PWS - Deployment Solutions.docx

Program Executive Office - Defense Healthcare Management Systems (PEO DHMS) Deployment Solutions Performance Work Statement (PWS) Background The Program Executive Office - Defense Healthcare Management Systems (PEO DHMS) is responsible for delivering advanced health IT solutions to the Department of War (DoW), the Department of Veterans Affairs (VA), the United States Coast Guard (USCG), North Atlantic Treaty Organization (NATO)/Coalition partners, and other federal partners including efforts coordinated through the Federal Electronic Health Record Modernization (FEHRM) office. Within its portfolio, PEO DHMS oversees three critical programs: DoD Healthcare Management System Modernization (DHMSM), Joint Operational Medicine Information System (JOMIS) and Enterprise Intelligence and Data Solutions (EIDS). These programs collectively enhance healthcare delivery, operational medicine capabilities, and medical readiness across diverse environments.

DHMSM was established to acquire and field a configurable and scalable modernized Electronic Health Record (EHR) system to replace DoW legacy healthcare systems. In support of this mission, DHMSM acquired an integrated inpatient/outpatient Commercial EHR solution known as MHS GENESIS. The DHMSM portfolio extends beyond MHS GENESIS, incorporating a broader set of solutions to create a single, unified EHR for the federal health community. Through a suite of clinical applications and products, DHMSM provides comprehensive health management, advanced data applications, and improved usability, supporting priorities such as telehealth, population health analytics, and a user-facing patient portal. The DHMSM Program Management Office (PMO) manages the integration of these business processes and clinical workflows to ensure user adoption and a seamless experience throughout the full continuum of care.

JOMIS provides warfighters with technologies to make life-saving and critical mission decisions in operational medicine (OpMed) environments. In support of this mission, JOMIS develops, deploys, and manages OpMed products that allow for documentation of patient care, transmission of patient care data through all roles of care, medical readiness tracking and aggregation of medical Command and Control Situation Awareness (C2SA) data. The JOMIS products are meant to be used as an integrated suite of products that work together with DHMSM and EIDS products to inform the longitudinal health record and conduct aggregated medical reporting and simulations to support C2SA. The suite includes but is not limited to OpMed Care Delivery Platform (CDP), Battlefield Assisted Trauma Distributed Observation Kit - Joint (BATDOK-J), Medical Hub (MedHUB), and Theater Blood-Mobile (TBLD-M). As new capabilities are identified, new products or capabilities may need to be deployed, once developed. JOMIS users are deployed forces across the globe supporting all roles of care in connected and disconnected operational, austere, and forward-deployed locations. To deploy and train OpMed products to the field, JOMIS collaborates with their Service partners to provide a variety of different deployment and training methods based on each individual site or unit, to include low-to-no touch deployment and training.

The EIDS PMO supports the strategic goals of the MHS and facilitates informed decision-making through the delivery of robust information services and data in a timely, relevant, and actionable manner. They deliver, connect, and curate data across a diverse data ecosystem in support of Military Health, readiness, federal health data integration, and innovation. EIDS provides seamless data services and decision support for clinicians, patients, beneficiaries, analysts, researchers, and DoW leadership to support improved patient care. EIDS provides service delivery and product line management, offering more than 100 products and services to DoW, Defense Health Agency (DHA), federal partners, academic, and research communities. They focus on providing the right data at the right time to the right person to drive organizational insights and better patient outcomes. The primary capability supported by EIDS is the Military Health System Information Platform (MIP), which is the largest secondary repository of health-related data in the DoW. It provides self-service access to high trust, governed data and enables traditional reporting and dashboarding capabilities in a secure, cloud-based platform. Users are able access and analyze data within a single, cohesive environment with a collaborative user community.

Due to the growing demand for its product portfolio, PEO DHMS has expanded its focus to include the deployment to operational locations, and additional federal partners, as well as specialized environments where standard network connectivity is limited or unavailable.

Purpose & Scope This is a non-personal services contract to provide all services and materials necessary to support and execute the on-demand deployment of any product(s) within the DHMS portfolio and related or supporting components. This includes program management, deployment planning and execution, hardware delivery and connectivity, product connectivity and interface validation, user enablement services, data management and migration.

Services are applicable to Continental United States (CONUS) and Outside Continental United States (OCONUS) locations, covering various roles of care and facility types as specified in individual task orders[footnoteRef:1]. [1: The Department anticipates that the user base, supported organizations, and operational footprint may expand over the period of performance. While the scope and timing of any such expansion cannot be precisely defined at this time, offerors should be aware that future requirements may include support for periods of increased operational tempo and additional participating entities consistent with evolving mission needs.]

Desired Outcomes/Tasks/Objectives This section outlines the desired outcomes, high-level tasks, and core objectives for the successful deployment of products and integrated systems to hospital (fixed facility) and field unit (expeditionary) environments under this Indefinite Delivery, Indefinite Quantity (IDIQ) contract. The contractor shall be responsible for all activities necessary to ensure a seamless transition from project initiation to full operational capability at each deployment site with minimal disruption to ongoing operations. The overarching goal is to deliver a fully functional and adopted solution that ensures the seamless and accurate transmission of data through all roles of care and meets the mission needs of each location. This is critical for updating patient health records and aggregating data for C2SA reporting.

Each task order will specify the exact scope, schedule, and performance criteria for a given deployment. The objectives listed herein describe the full range of capabilities that may be required across the full range of military operations.

Program Management As part of the Deployment Approach (A003) and the Implementation Plan (A010), the contractor shall provide a program management framework to ensure deployment efforts are governed by consistent standards of quality, risk management, and fiscal discipline. This framework shall provide the Government with full transparency into project performance and ensure the contractor is accountable for all outcomes. The contractor shall successfully execute all work under this contract, including the necessary processes and tools to effectively manage cost, schedule, and performance/resources. Specific requirements, deliverables, and reporting frequencies for each activity will be defined within individual task orders.

The contractor shall designate a primary Program Manager (PM) who will serve as the Government's single point of contact and be responsible for the overall management of the contract. While the contractor may designate other points of contact at the task order level, the primary PM is the one individual authorized to act on behalf of the contractor for all matters related to this contract. This primary PM is ultimately responsible for coordinating all contract performance, including resource allocation, risk mitigation, and ensuring clear communication with the Government's Contracting Officer's Representative (COR).

Core Management Functions:

· Support for Governance and Stakeholder Engagement: The contractor shall provide dedicated support for all Government-led governance bodies (e.g., Informatics Steering Committee or OpMed IT Steering Committee). The contractor's role is to facilitate informed decision-making by:

· Preparing and Facilitating Materials: Developing meeting agendas, presentation materials (D001), data-driven analyses, and expert recommendations on deployment strategies for Government review and consideration.

· Documenting and Tracking Outcomes: Recording meeting minutes (D002) and tracking action items and key decisions made by the Government-led committees.

· Executing a Stakeholder Communications Plan: Developing and executing a comprehensive communications plan that identifies all key stakeholder groups and defines the contractor's strategy for disseminating information about project status, risks, and changes as directed by Government leadership.

· Risk and Issue Management: The contractor shall develop and actively maintain a risk register. This includes creating a comprehensive Contingency Plan to mitigate identified risks, such as data loss, network failures, or schedule delays, ensuring mission-critical operations are protected for the task order.

· Quality and Change Management: The contractor shall implement a robust Quality Management process to ensure all deliverables meet or exceed contract standards. The contractor shall develop and maintain an effective Quality Control Plan (QCP) (CDRL A001), which outlines quality procedures and includes a self-inspection and internal coordination plan. The QCP shall establish a formal Change Control process to manage, document, and validate any modifications to the system or its configuration post-deployment. Required revisions must be made within 5 working days.

· Staffing Plan: The contractor shall develop, maintain, and deliver a Staffing Plan (D003) that details the roles and labor categories required to successfully execute all tasks specified in the task order.

· Contract Reporting and Administration: The contractor shall manage the timely development and submission of all contract deliverables as delineated in the PWS and Sections 34-37.

· Financial and Contract Reporting: The contractor shall provide a Monthly Progress Report (D006) detailing performance against schedule, budget, and objectives.

· Kick-Off Meeting: The contractor shall conduct a kick-off meeting with the Government for each awarded task order. The purpose of this meeting is to ensure a shared understanding of the task order requirements, establish lines of communication, and review the contractor's planned approach.

Deployment Planning and Execution The contractor shall employ an adaptable framework for planning and executing all deployment activities or events to include initiation, planning, configuration, validation, implementation, stabilization, and transition. This framework ensures that each project, regardless of scale or location, moves from concept to sustained operation in a deliberate and controlled manner. The contractor will receive a tested product ready for deployment that requires configuration, validation, and implementation.

Initiation and Planning During initiation and planning, the focus shall be on discovery and creating the blueprint for successful deployment. The desired outcome is a complete and actionable blueprint for deployment, including a strategic approach, a readiness assessment, and a detailed schedule that provides a clear and executable roadmap for successful implementation.

· The Deployment Approach (CDRL A003) is the foundation for the Implementation Plan (CDRL A010). The contractor shall provide the overall approach and methodology for deployment, continuity and logistics, training, user adoption, change management, and communications across multiple environments/networks, fixed/expeditionary facilities for multiple products, and with different federal partners (DoW and non-DoW). The contractor shall include any potential opportunities, risks, issues, and dependencies for each area, and mitigation plans.

· Deployment Readiness Assessment (D008): The contractor shall provide a Deployment Readiness Assessment, which is a formal and systematic evaluation used to determine if an organization, its users, and the technology itself are fully prepared for a successful "go-live" event. This assessment is a comprehensive review that measures preparedness against a predefined set of criteria, moving beyond just technical functionality to include people, processes, and support systems. The contractor shall identify risks, gaps, and potential points of failure that could jeopardize the deployment's success, disrupt operations, or hinder user adoption.

· Implementation Plan (CDRL A010): Based on the Readiness Assessment, the contractor shall develop, maintain, and actively manage an implementation plan, to include a detailed Integrated Master Schedule (IMS) (CDRL A011). The Implementation Plan is the detailed tactical execution plan that operationalizes the approach outlined in the Deployment Approach.

· Data Collection (D009): As specified by the task order, the contractor shall facilitate the timely and accurate collection of all data required to configure the product, hardware, equipment, and interfaces for deployment (Product Configuration Data (D009)).

Product Configuration, Validation, and Implementation As specified in the task order, the contractor shall perform configuration, validation, and implementation activities required for deployment, culminating in the formal cutover event. DHMS products may include hardware and/or component installation and configuration across various networks. This may include user role assignment, security permissions, and system-level parameters. The desired outcome is a fully integrated and validated product where all functionality and data are confirmed to be accurate and operate as intended, ensuring the product is ready for operational use.

Product Validation The contractor shall develop and execute a Product Validation Plan (D012) for all products configured as specified in the task order. The desired outcome is to verify the configured product matches the specifications outlined in the task order.

· Validate the product(s) functionality, which may include integration with both internal and external clinical, financial, and administrative systems and interfaces, to ensure it operates as intended under expected conditions, as specified in the task order.

· The contractor shall complete data validation and reconciliation as designated in the task order.

Network Integration and Configuration The contractor shall ensure seamless integration with existing network infrastructure, validating bandwidth requirements and testing all network configurations and firewall rules. As applicable, the contractor shall deploy and configure products to operate autonomously in Disconnected, Intermittent, and Limited (DIL) environments, encompassing the full range of operational platforms from server-based theater hospital products to mobile, point-of-injury data capture solutions running on handheld devices and wearable sensors. The desired outcome is a fully configured and integrated product that complies with applicable DoW cybersecurity requirements.

Hardware Delivery, Installation, and Configuration The contractor shall manage the procurement, end-to-end logistics using DD Form 1149 (D011), installation, and network integration of all required hardware, which shall be contractor-furnished and not Government Furnished Equipment (GFE), as delineated in the task order. The desired outcome is that all physical components are identified, delivered, installed, connected, and functioning as intended in their designated operational environment based on Government requirements.

Medical Device Configuration and Validation The contractor shall ensure that all required medical devices can securely and reliably connect to and interoperate with the newly deployed product. The desired outcome is a fully validated, integrated environment where data flows accurately and securely between medical devices and the central system, ensuring patient safety and quality of care.

Data Management and Migration As part of the Deployment Approach (CDRL A003) and Implementation Plan (CDRL A010), the contractor shall be responsible for the secure and accurate management, migration, and validation of all clinical and administrative data as specified in the task order. The desired outcome is for all necessary data to be validated and securely transferred to the new product with its integrity intact, ensuring continuity of care.

· For fixed facilities, execute the Extract, Transform, and Load (ETL) process, potentially by replicating data to a parallel data center prior to a planned cutover.

· For field units, perform "Data Seeding" as a critical pre-deployment task. This involves pre-loading the ship's or unit's local server with essential data such as patient demographics, formularies, and clinical templates to enable autonomous operation.

· Utilize secure data migration methods, such as encrypted transfer protocols or the physical transport of encrypted backup media.

Cutover, Stabilization, and Transition The contractor shall manage the activities associated with cutover to the new product, stabilize the new environment, and ensure a seamless hand-off to sustainment teams. The desired outcome is to have a seamless transition from one product or system to another with minimal impact on healthcare operations.

· Cutover: The contractor shall manage the coordination and communication of the transition to the new product.

· Post-Deployment Stabilization Support: The contractor shall implement and manage a multi-tiered user support structure to provide rapid and effective assistance, including on-site "at-the-elbow" and remote support as defined in the task order.

· Post-Deployment Stabilization Report (D010): The contractor shall provide a daily report during the Post-Deployment Support period as defined in the task order. This report will include status of tickets, devices, user support, and other key indicators of a successful transition.

· Transition to Sustainment: The contractor shall execute a formal transition plan to hand off the fully deployed and stabilized product(s) to the Government sustainment and operations teams.

User Enablement Services The contractor shall provide all necessary personnel, supervision, and materials required to perform a full range of training and user adoption services in support of the deployment of DHMS products. The contractor must possess the capability to perform the services described in the sections below.

Human Systems Integration (HSI) Alignment The contractor shall ensure that all training, adoption, and support services are aligned with the principles of Human Systems Integration (HSI) as outlined in DoDI 5000.95. The objective is to ensure that the contractor's services contribute to a total system that is effective, suitable, and safe for human use. The contractor shall maintain a working knowledge of HSI principles and processes, and leverage HSI principles to identify and help mitigate barriers to user performance and acceptance.

Consideration of Operational Environments The contractor shall possess the capability to provide training, adoption, and user support services to users in operational environments, including theaters of war and other locations with DIL network connectivity. The specific requirements for such support will be detailed in individual task orders. When providing services for these environments, the contractor shall ensure all resources, methods, and support models are operationally suitable to achieve optimal staff efficiency at the lowest possible barrier to adoption. The focus shall be on user self-sufficiency and mission effectiveness in a contested or austere environment.

Consideration of Global User Community All services described herein shall be available to a global user base. The contractor shall deliver consistent, prompt, and effective support to personnel regardless of their geographic location or time zone. All planning, staffing, and execution strategies must account for the complexities of worldwide operations, including but not limited to, varying network conditions, local command structures, and cultural considerations.

Training As part of the Deployment Approach (CDRL A003) and Implementation Plan (CDRL A010), the contractor shall design, develop, and execute a comprehensive training program to ensure users are familiar with the product deployed in the task order. For the Federal EHR, proficiency is achieved when a user can consistently and confidently complete role-specific workflows and pass course-specific competency assessments. For JOMIS products, the training shall be intuitive, user-centric, and outline a joint approach for collaborative execution with the Services. The training program should also provide schedules, risk assessments, and mitigation plans for each product and site in a timely manner. The Government will specify the required materials and target audiences in each task order. The desired outcome is a confident and competent user base capable of leveraging the product(s) full capabilities effectively and efficiently.

Training Program Development

· The contractor shall develop a formal training and orientation plan that identifies all relevant user groups, personas, and their specific learning needs.

· The contractor shall create training materials, including instructor guides, user manuals, quick reference guides (tip sheets), computer-based training, micro-learning, and in-application guidance such as tooltips and contextual help directly within the tool (CDRL A002).

· The contractor shall identify and train designated "super users" from experienced staff who will participate in testing and provide peer support.

· As specified in the task order, the contractor shall establish a dedicated training environment that mirrors production and mimics real-world configuration, workflows, and product interactions to allow hands-on practice.

Training Delivery

· The contractor shall provide qualified instructors to deliver and manage end-to-end training for a diverse and geographically dispersed user base. Instruction must be tailored to the specific task order and operational environment, accommodating all echelons of care. To build user confidence in newly deployed products, the training shall incorporate role-based simulations and "day-in-the-life" scenarios for users throughout the full continuum of care.

· Deliver blended, role-based training for all impacted functional and technical/system admin users that combines various methods like instructor-led training (both virtual and in-person), self-paced e-learning, and hands-on simulations. Training must be tailored to the specific workflows and responsibilities of the user.

· The contractor shall manage all end-to-end logistics for training delivery as specified in the task order, including user assignment, scheduling, and tracking. A key component will be conducting "train-the-trainer" sessions to enable government personnel to provide ongoing sustainment training.

· Training shall be delivered via multiple methods, including Instructor-Led Training (ILT), Virtual Instructor-Led Training (VILT), Computer-Based Training (CBT), in person support, and self-guided learning. To ensure a smooth transition, the contractor will identify critical user groups to maintain key functions during cutover and provide on-site or virtual support for end-users during and after deployment.

· The contractor shall identify a method for tracking user proficiency. As specified in the task order, they will deliver a User Training Completion Report (D007) to measure progress. A final report on all training activities is also required, which will include attendance records, a roster of untrained users, a summary of user feedback, and lessons learned.

Adoption and Change Management The contractor shall provide and execute robust user adoption and change management support to facilitate a smooth transition and foster buy-in. The overarching goal is to prepare the organization for change, drive user acceptance and adoption, and demonstrate the realization of measurable value from the newly deployed product(s). The contractor is responsible for the execution of all change management activities to ensure the successful integration of the new product(s) into the organization's daily workflows and culture, leading to high levels of user satisfaction and the realization of the product's intended benefits.

Change Management and Leadership Engagement

· As part of the Deployment Approach (CDRL A003) and Implementation Plan (CDRL A010), develop and execute a comprehensive Change Management and Adoption Plan that outlines the approach for managing the human side of the transition. The contractor shall be responsible for managing all activities outlined in the plan, leveraging proven industry best practices and models for both its development and execution.

· Conduct a thorough stakeholder and change impact analysis and use its findings to actively manage stakeholder engagement, mitigate resistance, and adapt to evolving organizational needs throughout the transition. Use readiness surveys to gauge organizational preparedness.

· Actively engage Government leadership to secure strong executive and clinical buy-in. The contractors shall lead the effort to empower and equip Government identified physicians and staff champions to take a leadership role in the transition.

· Implement and manage a dedicated communication and engagement strategy, as applicable, ensuring consistent and effective communication throughout the task order.

Communication and End-User Engagement

· Design and execute a tailored communication and engagement plan to keep all stakeholders informed, build awareness, and address concerns.

· Create, disseminate, and maintain communication products that build awareness of the "why" behind the change, broadcast key project milestones, and celebrate successes to build momentum and positive sentiment. The contractor is responsible for the full lifecycle of these materials.

· Actively and continuously manage the engagement of end-users throughout the design, planning, and implementation process, ensuring their feedback is documented and incorporated to create effective workflows.

· Design, schedule, and conduct dedicated engagement sessions for supervisors and organizational leaders. The contractor shall develop and deliver leader-specific talking points, FAQs, and coaching materials to equip leaders to champion the change and manage resistance.

· Establish, manage, and host regularly scheduled, informal "Office Hours" and open forum sessions (both virtual and in-person) as required by the task order. The contractor is responsible for staffing these sessions and providing immediate, transparent answers.

· Facilitate engagement activities (e.g., focus groups, user interviews, direct observation) to assess organizational readiness and identify potential barriers to user acceptance. The contractor shall then analyze these findings to develop and implement targeted interventions (e.g., additional demos, specialized communication) to address identified barriers and ensure all user groups are successfully supported.

Adoption Measurement and Reinforcement

· Implement and manage the tools and processes to monitor product usage and user proficiency post-cutover. The contractor shall define, track, analyze, and report on metrics demonstrating measurable value, user satisfaction, and user acceptance.

· The contractor shall be responsible for delivering regular performance reports that analyze Key Performance Indicators (KPIs) tied to operational efficiency (e.g., reduced patient documentation time, improved clinical workflow compliance) and user sentiment. These reports will serve as the primary evidence of a successful change initiative for the task order.

· The contractor shall design and conduct user satisfaction surveys and lead after-action reviews. The contractor shall then analyze the findings to produce detailed reports with actionable recommendations and lessons learned to guide future deployments and continuous improvement efforts.

Period of Performance (PoP) The PoP shall be for one (1) base year of 12 months and four (4) 12-month option years.

Transition-in Period The Transition-in period is 30 days from task order award date. Transition-in performance is defined as the period for the contractor to integrate and provide onboarding activities. During the transition-in period, the contractor shall develop a Transition-in Plan (CDRL A004) and a Staffing Plan (D003) to demonstrate how all contract requirements will be met and ensure incoming personnel are functionally trained and qualified on the full performance start date. Personnel shall be trained and qualified within 30 days.

Transition-out Period The contractor shall provide information and cooperation to affect an orderly and efficient transition to a successor. The contractor shall develop a Transition-out Plan (CDRL A005) supporting outgoing transition support and provide the plan 60 days prior to the end of the contract or task order. Upon approval of the Transition Plan, the contractor shall commence transition out activities working with the incoming contractor or Government entity. Additionally, the contractor shall provide formal coordination with Government staff and successor staff and management. The Transition Plan shall specify a training program and a date for transferring responsibilities for each division of work described in the plan, including the delivery of all final documentation. The contractor shall provide an adequate number of experienced personnel during the phase-in, phase-out period to ensure that the services called for by this contract are maintained at the required level of proficiency. The Transition Plan shall include, but is not limited to:

1. Coordination with Government representatives.

2. Review, evaluation, and transition of current support services.

3. Turn-in of all Government keys, ID/access cards, and security codes. The contractor shall comply with transition-out requirements of the DHA for contractors who have been issued a CAC or who generate “records”, as defined by DoW (records manual), including DoW-directed disposition of records, and others displayed on the In/Out (I/O) Processing Portal.

Place of Performance Specific places of performance will be identified in individual task orders issued under the contract. The contractor shall comply with host nation agreements for performance of any work in OCONUS locations and as specified in individual task orders.

Hours of Operation The contractor must maintain an adequate workforce for the uninterrupted performance of all tasks to be defined within each task order.

Recognized Federal Holidays Unless otherwise defined in the task order, contractors are not required to perform services on the following holidays:

New Year’s Day Martin Luther King Jr.’s Birthday President’s Day Memorial Day Juneteenth Day Independence Day Labor Day Columbus Day Veteran’s Day Thanksgiving Day Christmas Day Travel Contractor travel requirements will be defined within each task order.

Other Direct Costs (ODC) The contractor shall be authorized to bill ODCs as established within the task order. These costs must be preapproved by the COR and include costs applied to the contract, except for the cost of material or labor. The cumulative reimbursable ODC amount shall not exceed the relevant Contract Line Item Number (CLIN) obligated amount.

Status of Forces Agreements (SOFA) It is possible for some contract activity to occur at OCONUS locations. In the event such support is required, if the country in which contractor support will occur has a SOFA with the United States, it is critical for those designated for travel to receive authority to operate as a contractor for the U.S. Military in those countries. The Government will identify SOFA points of contact (POCs) for any OCONUS location where the contractor will be required to travel. The contractor shall coordinate to understand fully and to complete and submit necessary documents to the SOFA authority for each country where such support is to be scheduled. The contractor shall perform this task not later than 90 calendar days prior to any scheduled travel.

Government Furnished Property (GFP), Equipment, and Services The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services as described in the sub-sections below.

Services In general, the Government will not provide Services unless specified in the task order.

Facilities In general, the Government will not provide Facilities unless specified in the task order.

Materials In general, the Government will not provide Materials unless specified in the task order.

Equipment In general, the Government will not provide Equipment unless specified in the task order.

Procurement Integrated Enterprise Environment (PIEE), GFP Module Application The contractor shall be responsible for obtaining and maintaining access, training, and successful operation of the PIEE/GFP Module application for the entirety of the task order PoP. The PIEE GFP Module application is located at the following website: https://wawf.eb.mil/piee-landing/. Access to PIEE/GFP Module application training materials and in-depth information applicable to the contractor’s responsibilities regarding GFP can be found at the following website: https://dodprocurementtoolbox.com.

Contracting Office Responsibilities:

The Contracting Office shall ensure close coordination and validation of the GFP items with the COR and DHA Accountable Property Officer prior to uploading the GFP Attachment into the PIEE/GFP Module. At the time GFP is anticipated and identified, the Government will upload the GFP Attachment into the PIEE/GFP Module. It is the Contracting Office’s responsibility to prepare, upload, and maintain the GFP Attachment in the PIEE/GFP Module in accordance with the GFP Attachment instructions provided at the DoD Procurement Toolbox. The Contracting Officer and COR shall manage and keep an inventory of any GFP associated with contract/task orders awarded through DHA, in accordance with applicable Federal Acquisition Regulation (FAR) Part 45, Revolutionary FAR Overhaul (RFO) Part 45, DoD FAR Supplement (DFARS) 245 with respective clauses, DHA Administrative Instruction (AI) 094 and PD 45-01 following the change in disposition of items listed on that PIEE/GFP Module Attachment.

The Contracting Office will also review, acknowledge, reject, and/or approve shipment orders provided by the contractor as appropriate. Functional roles can be determined within the Contracting Office and requested within the PIEE/GFP Module system.

Contractor Responsibilities:

A key contractor responsibility is to work with the Contracting Officer and COR to ensure the PIEE/GFP Module data, to include the PIEE/GFP Attachment, provides a timely, complete, and accurate accounting of the GFP applicable to the contract/task order. Contractors are required to report the receipt of any GFP shipped to them, regardless of whether it is listed on the GFP Attachment for their contract. Similarly, contractors are required to utilize the GFP Module application in conjunction with the shipment of GFP to the Government, or in reporting Property Loss of GFP issued (such as destruction or loss). Discrepancies or disputes regarding property shipped to or shipped from the contractor must be reported via the GFP Module application, with the Contracting Officer having authority over final designation of status.

Contractor Furnished Items and Services The contractor shall furnish all supplies, materials, equipment, facilities, and services required to perform work listed in Section 3, Desired Outcomes/Tasks/Objectives of this PWS as specified in the task order.

Manpower Reporting Contractors shall report “contractor manpower” (including subcontractor manpower) via the internet at www.sam.gov. The contractor shall report annually by October 31, for services performed during the preceding Government fiscal year (October 1 – September 30), the amount invoiced for services, the number of hours of contract employees, and any relevant subcontract numbers and hours.

Data Rights In accordance with the DFARS clauses pertaining to data rights included in this contract (ref. DFARS RFO Class Deviation 2026-O0036 Part 227.4), the Government shall have unlimited rights to all data, documents, and materials produced or delivered in the performance of this contract. These deliverables include, but are not limited to, all analyses, evaluations, models, reports, documents, studies, computer programs, and services developed with Government funding.

All materials developed and delivered under this contract are the sole property of the Government. The contractor shall not use, sell, or otherwise distribute these materials for any purpose without the express written permission of the Contracting Officer. Government ownership includes the right to copyright, patent, register, and transfer these rights. This provision does not abrogate any other rights of the Government.

For any deliverables that contain or incorporate pre-existing materials not first produced under this contract, the contractor shall grant the Government a nonexclusive, worldwide, royalty-free, irrevocable license to use, reproduce, distribute, prepare derivative works, publicly perform, and publicly display such materials. The contractor warrants that it possesses all necessary intellectual property rights, permissions, and licenses to grant this to the Government.

The contractor shall provide prompt written notification to the Contracting Officer of any notice or claim of copyright or patent infringement received by the contractor with respect to any materials delivered or used in the performance of this contract.

Information Technology and Security Work under this contract may include classified work. Any additional security requirements will be specified under individual task orders.

Unless specified in the task order, the Automated Data Processing/Information Technology (ADP/IT) levels and position sensitivity designation for positions under this contract is ADP/IT-II Level (Limited Privileged): Positions in which the contractor is responsible for the direction, planning, design, operation, or maintenance of a computer system, and whose work is technically reviewed at the IT-II Position level by a higher authority to ensure the integrity of the system. Personnel whose duties meet the criteria for an IT-II Position require a FAVORABLY ADJUDICATED TIER III (T3) Background Investigation for Suitability Determination. ADP/IT-II Level positions will not be granted eligibility for SECRET access.

Training Contractor employees performing cybersecurity/cyberspace functions shall comply with the following requirements:

· Training: All contractor and associated subcontractor employees working Cybersecurity Information Assurance (IA)/Cyberspace functions must comply with DoW training requirements in Department of Defense Directive (DoDD) 8140.01 and DoD Manual (DoDM) 8140.03. Contractors shall identify, document, track, and report qualifications of contractor support personnel who perform cyberspace roles.

· Certification: The contractor shall ensure that personnel accessing Information Systems (IS) have the proper and current IA certification to perform IA functions at task order award in accordance with the most current version of DoDM 8140.03, “Cyberspace Workforce Qualification and Management Program.” The contractor shall meet the applicable IA certification requirements as outlined in DFARS 252.239-7001, including:

· DoW-approved IA workforce certifications appropriate for each category and level as listed in the current version of DoDM 8140.03, “Cyberspace Workforce Qualification and Management Program.”

· Appropriate operating system and/or product certification for IA technical positions as required by the most current version of DoDM 8140.03, “Cyberspace Workforce Qualification and Management Program.”

Upon request by the Government, the contractor shall provide documentation supporting the IA certification status of personnel performing IA functions.

Contractor personnel who do not have proper and current certifications shall be denied access to DoW IS for the purpose of performing IA functions.

Access to Defense Health Agency (DHA) IT All contractor employees that require access to DHA IT must comply with the requirements of DHA-Procedural Instruction 8140.01, Acceptable Use of DHA IT, to include those contract employees with privileged access.

System Authorization Access Request (SAAR), Defense Department (DD) Form 2875 The contractor shall submit the most current version of DD Form 2875, “System Authorization Access Request (SAAR), in accordance with the Contracting Officer guidance for all contractors that use the DoW Gateways to access Government IT systems and/or DoW applications. DD Form 2875 shall clearly specify the system and/or application name and justification for access to that system and/or application.

The contractor shall submit the completed DD Form 2875 to DHA IT Security for verification of Tier I or Tier II Designation. The DHA Personnel Security will verify that the contractor employee has completed the appropriate background investigation or a request for background investigation has been submitted to the Office of Personnel Management (OPM). Acknowledgement from OPM that the request for a background investigation has been received and that an investigation has been scheduled will be verified by the DHA Personnel Security prior to access being approved.

Upon approval, DHA will notify the user of the ID and password via secure/encrypted e-mail upon the establishment of a user account. User accounts will be established for individual use and may not be shared by multiple users or for system generated access to any DoW application. Misuse of user accounts by individuals or contractor entities will result in termination of system access for the individual user account.

The contractor shall conduct a monthly review of all contractor employees who have been granted access to DoW Information Systems/networks to verify that continued access is required.

The contractor shall provide the DHA Privacy and Civil Liberties Office (DPCLO) with a report of the findings of their review by the 10th day of each month following the review. Reports identifying changes to contractor employee access requirements shall include the name, DoW ID number from CAC, Company, IS/network for which access is no longer required and the date access will be terminated.

Cybersecurity Requirements for Non-DoW IT or Covered Contractor Information Systems (IS) The contractor shall, at time of award, have implemented the security requirements prescribed in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (available via the internet at http://dx.doi.org/10.6028/NIST.SP.800-171), in accordance with DFARS clause 252.204-7012.

NIST SP 800-171 DoD Assessment Methodology.

The DFARS RFO clause 252. 240-7997 introduces the “NIST SP 800-171 DoD Assessment Methodology” requirement. This requirement enables a strategic assessment of a contractor’s implementation of the NIST SP 800-171 requirements as required in DFARS clause 252.204-7012. The DoD Assessment Methodology requirement flows down to subcontractors. The contractor shall consider the recommendations for enhanced security requirements prescribed in the NIST SP 800-172, “Enhanced Security Requirements for Protecting Controlled Unclassified Information” (available via the internet at https://doi.org/10.6028/NIST.SP.800-172).

Basic Assessment.

The contractor shall perform a Basic Assessment, using the NIST SP 800-171 DoD Assessment Scoring Template, and provide the results for each covered contractor information system that is relevant to an offer, call, contract, task order, or delivery order.

The contractor shall ensure that applicable subcontractors also have their results of a current assessment posted in the designated government system prior to awarding a subcontract or other contractual instrument in accordance with DFARS clause 252.240-7997.

The contractor shall provide the Government with access to its facilities, systems, and personnel when necessary to conduct or renew a higher-level (i.e., Medium or High) assessment in accordance with DFARS clause 252.240-7997.

Cybersecurity Maturity Model Certification.

The contractor shall comply with DFARS RFO Class Deviation 240.371 Cybersecurity Maturity Model Certification. The CMMC (DFARS clause 252.204-7021) builds upon the NIST SP 800-171 DoD Assessment Methodology by adding a comprehensive and scalable certification element to verify the implementation of processes and practices associated with the achievement of a cybersecurity maturity level. The CMMC is designed to increase assurance to the DoW that federal contract information (FCI) and DoW CUI is protected at a level commensurate with the risk. The CMMC requirement flows down to subcontractors.

The contractor shall align with the most current CMMC program milestones and prepare to attain an accredited CMMC Third Party Assessment Organization (3PAO) at CMMC Level 2. Once CMMC 2.0 is fully implemented, DoW will only accept CMMC assessments provided by the Government or an authorized and accredited C3PAO or certified CMMC Assessor. In the final phases of the transition to CMMC 2.0 assessments will be retroactive, and contractors will need to demonstrate compliance. Additional information on CMMC is available at https://dodcio.defense.gov/CMMC and https://www.cyberab.org/.

The contractor shall submit requests to vary from NIST SP 800-171 in writing to the Contracting Officer or COR, for consideration by the DoW Chief Information Officer (CIO). The contractor need not implement any security requirement adjudicated by an authorized representative of the DoW CIO to be non-applicable or to have an alternative, but equally effective, security measure that may be implemented in its place.

If the DoW CIO has previously adjudicated the contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the Contracting Officer or COR when requesting its recognition under task orders issued under this contract.

Cloud Computing If the contractor intends to use an external cloud service provider, on their behalf, to store, process, or transmit any DoW CUI in performance of task orders under this contract, the contractor shall require the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/) and that the cloud service provider complies with requirements outlined below for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

If the information is DoW CUI-specific (e.g., PII/PHI), then the contractor shall ensure the external cloud service provider meets security requirements equivalent to FedRAMP High baseline.

Cyber Incident Reporting Requirement When the contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor’s ability to perform the requirements of any task orders under this contract that are designated as operationally-critical support and identified in the task order, the contractor shall:

· Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident, as well as other IS on the contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the contractor’s ability to provide operationally critical support; and

· In accordance with DFARS clause 252.204-7012, rapidly report (within 72 hours) cyber incidents involving DoW CUI to DoD Cyber Crime Center (DC3) via https://dibnet.dod.mil. In the event of a cybersecurity incident involving a CUI-Specific breach (i.e., PII/PHI), the contractor, in addition to reporting to the DC3, shall follow the incident reporting guidance prescribed in the TRICARE Operations Manual, Chapter 1, Section 5, “Compliance with Federal Statutes” at https://manuals.health.mil/.

The cyber incident report shall be treated as information created by or for DoW and shall include, at a minimum, the required elements as prescribed at the https://dibnet.dod.mil/portal/intranet/.

Medium Assurance Certificate Requirement: To report cyber incidents in accordance with this clause, the contractor or…