be paid by the Government for efforts expended during the start-up period.

CONTRACTOR SUPPORT

Notice: Navy Use Of Support Contractor For Contract Closeout Functions

Naval Medical Logistics Command (NMLC) uses two private contractors in support of the contract closeout process. Those companies are Contracting Resources Group (CRG) of Federal Hill, MD, doing business under the authority of the Small Business Administration’s 8(a) program and the Ability One Program, doing business under the authority of the Javits-Wagner O’Day Act (41 U.S.C. § 47).

The contract closeout process includes activities such as processing deobligation modifications, obtaining contractor and requiring activity concurrence, preparing the DD-Form 1594 (Contract Completion Statement), and preparing closed files for archiving. Support contractors may perform additional administrative duties, including filing and processing simple administrative modifications. Performing these functions require the contractor employees to have access to the contract file. Therefore, information the Contractor provides to the Government or information already in the possession of the Government may be viewed by these support contractors in the course of performing contract close-out functions. The information that may be made available to the contractor may include pricing and technical responses and performance information.

NMLC has signed Non-Disclosure Agreements with each support contractor employee and has required both contractors to provide a Conflict of interest Mitigation Plan to ensure these employees are firewalled from all business development activity.

By signature of this contract, the quoter consents to access of their business sensitive/confidential or proprietary data by the Government’s support contractor personnel in order to perform close out services.

ADDENDUM TO 52.212-1

INSTRUCTIONS FOR SUBMITTING A PROPOSAL:

a) Electronic Files. The proposal shall be submitted via email to the following addresses: nicholas.j.carroll15.civ@mail.mil and derek.m.marriott.civ@mail.mil.

b) Electronic files shall not contain classified data. Each proposal volume described below shall be prepared as a separate, single file clearly marked with the volume title. Do not use compressed file formats. Submissions shall be virus free.

c) Utilize the “Proposal Table of Contents” below to organize the electronic proposal files.

PROPOSAL TABLE OF CONTENTS

1. SF 1449/SF 30

NOTE: Page 1 of the SF 1449 and all Amendments (SF 30) must be signed by an authorized representative which indicates agreement of a 210-day acceptance period.

2. Contract Administrative Data

3. Representation and Certifications

4. MTF Monitoring Process

5. Software License Terms

1 PDF file containing Volume I, Administrative/Business

1. Subcontracting Plan

1 PDF file containing the Volume II, Small Business Subcontracting Plan

1. Pricing Workbook

2. Breakdown to support proposed overall pricing Excel Workbook(s) containing Volume III, Pricing

1. CONTENT REQUIREMENTS.

3. PROPOSAL SHALL BE PREPARED AND SUBMITTED AS FOLLOWS:

3.1. VOLUME I: ADMINISTRATIVE/BUSINESS – (1 PDF file).

3.1.1. Solicitation/Contract/Order For Commercial Items (SF 1449) and Amendments (SF 30). Page 1 SF 1449 with signature of a corporate officer authorized to negotiate for the company in Block 30a, acknowledgement of all amendments, (SF 30) with signature in Block 15B, and agreement of 210 days acceptance period.

3.1.2. Contract Administration Data. Provide points of contact (POCs) for administration of any resulting contract. These POCs shall be available during normal business hours and other than normal business hours. The POC for other than normal business hours will be contacted only in the event of emergencies. Accordingly, the named individual(s) should possess sufficient corporate authority to effectively deal with emergency situations. The telephone number(s) provided should be functional at all times. If there are different POCs for different conditions, such as weekdays, weekends, holidays, etc, please furnish all and explain as follows:

3.1.3. Representations And Certifications.

3.1.3.1. Ensure your representations and certifications are updated at the System for Award Management (SAM) https://www.sam.gov/portal/public/SAM.

3.1.3.2. Include one completed copy of the following, as applicable (if completed via SAM, including completed copies is not necessary):

3.1.4. MTF Monitoring Process. The current MTF monitoring process is provided as PWS Enclsoure 1. Review the current plan and submit a new plan to provide proactive monitoring of system performance. The offeror shall be responsible for determing the appropriate timeframe for monitoring. The proposed plan, if accepted, will be incorporated into the resultant contract and will replace the current MTF monitoring process.

3.1.5. Software License Terms. For all software furnished under this contract, the offeror shall provide a copy of the software licensing agreeement or any terms and conditions that apply to the software.

3.2. VOLUME II: SMALL BUSINESS SUBCONTRACTING PLAN – (1 PDF file).

3.2.1. Submission of a small business subcontracting plan is required. The subcontracting plan shall be in accordance with FAR Clause 52.219-9 and DFARS Clause 252.219-7003, including alternates and deviations (for reference see FAR 19.704 and DFARS 219-704).

3.2.1.1. The Department of Defense (DOD) has established small business goals as an assistance to assure small business receives a fair proportion of DOD awards. The small business subcontracting goal for this requirement is 5% of the total contract value.

3.2.1.2. The Government recognizes that these goals are stated as a percentage of the total contract value for the small business participation plan; whereas, the goals included in the subcontracting plan (FAR Clause 52.219-9) are stated in terms of a percentage of total subcontract dollars.

3.3. VOLUME II: PRICE – (Excel Workbook(s))

3.3.1. Pricing shall be submitted using the attached Excel workbook titled “Pricing Workbook,” see attached for a copy of the workbook along with instructions for its completion.

3.3.2. Provide a breakdown to support the overall proposed total price. This can be provided in a separate Excel workbook or by adding a tab(s) to the “Pricing Workbook.”

3.3.3. Pricing should reflect all MTFs starting the contract under scenario A. The pricing workbook is not built to account for escalation in pricing throughout the course of the Option Periods.

3.3.4. To determine overall pricing, only scenario A will be utilized up to the MHS Genesis go-live date, at which point sustainment pricing will be ceased for the reaminder of the contract. The go-live date is prescribed in the Pricing Workbook, “Base + 4 Options Pricing” tab, column B.

(End of addendum)

PERFORMANCE WORK STATEMENT

Anesthesia Recording and Monitoring Devices (ARMD) Medical Equipment Hardware and Software Maintenance

1. DEFINITIONS

ARMD. Abbreviation of “Anesthesia Recording and Monitoring Devices” for the purposes of this contract, the ARMD is inclusive of all hardware, firmware and software (to include non-clinical Contractor software installed on MTF workstations).

ATC. Acronym of Authorization to Connect

ATO. Acronym of Authorization to Operate

Clinically Interfaced Workstation. Each individual PC workstation located at the MTF in which the Contractor’s software interfaces with clinical devices for automatic data capture at the bedside and as described in Paragraph 3.2.

Commercial Hardware. Third-party commercial hardware other than the Contractor’s hardware, including but not limited to PC workstations, servers, wireless networking equipment, and mounting hardware, as described in Paragraph 3.2.

Component. Contractor provided devices: servers and the software they serve out, all storage and archive devices, workstations (diagnostic, review and quality control), hard copy devices, the network and other network peripherals (if provided and installed by the Contractor), Contractor provided ARMD interfaces to Government furnished devices and systems (e.g., HL7).

Component Failure. Any component malfunction which renders the component unable to perform its intended function and requires corrective maintenance, alignment, calibration, or replacement. Any component which is comprised of subcomponents (e.g., workstation comprised of monitors, CPU, keyboard, etc.) shall be treated as a single entity. Therefore, failure of any subcomponent (e.g., a monitor) shall constitute failure of the component (e.g., the workstation).

COR. Acronym of “Contracting Officer’s Representative”

Core System. Subset of the System that includes the following components: servers, workstations and the software they serve out (including Web servers), all intermediate storage and long-term archive devices, network switches (if vendor provided).

Core System Failure. Any emergency situation in which any one or multiple components comprising the core system requires immediate corrective maintenance. Such a failure may be brought on by failure of a single or multiple core system components such that system performance parameters defined herein are not being met.

CPU. Acronym of “Central Processing Unit”

CPT. Acronym of “Current Procedural Terminology” Documentation. The Operator's User Manual(s) and related materials provided by DMI.

DHA. Acronym of “Defense Health Agency”

DoD. Acronym of “Department of Defense”

DCS. Abbreviation of Defense Collaboration Services. DCS provides secure web conferencing and instant messaging services on the Non-secure Internet Protocol Router Network (NIPRNet) and Secure Internet Protocol Routing Network (SIPRNet), and is accessible via the Internet. This open source real time collaboration service is available to over four million DOD personnel and mission partners and routinely serves 46 thousand web conference users weekly and 16 thousand concurrent chat users daily. DCS resides on milCloud, a datacenter virtualized hosting environment, and supports Common Access Card (CAC) and select hard token holders and guest (DOD mission partners) users, that securely connects and provides Commercial partners access to DoD systems and networks.

FAQ. Acronym of “Frequently Asked Questions”

FQDN Abbreviation of “Fully Qualified Domain Name”

HL7. Acronym of “Health Level 7” standard

IA. Acronym of Information Assurance

IAVA. Acronym of Information Assurance Vulnerability Alerts

Information Assurance. Measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation.

JTR. Abbreviation of “Joint Travel Regulations”

Licensed Software. The Contractor’s Medical Incorporated Software and Interface Software.

MedCOI. Abbreviation of Medical Community of Interest network. The DHA is currently in process of deploying the MedCOI network across all Military Health System facilities. All Military Health System devices and systems must be migrated to the MedCOI network as it deploys to a given MTF.

MTF. Acronym of “Military Treatment Facilities”

New Versions/Modules. Any new software product(s), releases or new modules offered by the Contractor for which the Contractor customarily charges a fee to its customers. New Versions/Modules are not included in the definitions of updates hereunder and are not included in this contract.

Normal Working Hours. The MTFs are normally open for service Monday through Friday between the hours of 7 AM and 5 PM, excluding host national and federally observed holidays. Since the MTFs are located globally, normal working hours apply to the local time zone.

PC. Acronym of “Personal Computer.”

PPS. Acronym of “Ports, Protocols, and Services”

POC. Acronym of “Point Of Contact”

Proper Working Order. Operating within Original Equipment Manufacturers (OEM) specifications as designed, produced, delivered and accepted.

Response Time. The timeframe between when the Government POC places the service call (via telephone or email) to the Contractor help desk and the time when the Contractor responds to the call/email.

RMF. Acronym of “Risk Management Framework”

S3. Abreviation of “Surgical Scheduling System”

Software. All clinical information systems software developed by the vendor and delivered to Government in association with the operation of the ARMD Innovian system including any Software Updates for the foregoing, other than the Interface Software.

System. System shall be defined as the integrated network of all Contractor provided ARMD components.

TO. Acronym of “Task Order”

Updates. Updates are software patches, registry modifications, local security policy modifications or any other mechanisms of change to the “system” released by the OEM to address specific deficiencies, vulnerabilities, or to activate specific functionalities.

2. SCOPE

2.1. The Government has a requirement for maintenance and sustainment services for the ARMD medical equipment hardware and software installed and deployed worldwide as a result of the ARMD tri-service initiative. The anesthetic record plays an important role in patient safety and provides important information used for quality assurance initiatives. To enhance the rapid and legible gathering of highly detailed and accurate anesthetic records, ARMD electronically records and documents patient physiologic parameters, medications delivered, important demographics including allergies, patient height and weight, and anesthesia provider actions at the point of care in real time. In addition, this capability along with an overview of total operating room activity provides a remarkable resource for management and leadership authority in optimizing operative services.

2.2. The Contractor shall provide all personnel, equipment, tools, vehicles, materials, supervision, transportation/travel and services necessary to effectively, economically, and satisfactorily provide the services described herein. Service events will include preventive maintenance, as defined in Enclosure 1, corrective maintenance, migration of the ARMD from one domain/network to another (Service networks to MedCOI network) and emergency maintenance activities necessary to keep the ARMD in good (proper) working order. For the purposes of this contract, the ARMD is inclusive of all hardware, firmware and software (to include non-clinical software installed on MTF workstations). Services are required worldwide at the locations specified in Enclosure 2 -Table 2: Miltary Treatment Facility (MTF) Listing; however, any DoD facility is considered within the scope of this contract.

2.3. Throughout the contract period, locations and hardware may be added or removed, as hardware and software eclipse useful life, as hardware refreshes are completed, as new equipment comes off of warranty, and as MHS Genesis is deployed at each MTF. The Contractor will be notified of changes as soon as possible. Once a location or hardware is added or removed, the contract will be modified and the unit prices will be adjusted accordingly, utilizing Exhibit A – Detailed Pricing Workbook. These modifications are anticipated to occur on a quarterly basis in order to align with the MHS Genesis deployment schedule, but can occur at any time throughout the life of the contract. To remain within scope of the contract, the added location(s) or hardware shall represent not more than 20% of the total contract price.

3. DESCRIPTION OF SERVICES

3.1. The Contractor shall provide maintenance and support coverage for the modules and components of the ARMD. The Contractor shall cause the Licensed Software to operate in all material respects in conformity with the Documentation under normal use during the contract performance period. The Contractor shall provide updates in addition to help desk support. When updates to hardware or software are required, the Contractor shall coordinate with DoD and Service/National Capital Region (NCR) program managers for distribution of updates and provide any remote support required by the MTF to complete the installation.

3.1.1 The contractor shall provide installation services for all modules and components of the ARMD necessary at each Military Treatment Facility as the DoD moves ARMD off of existing domains and networks and onto the new DHA Domain and network (MedCOI). The contractor will provide help desk support along with on-site support personnel if needed when notified of these migrations. Contractor will participate in pre/post migration conference calls with DHA and the site. Contractor migration activities may include but are not limited to, assisting sites with change of network IP address space, active directory object renaming, unjoining and rejoining of computer objects to the domain, B2B modifications, PPS documentation. Post migration the contractor shall perform full functional testing, to include but not limited to, report website functionality, S3 HL7 message operation and functionality testing on clinical and non-clinical workstations.

3.2. The modules and components of the ARMD are defined below:

Host Server

· Intel Xeon Bronze 3104 CPU x 2

· 48 GB RAM

· 2.4TB HHD x 5

· 300GB HHD x 3

Virtual Application Server

· 8GB RAM (Dynamic)

Virtual Database Server

· 24GB RAM (Dynamic)

Virtual HL7 Server

· 8GB RAM (Dynamic)

Clinical Workstation (CWS) Specification

· Intel Core I7-6600U CPU

· 8GB RAM

· 128GB SSD

· RS232 COM Ports x 3

3.3. All Software Updates and Versions/Modules added to the ARMD throughout the contract performance period shall be governed by the appropriate software license terms. In particular, the Contractor shall update annually Current Procedural Terminology (CPT) codes provided by the Government.

3.3.1. The Contractor shall be responsible for on-going testing of Operating System (OS) and application software patches for stability within the ARMD environment. A list of tested and acceptable patches and any applicable notes, directions or comments for the user shall be posted to the Contractor’s website (see Paragraph 3.3.2. below) by the fifth (5th) calendar day each month. The Contractor will also email notifications to service PM’s by the 5th of the month. If any of the listed OS and application software patches causes the system to become inoperable, the Contractor shall correct the deficiency consistent with the language stated in Paragraph 3.13.

3.3.1.1. If an OS or application software patch cannot be approved, the Contractor shall be responsible for modifying the ARMD, if necessary, to meet IA requirements, as defined in DoDI 8500.01 and DoDI 8510.01, links to both are provided below, in a future scheduled software release version of ARMD and provide information for update of the POA&M

3.3.2. The Contractor shall assist the Government in preparing documentation and developing mitigation plans to address identified annual IA review issues and meeting all DoD IA requirements. There may be instances where the Government will require IA review more often if vulnerabilities are identified by the Services. In addition, the Contractor shall assist in the implementation of the software resolutions to include performing updates to the RMF documentation.

3.4. To maintain continuity, the Contractor shall ensure all ARMDs are using the same version of software and employ software configuration management principles. The Government will allow a reasonable amount of time, via a mutually agreed upon schedule, for the Contractor to retrofit any changes to the software to maintain consistent versions of the software. Any change or update of software shall include migration of existing data from the previous software version to the updated software version.

3.5. The Contractor shall provide a technical support staff which is available to answer questions regarding the operation and/or use of the Licensed Software by telephone without additional charge to the Government. The Contractor will provide remote technical and on-site support with response times in accordance with paragraph 3.13.

3.6. The Contractor shall maintain records regarding all maintenance support provided by its personnel on the ARMD. The Contractor shall make this information electronically available to the Government, as requested, and agrees to treat the information on all such records as confidential.

3.7. The Contractor shall ensure maintenance spares and spare parts for the ARMD can be obtained within twenty-four (24) hours of any reported failures and shipped to the effected MTF.

3.8. With respect to the Commercial Hardware listed in Paragraph 3.2., the Contractor shall provide appropriately qualified and experienced service personnel for service or repair work on such hardware and software. The Contractor shall supply replacement or additional parts, accessories or equipment, if required in connection with such services or work. Refurbished parts may be used. These parts shall comply fully with the performance and reliability standards of new parts and carry the same warranty as new parts. The Contractor shall not alter the covered Hardware that (i) would violate a safety standard mandated by law or government regulation, or mandated or recommended by any applicable industry code, or (ii) would not accord with the installation requirements and directives of the manufacturer. The Government will conduct user level preventive maintenance and testing of the covered hardware as required by the manufacturer or as is common industry practice before each use to ensure the covered hardware is operating properly. The Government shall perform routine maintenance and cleaning of the covered hardware on a regular basis as suggested by the manufacturer’s service manual.

3.9. Reserved.

3.10. Maintenance Service Support. The size and complexity of the site shall dictate the level of service support required. The Contractor shall utilize personnel who are fully qualified and knowledgeable on the maintenance of the ARMD to provide maintenance services on the ARMD.

3.11. Scheduled Maintenance

3.11.1. The Contractor shall submit a maintenance plan as a deliverable to the COR within thirty (30) calendar days after award.

3.11.1.1. Maintenance plan shall include at least the following information: scheduled calibration and preventive maintenance program details, as defined in Enclosure 1, repair maintenance program details, archive system maintenance program details, application maintenance plan details, database maintenance plan details, HL7 maintenance plan details, repair parts program details, technical support resources description, facilities requirements for maintenance, training, and maintenance program support. The scheduled maintenance plan must include maintenance requirements applicable to each MTF that has accepted the ARMD.

3.11.2. Scheduled maintenance shall include execution of the maintenance plan as addressed in Paragraph 3.11.1.1.

3.11.3. To the maximum extent possible, scheduled maintenance shall be performed on individual components of the system so as not to affect the operation of the entire system.

3.11.4. The Contractor shall perform any scheduled services which will result in system downtime at times outside of the normal working hours (see definition). The Contractor shall perform all other scheduled services which will NOT result in system downtime at times convenient to the Government. All services shall be coordinated with the MTF representative.

3.12. Corrective Maintenance

3.12.1. The Contractor shall provide on-site hardware, firmware and software corrective maintenance service for all component and system failures, to include software problem analysis, associated reprogramming and corrected software documentation.

3.12.2. The Contractor shall affect repairs in the most expedient manner with minimum interruption to the operation of the system.

3.12.3. An emergency corrective maintenance call is defined as a failure of a component when no back up is available, or a failure of the system that prevents the site from accomplishing its normal workload with the remainder of the system. Placement of such an emergency corrective maintenance call marks commencement of downtime and response time measurement.

3.12.3.1. Once the Contractor service representative arrives on site to fulfill an emergency corrective maintenance action on a core system component(s), for all calls placed during normal working hours, the service representative shall remain on site, at no additional charge to the Government, until all repairs are completed, all integrated system performance parameters are met, and the system is available for clinical use.

3.12.3.2. For corrective maintenance action calls placed outside normal working hours, the service representative shall remain on site until all repairs are completed, all integrated system performance parameters are met, and the system is available for clinical use.

3.12.4. All other corrective maintenance calls that do not meet the requirements of the “emergency” call shall be defined as “routine” corrective maintenance calls.

3.13. Response Time

3.13.1. The Contractor shall be available twenty-four (24) hours a day every day of the year to respond to the Government’s issues. The Contractor shall be cognizant of the varying time zones around the world where the ARMD is being used. The contract employee(s) responding to the Government’s call must be competently skilled to provide at least Tier 1 service, as defined in Paragraph 3.13.2.1.

3.13.2. The Government’s definition for the level of Contractor support is defined below:

3.13.2.1. Tier I: Help desk services provided within four (4) hours of notification by the customer, whether by phone or email to their Help Desk group mailbox.

3.13.2.2. Tier II: System Engineer support via remote connection. This is the primary level of support for any issue identified with a Severity Level of III, IV or V. Refer to definitions below.

3.13.2.3. Tier III: The Contractor shall provide on-site support for any identified issue that cannot be resolved at the Tier I or Tier II after four (4) hours of being contacted. Tier III support shall be the primary level of support for any issues identified with a Severity Level of I or II. Refer to definitions below.

3.13.3. For the purposes of this contract, the definition for each Severity Level is defined below:

3.13.3.1. Catastrophic (Severity Level I): Any failure within an active surgery; any failure which results in the population of an incorrect patient identifier; any failure which results in an immediate threat to patient health; or 50% or more of workstations affected.

3.13.3.2. Severe (Severity Level II): Any failure which prevents performance of surgery planned within twenty-four (24) hours; any failure which results in the potential threat to patient health, any failure which results in the potential population of an incorrect patient identifier; or 25-50% of workstations affected.

3.13.3.3. Major (Severity Level III): No effect on patient health, but potential to affect surgery planned more than twenty four (24) hours later.

3.13.3.4. Minor (Severity Level IV): no potential effect on planned surgery.

3.13.3.5. Cosmetic (Severity Level V): changes to the appearance of the ARMD.

3.14. The Contractor shall ensure the hardware and software for every ARMD in the MTF is in proper working order 99% of the time which equates to 361 days of the year (362 days during leap year). The remaining four (4) days of the year are allocated for scheduled and unscheduled downtime at each MTF. Refer to Paragraph 1 for the definition of proper working order and refer to Paragraph 4 for the performance measures.

3.15. Exclusions/Limitations. The Contractor shall not be held liable for the items listed below:

3.15.1. Maintenance Service for Commercial Hardware not listed in Paragraph 3.2., or Third-Party Products the Government chooses to use in conjunction with the ARMD.

3.15.2. Maintenance Service for any New Versions/Modules that have not been licensed under a primary Contractor’s license.

3.15.3. Repairs for any of the following:

3.15.3.1. The Government's failure to properly procure, configure, maintain, and install any Commercial Hardware not identified in Paragraph 3.2. and used in conjunction with the ARMD.

3.15.3.2. Damages caused by computer viruses unless caused by a failure on the part of the Contractor to mitigate identified information assurance vulnerabilities with a known patch.

3.15.3.3. Failure of electrical power, power surge, temperature, humidity, neglect, or any failure of the facilities to meet the Contractor’s specifications.

3.15.3.4. Reserved

3.15.3.5. The Government's modification of the ARMD without the Contractor’s written consent.

3.15.3.6. Failure to provide reasonable and timely access to the Government's system or unreasonably or materially impeding access to the Government's system.

3.15.3.7. Use of any supplies, parts or equipment not meeting the manufacturer’s specifications.

3.15.3.8. Operator, user error or Government maintainer, including but not limited to, any corruption of the database data whether occurring during routine use, upgrading or maintenance service. The Contractor shall demonstrate the Government caused the error discussed in this paragraph.

3.15.3.9. The Government’s failure to implement reasonable and adequate disaster recovery procedures including, but not limited to, backups and validation performed on a periodic basis and those required prior to any update, maintenance or database conversion.

3.16. The Contractor shall not use third-party tools without an IA approval of the appropriate Service. A third-party tool is defined as any type of software that has not been approved by the Government (e.g., Google Chrome).

3.17. Under no circumstances shall the Contractor remove permanent media storage device (i.e. hard-drive) from the government facility. Such permanent media storage devices may contain Protected Health Information (PHI) and or Personally Identifiable Information (PII). The Contractor shall not remove such devices whether it is the permanent media storage device itself or an ARMD component that contains a permanent media storage device during maintenance and support of the ARMD system under this contract.

3.18. Remote Diagnostics

3.18.1. The Contractor shall possess the ability to provide system connectivity, diagnostic software and technical support services which utilize remote diagnostics for troubleshooting, repairing, and configuring the ARMD.

3.18.2. Remote capabilities shall be able to reach all central system components in the ARMD (i.e. servers and the software they serve, archive controller, archive devices, network infrastructure, network managed workstations) through a common (single) telecommunications access line.

3.18.3. Tele-maintenance methods shall also include the use of telephonic contact with Government site support staff and users.

3.18.4 All Remote diagnostics shall be conducted in accordance with the most current Defense Information Systems Agency (DISA) and Defense Health Agency (DHA) Gateway requirements for Business to Business (B2B) connections. A secure web conferencing tool such as Defense Collaboration Services (DCS) can be used for remote support in the event B2B is not operational at the MTF and the MTF authorizes its use.

3.18.4.1. All Contractor systems that will communicate with DoD systems will interconnect through the established Military Health System (MHS) Business to Business (B2B) gateway. For all Web applications, the Contractor shall connect to the DISA-established Web DMZ. The Contractor shall connect to the B2B gateway via a Contractor procured Internet Service Provider (ISP) connection and assume all responsibilities for establishing and maintaining their connectivity to the B2B gateway. This will include acquiring and maintaining the circuit to the B2B gateway and acquiring a FIPS-140-2 Virtual Private Network (VPN)/Firewall device compatible with the MHS VPN device. Maintenance and repair of Contractor procured VPN equipment shall be the responsibility of the Contractor. The Contractor shall configure their network to support access to government systems (e.g., configure ports and protocols for access). The Contractor shall provide full time connections to a TIER1 or TIER2 ISP. Dial-up ISP connections are not acceptable. Requirements of Paragraph 3.8. must be followed to access DoD networks.

3.18.4.2. Contractor personnel accessing DoD Systems through the DISA or DHA B2B Gateway must comply with DoD 8570.01-M, Information Assurance Workforce Improvement Program requirements for Information Assurance Technical (IAT) Level II. A copy of this directive can be obtained via the following link: http://www.dtic.mil/whs/directives/corres/pdf/857001m.pdf. Compliance requires possession and maintenance of one of the following certifications: Cisco Certified Network Associate (CCNA) Security, Global Industrial Cyber Security Professional (GICSP), Global Information Assurance Certification (GIAC), Security Essential Certification (GSEC), Computing Technology Industry Association (CompTIA) Security plus Continuing Education (CE), or Systems Security Certified Practitioner (SSCP).

3.19. Risk Management Framework (RMF) continuous monitoring of existing ARMD Systems (Draeger Innovian)

3.19.1. The Contractor shall comply with DoDI 8500.01, Cybersecurity, DoDI 8510.01, Risk Management Framework (RMF) for DoD Information Systems, and Special Publication (SP) 800-37, Guide for Applying the Risk Management Framework (RMF) to Federal Information Systems, National Institute of Standards and Technology. A copy of the DoDI instructions may be obtained via these links: http://www.dtic.mil/whs/directives/corres/pdf/850001_2014.pdf and http://www.dtic.mil/whs/directives/corres/pdf/851001_2014.pdf. A copy of SP 800-37 may be obtained at http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r1.pdf

3.19.2. The Contractor shall provide results from vulnerability scans using Nessus (in .nessus format) as required.

3.19.3 The Contractor shall support monthly Nessus scans as part of a Continuous Monitoring Strategy.

3.19.4. The Contractor shall remediate or mitigate vulnerabilities discovered during monthly Nessus Scans and provide supporting documentation showing the vulnerability is remediated or mitigated.

3.19.5. The Contractor shall obtain maintain an Authority to Operate (ATO) and an Authority to Connect (ATC) in accordance with DoD policy.

3.20. Reports

3.20.1. Monthly Reports. The Contractor shall provide a monthly report for all trouble tickets to the COR by the fifth (5th) calendar day each month. The report shall be meaningful and informative, and include the raw data supporting the report in an Excel spreadsheet. The report shall include at least information about open tickets, closed tickets, and outstanding tickets. The information provided regarding the tickets should be in narrative form and not reported as a number or percentage. The information in this report shall be sufficient for the Government to fully understand the issues reported by the MTFs and the Contractor’s actions. An analysis of the data is required and shall include any trends or patterns as well as proposed reasonable solutions.

3.21. Service Reports

3.21.1. All reports of service (scheduled and corrective maintenance) shall be documented and validated by the MTF representative, and a copy provided to the COR and Service Project Manager (PM).

3.21.2. The Contractor shall maintain a consolidated Microsoft (MS) Excel spreadsheet depicting all of the services rendered under this contract. At a minimum, the spreadsheet record shall include: (a) date and time notified, (b) date and time of arrival onsite, (c) description of malfunction or service to be performed, (d) model number/serial number and location of the equipment, (e) time spent to repair, (f) parts used/replaced, and (g) parts cost, (h) description of service performed, (i) name of government POC, (j) name of Contractor service engineer, (k) tele-maintenance methods used, if any, (l) designation of user error if appropriate. Additional information may be required by each Service. A copy of this spreadsheet shall be provided to the COR by the fifth (5th) calendar day each month. The Contractor shall also provide service reports to the Contracting Officer upon request.

3.21.3. The Contractor shall maintain historical service records on each component of the system which shall be provided electronically to the Government upon request.

4. QUALITY ASSURANCE SURVEILLANCE PLAN (QASP)

4.1. This QASP serves as the principal basis for assessing the overall quality of the Contractor’s performance. It provides the methodology by which the Contractor's performance will be monitored to determine compliance with required performance objectives and to determine if acceptable quality levels have been met. The plan is designed so that surveillance is limited to that which is necessary to verify that the Contractor is performing at an acceptable level.

4.2. Table 1: Performance Requirements Summary:

Comprehensiveness

Comprehensiveness

4.3. If performance is within acceptable levels, it will be considered to be satisfactory. If not, overall performance may be considered unsatisfactory.

4.4. The COR provides an annual report on Contractor Performance (CPARS or other annual report). The Contractor’s failure to achieve satisfactory performance under the contract/task order, reflected in the COR’s annual report, may result in termination of the contract/task order and may also result in the loss of future Government contracts/task orders. The Contractor’s failure to achieve satisfactory performance under the contract/task order may result in the non-exercise of available options.

4.5. For each item that does not meet acceptable levels, the Government may issue a Contract Discrepancy Report (CDR). CDRs will be forwarded to the Contracting Officer with a copy sent to the Contractor. The Contractor must reply in writing within five (5) calendar days of receipt identifying how future occurrences of the problem will be prevented. Based upon the Contractor’s past performance and plan to solve the problem, the Contracting Officer will determine if any further action will be taken.

4.6. In accordance with contract clause FAR 52.212-4, the Contractor will be incentivized to provide quality products in a timely manner since the Government can require the Contractor, at no additional cost, to replace or correct work that fails to meet contract requirement.

5. ENTERPRISE-WIDE CONTRACTOR MANPOWER REPORTING APPLICATION (ECMRA)

5.1. The Contractor shall report ALL contractor labor hours (including subcontractor labor hours) required for performance of services provided under this Contract for the Navy via a secure data collection site. The Contractor is required to completely fill in all required data fields using the following web address https://ecmra.mil/.

5.1.2. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. Contractors may direct questions to the help desk, linked at https://ecmra.mil/.

6. STATUS OF FORCES AGREEMENTS. Status of Forces Agreements (SOFAs) between the United States and foreign countries govern the rights and obligations of the United States armed forces in those countries.

6.1. For work performed in Japan:

6.1.1. U.S.-Japan bilateral agreements govern the status of contractors and employees, criminal jurisdiction, and taxation;

6.1.2. USFJ (U.S. Forces Japan) and component policy, as well as U.S.-Japan bilateral agreements, govern logistic support and base privileges of contractor employees;

6.1.3. The Commander, USFJ, is primarily responsible for interpreting the SOFA and local laws applicable to U.S. Forces in Japan and for requirements in support of USFJ; and

6.1.4. A copy of the SOFA is available at the following website: https://www.usfj.mil/Portals/80/Documents/Instructions/36-2611%20(USFJI).pdf

6.2. For work performed in Korea:

6.2.1. U.S.-Korea bilateral agreements govern the status of contractors and employees, criminal jurisdiction, and taxation;

6.2.2. USFK (U.S. Forces Korea) and component policy, as well as U.S.-Korea bilateral agreements, govern logistics support and base privileges of contractor employees;

6.2.3. The Commander, USFK, is primarily responsible for interpreting the SOFA and local laws applicable to U.S. Forces in Korea and for requirements in support of USFK; and

6.2.4. A copy of the SOFA is available at the following website: http://www.usfk.mil/About/SOFA/.

7. THEATER AND COUNTRY CLEARANCE REQUIREMENTS

7.1. The Contractor shall ensure all U.S. citizen or U.S. resident contractor employees and sub-contractor employees performing services under this contract comply with the training and Theater/Country Clearance requirements listed in the Government Foreign Clearance Guide for the country in which they will be employed. The requirements can be found at https://www.fcg.pentagon.mil/fcg.cfm. Verification of the training shall be made available to the KO or COR upon request.

7.2. The Contractor shall follow specific guidance for the combatant command in whose area the Contractor will be performing services or delivering supplies. This guidance is contained on the respective combatant commander’s operational contract support webpage, which is linked to the procedures at http://www.acq.osd.mil/dpap/pacc/cc/areas_of_responsibility.html, at the weblink for the combatant command for the area in which the contractor will be performing services or delivering items. These pages list prevailing regulations, policies, requirements, host nation laws, orders/fragmentary orders, combatant commander’s directives, unique clauses, and other considerations necessary for contract performance in, or delivery of items to, that combatant commander’s area of responsibility.

8. A204-9400(1-17) CONTRACTOR UNCLASSIFIED ACCESS TO FEDERALLY CONTROLLED FACILITIES, SENSITIVE INFORMATION, INFORMATION TECHNOLOGY (IT) SYSTEMS OR PROTECTED HEALTH INFORMATION (JAN 2017)

Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors. The Deputy Secretary of Defense Directive-Type Memorandum (DTM) 08-006 – “DoD Implementation of Homeland Security Presidential Directive – 12 (HSPD-12)” dated November 26, 2008 (or its subsequent DoD instruction) directs implementation of HSPD-12. This clause is in accordance with HSPD-12 and its implementing directives.

APPLICABILITY

This clause applies to contractor employees requiring physical access to any area of a federally controlled base, facility or activity and/or requiring access to a DoN or DoD computer/network/system to perform certain unclassified sensitive duties. This clause also applies to contractor employees who access Privacy Act and Protected Health Information, provide support associated with fiduciary duties, or perform duties that have been identified as National Security Position, as advised by the command security manager. It is the responsibility of the responsible security officer of the command/facility where the work is performed to ensure compliance.

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DoD CAC). Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

ACCESS TO FEDERAL FACILITIES

Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DoD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Command’s Security Manager upon arrival to the Command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

ACCESS TO DoD IT SYSTEMS In accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DoD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity’s Command Information Assurance Manager.

Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) or T5 or T5R equivalent investigation , which is a higher level investigation than the National Agency Check with Law and Credit (NACLC)/T3/T3R described below. Due to the privileged system access, an investigation suitable for High Risk national security positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s Security Manager and Information Assurance Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources.