PWS_ESS_Modernization_NHB.pdf

Department of Defense

Defense Health Agency

Performance Work Statement

Electronic Security System (ESS) Modernization

Directorate for Administration, Operations Management

Naval Hospital Bremerton (NHB)

Solicitation Number: [TBD]

Version: 1.0

Date: June 2026

PART 1

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide a comprehensive upgrade and potential replacement of the Electronic Security System (ESS) at Naval Hospital Bremerton

(NHB).

1.2 Description of services/introduction: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform the design, installation, and testing of the

ESS as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The Contractor shall perform to the standards in this PWS and all referenced publications in Section 2.3 of this PWS.

1.3 Background: The current security surveillance and detection system at NHB is not compliant with the most current versions of the applicable publications prescribed in

Section 2.3 of the PWS. Therefore, this contract is required to modernize the ESS to protect assets—people, facilities, sensitive information, and equipment—thereby supporting the mission of Defense Health Agency (DHA) and NHB.

1.4 Objectives: The objectives of this contract are to:

• Provide NHB with a fully functional, reliable, and integrated ESS (Video Surveillance

Systems (VSS), Access Control System (ACS), and Intrusion Detection System (IDS)) that meets all requirements referenced in the publications identified in Section 2.3 of this

PWS.

• Ensure all required areas of the hospital are under appropriate camera surveillance with adequate video recording and storage capabilities.

• Implement a standalone, cyber-secure system capable of achieving a DoD Risk

Management Framework (RMF) Authority to Operate (ATO).

1.5 Scope: The Contractor shall provide all necessary program management, engineering, labor, materials, equipment, and supervision to design, procure, install, configure, test, and accredit a complete and operational ESS at NHB, which is compliant with the most current versions of the publications in Section 2.3 of this PWS. The scope includes the full integration of all subsystems, achieving a DoD Authority to Operate (ATO), providing comprehensive training to government personnel, and delivering complete system documentation. The Contractor shall also provide warranty and ongoing maintenance support as defined herein. The final system shall be a standalone network, not connected to the existing hospital network.

1.6 Period of Performance (PoP): [To be determined at contract award].

1.7 Administrative specifications

1.7.1 Place of performance: The work shall be performed at Naval Hospital Bremerton (NHB) in Bremerton, WA.

1.7.2 Recognized Federal holidays: The Contractor is not required to perform services on

Federal holidays.

1.7.3 Hours of operation: The Contractor is responsible for conducting business Monday through Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings.

1.7.4 Emergency Services: On occasion, services may be required to support an activation or exercise of contingency plans outside the normal duty hours.

1.8 RESERVED.

1.9 RESERVED.

1.10 Quality

1.10.1 Quality Control (QC): The Contractor shall develop and maintain an effective QC program to ensure services are performed in accordance with this PWS. The Contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The Contractor’s QC program is the means by which the work complies with stated requirements. The Contractor shall prepare and submit its comprehensive QCP within 7 days after contract award to the Government IAW CDRL A001. After acceptance of the Quality Control Plan (QCP) the Contractor shall receive the CO’s acceptance in writing of any proposed change to his QC system. See Part 7, Technical Exhibit 1 - CDRL A001.

1.10.2 Quality assurance (QA): The Government will evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.11 RESERVED.

1.12 Key personnel (Contractor): The Contractor shall provide a Contract Manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the Contractor when the manager is absent shall be designated in writing to the CO. The Contract Manager or alternate shall have full authority to act for the

Contractor on all contract matters relating to daily operation of this contract. The Contract

Manager or alternate shall be available between 8:00 a.m. to 4:30 p.m., Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons.

1.13 RESERVED.

1.14 Reporting

1.14.1 RESERVED.

1.14.2 RESERVED.

1.14.3 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions:

assure that the Contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the Contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor Contractor's performance and notifies both the CO and Contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of Contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the Contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.14.4 Post award conference/periodic progress meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office. The CO, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings the CO will apprise the Contractor of how the government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a Contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All Contractor personnel shall identify themselves as Contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings. The Contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is Contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is Contractor support personnel. Include a title block in all emails that states the fact that the person is Contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is Contractor support personnel.

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order. Contractor personnel shall make their Contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a Contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16 Contractor Access to Health Affairs (HA)/DHA Network(s)

1.16.1. Contractor access to the HA/DHA network is contingent strictly on the approved

Course of Action (COA) selected by the Government for this effort and subsequent contract award. Specifically, if the proposed ESS is fully Risk Management Framework (RMF) accredited, the Contractor may be granted access to the main HA/DHA network to perform integration, configuration, and testing, subject to final Government approval and compliance with DHA cybersecurity policies. However, if the proposed ESS is not RMF accredited, the Contractor will not be granted access to the main HA/DHA network, and must design, install, and configure the ESS on a completely standalone network infrastructure that maintains total physical and logical separation from the existing hospital network.

1.17 Personnel Security

1.17.1 The Contractor shall comply with DoD 8570.01-M, “Information Assurance

Workforce Improvement Program, CH4” November 10, 2015 as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in

DoD Health Care Programs” dated March 3, 2019, Department of Defense Instruction (DoDI)

6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM 5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.17.1.1 Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel

Security Office can be reached at (703) 275-6038.

1.17.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information

(CUI).

1.17.1.3 DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a

Contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA

Personnel Security Office not signing off on any access request.

Commented [ED1]: @Chacon, Joshua LTJG USN DHA BREMERTON NH (USA) will the contractor need to access DHA Networks at all while performing this contract?

Commented [C(2R1]: @Dang, Eric M CIV DHA DHN PACIFIC RIM (USA) I don't believe they do since it will be a standalone network. I think we can determine this once we get more information from the vendors.

Commented [ED3R1]: @Chacon, Joshua LTJG USN DHA BREMERTON NH (USA) is there an IT SME at your MTF that you can ask to confirm?

Commented [C(4R1]: @Dang, Eric M CIV DHA DHN PACIFIC RIM (USA) yes, I can talk with IMD.

Commented [C(5R1]: @Dang, Eric M CIV DHA DHN PACIFIC RIM (USA) so I spoke with IMD and they said if a vendor Risk framework accreditation that they recommend placing the system on the network. But if its not accredited, then do a stand alone. So it will probably depend on if the system will go on the network.

Commented [ED6R1]: @Chacon, Joshua LTJG USN DHA BREMERTON NH (USA) we can make a requirement to go onto the Network. It just depends on what your MTF wants to do. Let me know.

Commented [C(7R1]: @Dang, Eric M CIV DHA DHN PACIFIC RIM (USA) I remember speaking with my DFA about this and we talked about a stand alone system but that was prior to talking to IMD and learning new information. Are we able to add the requirement of it going onto the network as a possibility? The DFA is out at a conference and returns next week.

Commented [ED8R1]: @Chacon, Joshua LTJG USN DHA BREMERTON NH (USA) yes, please feel free to draft some language for us to use. We can massage it accordingly.

Commented [C(9R1]: @Dang, Eric M CIV DHA DHN PACIFIC RIM (USA) added

Commented [ED10R1]: @Chacon, Joshua LTJG USN DHA BREMERTON NH (USA) I made a few minor mods. Please accept them if you concur.

Commented [C(11R1]: @Dang, Eric M CIV DHA DHN PACIFIC RIM (USA) I accepted those changes.

mailto:joshua.chacon5.mil@health.mil mailto:joshua.chacon5.mil@health.mil mailto:eric.m.dang2.civ@health.mil mailto:eric.m.dang2.civ@health.mil mailto:joshua.chacon5.mil@health.mil mailto:joshua.chacon5.mil@health.mil mailto:eric.m.dang2.civ@health.mil mailto:eric.m.dang2.civ@health.mil mailto:eric.m.dang2.civ@health.mil mailto:eric.m.dang2.civ@health.mil mailto:joshua.chacon5.mil@health.mil mailto:joshua.chacon5.mil@health.mil mailto:eric.m.dang2.civ@health.mil mailto:eric.m.dang2.civ@health.mil mailto:joshua.chacon5.mil@health.mil mailto:joshua.chacon5.mil@health.mil mailto:eric.m.dang2.civ@health.mil mailto:eric.m.dang2.civ@health.mil mailto:joshua.chacon5.mil@health.mil mailto:joshua.chacon5.mil@health.mil mailto:eric.m.dang2.civ@health.mil mailto:eric.m.dang2.civ@health.mil

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE PUBLICATIONS

2.1 Definitions:

• Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

• Contracting Officer’s Representative (COR): An individual designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

• Electronic Security System (ESS): An integrated electronic system that encompasses

Access Control Systems (ACS), Intrusion Detection Systems (IDS), and Video Surveillance

Systems (VSS).

• Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

• Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of Contractor performance.

The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.2 Acronyms:

• ACS - Access Control System

• ATO - Authority to Operate

• CDRL – Contract Data Requirements List

• DoD - Department of Defense

• ESS - Electronic Security System

• IDS - Intrusion Detection System

• NHB - Naval Hospital Bremerton

• PWS - Performance Work Statement

• RMF - Risk Management Framework

• STIG - Security Technical Implementation Guide

• UFC - Unified Facilities Criteria

• VSS - Video Surveillance System

2.3 Applicable Publications:

• Committee on National Security Systems Instruction (CNSSI) 1253

• DoDI 2000.16, DoD Antiterrorism (AT) Standards

• DoDI 8510.01, Risk Management Framework (RMF) for DoD IT

• Federal Information Processing Standards (FIPS) Publication 201, "Personal Identity

Verification (PIV) of Federal Employees and Contractors"

• Health Insurance Portability and Accountability Act (HIPAA) Security Rule

• National Fire Protection Association (NFPA) Codes (70, 72, 101)

UFC 4-010-01, “DoD Minimum Antiterrorism Standards for Buildings"

• UFC 4-010-06, "Cybersecurity of Facility-Related Control Systems"

• UFC 4-021-01, "Mass Notification Systems"

• UFC 4-021-02, "Electronic Security Systems"

• UFC 4-510-01, "Design: Military Medical Facilities"

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

3.1 Services: The Government will NOT provide Government Furnished Services in support of this contract.

3.2 Facilities: The Government will provide Government Furnished Services required in support of this contract. This includes access to the facility and existing infrastructure pathways (e.g., conduit and cable trays) where feasible. Specific server room space will be designated for new head-end equipment.

3.3 Utilities: The Government will provide utilities in support of this contract. All utilities in the facility will be available for the Contractor’s use in performance of tasks outlined in this

PWS.

3.4 Equipment: The Government will NOT provide equipment in support of this contract/task order.

3.5 Materials: The Government will NOT provide materials in support of this contract.

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 General: The Contractor shall furnish all supplies, equipment, facilities, and services required to perform work listed under Section 5 of this PWS. This includes all cameras, servers, switches, workstations, software, licensing, cabling, and mounting hardware necessary to deliver a complete and operational system.

PART 5

5.0 SPECIFIC TASKS

5.1 Technical Requirements

5.1.1 The Contractor shall deliver a fully functional and integrated ESS for NHB, which is compliant with the applicable publications in Section 2.3 of this PWS.

5.2 General System Requirements

5.2.1 Operational Availability: The Contractor shall ensure the entire ESS achieves a minimum operational availability of 100%, measured monthly. The system shall be supported by an uninterruptible power supply (UPS) to ensure continuous operation for a minimum of two hours during a power outage.

5.2.2 System Latency: The Contractor shall ensure the time delay between sensor activation and annunciation at the operator workstation does not exceed 10 seconds, with a goal of 3 to 5 seconds.

5.2.3 Scalability: The Contractor shall ensure the ESS has a modular architecture capable of supporting a 25% expansion in connected devices through software configuration with minimal hardware additions.

5.2.4 Force Protection Condition (FPCON) Support: The Contractor shall configure the ESS to support all FPCON levels, allowing an administrator to implement progressively stricter security protocols with a single command.

5.2.5 Mass Notification System (MNS) Integration: The contractor shall fully integrate the

ESS with the facility's MNS in accordance with UFC 4-021-01. The integration shall support activation via supervised inputs, prioritized messaging (with active shooter taking precedence over fire), pre-recorded messages for all required scenarios, and live voice override.

5.3 Central Security Management System (SMS) / PSIM Requirements

The Contractor shall provide a central management platform that provides a single, cohesive interface for operating all integrated subsystems.

5.3.1 Graphical User Interface (GUI): The Contractor shall provide a GUI that displays all system components as dynamic icons on multi-layered facility maps, providing real-time status and intuitive control.

5.3.2 Alarm Annunciation and Workflow: The Contractor shall configure the system to prioritize alarms and automatically execute pre-defined Standard Operating Procedures

(SOPs), presenting operators with step-by-step response checklists and associated video upon an alarm.

5.3.3 System Health Monitoring: The Contractor shall ensure the SMS continuously monitors the health of all system components and generates automated "trouble" alerts to administrators upon detecting a failure or communication loss.

5.3.4 Reporting and Logging: The Contractor shall provide a system capable of generating on-demand and scheduled reports. All operator actions must be logged in a secure, tamper-proof audit trail.

5.4 Intrusion Detection System (IDS) Performance

5.4.1 Probability of Detection (Pd): The Contractor shall ensure all IDS sensors have a Pd of at least 95% for specified threats.

5.4.2 Nuisance and False Alarm Rates (NAR/FAR): The Contractor shall ensure the system does not exceed a NAR of three alarms per month for interior sensors and three alarms per day for exterior sensors, and a FAR of one alarm per month for interior sensors and one alarm per day for exterior sensors.

5.5 Access Control System (ACS) Performance

5.5.1 Credentialing: The Contractor shall ensure the ACS is FIPS 201 compliant and uses the

DoD Common Access Card (CAC) as the primary credential.

5.5.2 Monitoring and Logging: The Contractor shall install Door Position Switches (DPS) on every controlled door and configure the system to generate and log alarms for "forced entry" and "door held open" events. All access events must be logged to create a complete audit trail.

5.5.3 High-Risk Area Control: The Contractor shall implement stringent access control for high-risk areas, including the pharmacy, medical supply storage, laboratories, and data centers.

5.6 Video Surveillance System (VSS) Performance

5.6.1 Image Quality: The Contractor shall provide cameras with a minimum resolution of HD

1080p and frame rates appropriate for the monitored scene, sufficient to meet specified detection, recognition, and identification goals.

5.6.2 Alarm Assessment: The Contractor shall configure the VSS to automatically display video from relevant cameras on the operator's monitor upon any IDS or ACS alarm.

5.6.3 Video Storage: The Contractor shall provide Network Video Recorders (NVRs) with sufficient capacity to retain all video for a minimum of 30 days of continuous recording.

5.6.4 Patient Privacy: The Contractor shall ensure camera placement is planned to monitor critical areas while respecting patient privacy and avoiding placement in patient rooms.

5.7 Installation, Testing, and Training

5.7.1 Installation: The Contractor shall perform all installation work in a professional manner, adhering to all applicable codes and standards.

5.7.2 System Acceptance Testing (SAT): The Contractor shall execute a government-witnessed SAT to demonstrate that 100% of the system's functions meet PWS requirements.

5.7.3 Training: The Contractor shall provide comprehensive training courses for ESS operators, administrators, and maintenance personnel on-site at NHB beginning at contract award and annually thereafter. As such, the Contractor shall prepare and deliver a training plan and materials to the Government in accordance with CDRL A002.

5.7.4 ESS Documentation: The Contractor shall deliver all “as-built” drawings, user manuals, and maintenance procedures for the ESS to the Government in accordance with CDRL A003.

5.8 Warranty

5.8.1 Warranty: The Contractor shall provide a minimum one-year warranty on all parts, labor, and software, commencing upon final government acceptance.

Commented [ED12]: When and how often?

Commented [C(13R12]: @Dang, Eric M CIV DHA DHN PACIFIC RIM (USA) maybe annually. As long as the current security team has sufficient training and SOPs, we should be able to perform pass down training.

Commented [ED14R12]: @Chacon, Joshua LTJG USN DHA BREMERTON NH (USA) sounds good. I adjusted the language. Please let me know what you think.

mailto:eric.m.dang2.civ@health.mil mailto:eric.m.dang2.civ@health.mil mailto:joshua.chacon5.mil@health.mil mailto:joshua.chacon5.mil@health.mil

PART 6

6.0 INFORMATION TECHNOLOGY & SECURITY

6.1 All work under this contract is unclassified.

6.2 The TIER 1 or TIER 2 levels and position sensitivity designation for positions under this contract is:

6.2.1 TIER II: Non-critical sensitive position.

6.3 Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal information requirements:

6.3.1. Data Sharing Agreements (DSAs): Contractors requiring access to PII, which includes

PHI, or access to de-identified data, are subject to the DHA Privacy and Civil Liberties Office

(DPCLO) (Privacy Office) Data Sharing Program. This program requires DHA to enter into

DSAs with parties outside the MHS who use or create MHS data. A DHA contract may use the term Data Use Agreement (DUA) rather than DSA. DSAs assure that outside parties protect MHS data in accordance with the Privacy Act and the HIPAA Rules. To apply for a

DSA, the Contractor submits a Data Sharing Agreement Application (DSAA) to the DHA

DPCLO. The Contractor submits the DSAA even if a subcontractor will be the party accessing

MHS data. After review and approval of the DSAA, the Privacy Office provides a DSA to the

Contractor for execution.

6.3.2. Processing Procurement Sensitive Information: All individuals shall seek guidance from the CO regarding the coordination of documents, dissemination, and transmission of procurement sensitive information. Procurement sensitive information shall not be transmitted electronically unless encryption is utilized. Depending on a particular procurement, other restrictions may apply.

6.4 Training: RESERVED.

6.5 Cybersecurity Requirements for Non-DoD IT or Covered Contractor IS:

6.5.1 The Contractor shall, at time of award, have implemented the security requirements prescribed in the National Institute of Standards and Technology (NIST) Special Publication

(SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information

Systems and Organizations” (available via the internet at http://dx.doi.org/10.6028/NIST.SP.800-171), in accordance with DFARS clause 252.204-

7012.

6.5.2 NIST SP 800-171 DoD Assessment Methodology. The DFARS provision 252.204-7019 introduces the “NIST SP 800-171 DoD Assessment Methodology” requirement. This requirement enables a strategic assessment of a Contractor’s implementation of the NIST SP

800-171 requirements as required in DFARS clause 252.204-7012. The DoD Assessment

Methodology requirement flows down to subcontractors.

6.5.2.1 Basic Assessment: The Contractor shall obtain and maintain access to the Supplier

Performance Risk System (SPRS) via the PIEE, (available via the internet at https://www.sprs.csd.disa.mil/)

6.5.2.1.1 The Contractor shall perform a Basic Assessment, using the NIST SP 800-171 DoD

Assessment Scoring Template, and enter the results electronically in SPRS for each covered

Contractor information system that is relevant to an offer, contract, task order, or delivery order. See Attachment 2, Deliverable Schedule Table.

6.5.2.1.2 The Contractor shall ensure that applicable subcontractors also have their results of a current assessment posted in SPRS prior to awarding a subcontract or other contractual instrument in accordance with DFARS clause 252.204-7020.

6.5.3 The Contractor shall provide the government with access to its facilities, systems, and personnel when necessary to conduct or renew a higher-level (i.e., Medium or High) assessment in accordance with DFARS clause 252.204-7020.

6.5.4 Cybersecurity Maturity Model Certification (CMMC): The CMMC (DFARS clause

252.204-7021) builds upon the NIST SP 800-171 DoD Assessment Methodology by adding a comprehensive and scalable certification element to verify the implementation of processes and practices associated with the achievement of a cybersecurity maturity level. The CMMC is designed to increase assurance to the DoD that federal contract information (FCI) and

DoD Controlled Unclassified Information (CUI) is protected at a level commensurate with the risk. The CMMC requirement flows down to subcontractors.

6.5.4.1 The Contractor shall have a current (i.e., not more than three years old) CMMC certificate in SPRS issued by an accredited CMMC Third Party Assessment Organization

(3PAO) at the required CMMC level. The description of CMMC levels is available at https://www.cmmcab.org/.

6.5.5 The Contractor shall submit requests to vary from NIST SP 800-171 in writing to the

CO or COR, for consideration by the DoD Chief Information Officer (CIO). The Contractor need not implement any security requirement adjudicated by an authorized representative of the DoD CIO to be non-applicable or to have an alternative, but equally effective, security measure that may be implemented in its place.

6.5.6 If the DoD CIO has previously adjudicated the Contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a https://www.sprs.csd.disa.mil/ https://www.cmmcab.org/ copy of that approval shall be provided to the CO or COR when requesting its recognition under this contract.

6.5.7 Cloud Computing: If the Contractor intends to use an external cloud service provider, on their behalf, to store, process, or transmit any DoD CUI in performance of this contract, the Contractor shall require the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization

Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/) and that the cloud service provider complies with requirements in paragraphs 6.5.8 through 6.5.14 for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

6.5.7.1 If the information is DoD CUI-specific (e.g., PII/PHI), then the Contractor shall ensure the external cloud service provider meet the security requirements equivalent to FedRAMP

High baseline.

6.5.8 Cyber Incident Reporting Requirement

6.5.8.1 When the Contractor discovers a cyber incident that affects a covered Contractor information system or the covered defense information residing therein, or that affects the

Contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the Contractor shall:

6.5.8.1.1 Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered Contractor information system(s) that were part of the cyber incident, as well as other IS on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the Contractor’s ability to provide operationally critical support;

6.5.8.1.2 In accordance with DFARS clause 252.204-7012, rapidly report (within 72 hours) cyber incidents involving DoD CUI to DoD Cyber Crime Center (DC3) via https://dibnet.dod.mil/portal/intranet/. In the event of a cybersecurity incident involving a

CUI-Specific breach (i.e., PII/PHI), the Contractor, in addition to reporting to the DC3, shall follow the incident reporting guidance prescribed in the TRICARE Operations Manual, Chapter 1, Section 5, “Compliance with Federal Statutes” at https://manuals.health.mil/

6.5.8.2 Cyber incident report: The cyber incident report shall be treated as information created by or for DoD and shall include, at a minimum, the required elements as prescribed at the https://dibnet.dod.mil/portal/intranet/.

https://www.fedramp.gov/ https://manuals.health.mil/ https://dibnet.dod.mil/portal/intranet/

6.5.8.3 Medium assurance certificate requirement: In order to report cyber incidents in accordance with this clause, the Contractor or subcontractor shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents. For information on obtaining a DoD-approved medium assurance certificate, see https://public.cyber.mil/

6.5.9 Malicious software: When the Contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to DC3 in accordance with instructions provided by DC3 or the Contracting Officer.

Do not send the malicious software to the Contracting Officer.

6.5.10 Media preservation and protection: When a Contractor discovers a cyber incident has occurred, the Contractor shall preserve and protect images of all known affected IS and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DoD to request the media or decline interest.

6.5.11 Access to additional information or equipment necessary for forensic analysis: Upon request by DoD, the Contractor shall provide DoD with access to additional information or equipment that is necessary to conduct a forensic analysis.

6.5.12 Cyber incident damage assessment activities: If the DoD elects to conduct a damage assessment, the CO will request that the Contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of DFARS clause 252.204-7012.

6.5.13 Apply other IS security measures when the Contractor reasonably determines that IS security measures may be required to provide adequate security in a dynamic environment or to accommodate special circumstances (e.g., HIPAA) and any individual, isolated, or temporary deficiencies based on an assessed risk or vulnerability. These measures may be addressed in a system security plan.

6.5.14 The Contractor shall maintain within the US or US territories all Government data that is not physically located on DoD premises, unless the Contractor receives written notification from the CO to use another location, in accordance with DFARS 239.7602-2(a).

6.5.15. The Contractor shall mitigate supply chain risk to the government by complying with

DFARS 252.239-7018 and only utilizing unified capability equipment identified on the DODIN

Unified Capabilities Approved Products List (https://aplits.disa.mil/processAPList), unless granted a waiver in accordance with DODI 8100.04, DOD Unified Capabilities (UC).

6.6 Risk Management Framework (RMF) for DoD IT: All IS, Platform Information Technology

(PIT) and IT Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with DoDI 8510.01, Risk Management Framework (RMF) for DoD IT and comply with annual Federal Information

Security Modernization Act (FISMA) security control testing. IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction (CNSSI) https://public.cyber.mil/ https://aplits.disa.mil/processAPList

1253, implement a corresponding set of security controls from the NIST SP 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

6.6.1 All systems subject to RMF must present evidence of authorization in the System

Security Plan, Security Assessment Report, a Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has a DoD RMF or equivalent DoD

Component PIT system accreditation decision that is current within 3 years within 5 business days of CO request. Evidence of FISMA compliance must be presented in the form of a POA&M. Systems must have and maintain an Authority to Operate (ATO) or Authority to Operate with Conditions (ATO-C) by contract award.

6.6.2 The Contractor shall implement security controls in accordance with NIST implementation and validation requirements specified in the NIST SP 800-37 Risk

Management Framework (RMF) and DoDI 8510.01, Risk Management Framework (RMF).

6.6.3 The Contractor shall configure the information system in accordance with Defense

Information Agency (DISA) Security Requirements Guides (SRGs) and security technical implementation guides (STIGs).

6.6.4 The Contractor shall ensure that the information system conforms to the requirements of DoDI 8551.01 “Ports, Protocols, and Services Management (PPSM).”

6.6.5 The Contractor shall ensure that the information system shall authenticate all entities as specified in DoDI 8520.03 “Identity Authentication for Information Systems” prior to granting access.

6.6.6 The Contractor shall Public Key (PK) enable the information system, implementing digital signature and encryption requirements specified in DoDI 8520.02, “Public Key

Infrastructure (PKI) and Public Key (PK) Enabling.”

6.6.7 The Contractor will be responsible for compliance with the Joint Force Head Quarters

– Department of Defense Information Network issuances and IA Vulnerability Management

(IAVM) issuances by ensuring that the issuances are assessed, implemented and maintained throughout development and sustainment in accordance with specified timelines.

6.6.8 The Contractor shall support reciprocity, by providing all directed information in NIST security documents to the Government.

6.6.9 The Contractor shall implement system level protection and detection capabilities that are consistent with their contract for NIST Security requirements that meet DoD and

DHA Cybersecurity Architectures.

6.6.10 Cyber Incident Reporting Requirement: The Contractor shall comply with the incident management requirements of Chairman of the Joint Chiefs of Staff Manual (CJCSM)

6510.01B, “Cyber Incident Handling Program.”

6.6.11 Information Security Continuous Monitoring (ISCM): ISCM is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. ISCM is a critical part of the risk management process to ensure that IS and PIT operations remain within an acceptable level of risk despite any changes that occur. The Contractor shall maintain ongoing monitoring, analysis and incident response procedures for all ARRT and PIT systems under this requirement in accordance with NIST SP 800-137.

6.6.12 The Contractor shall mitigate supply chain risk to the government by complying with

DFARS 252.239-7018 and only utilizing unified capability equipment identified on the DODIN

Unified Capabilities Approved Products List (https://aplits.disa.mil/processAPList), unless granted a waiver in accordance with DODI 8100.04, DOD Unified Capabilities (UC).

6.7. Facility Related Control Systems: The DHA’s Facilities Enterprise (FE) Program

Management Office (PMO) establishes the processes for acquisition, installation and sustainment of FRCS in DHA Facilities. Requirements for cybersecurity of FRCS are developed and specified by the FHA FE FRCS PMO. The scope of PIT and Control Systems within the DoD includes building control systems such as Heating Ventilation and Air

Conditioning, Utility Management Control System, Electronic Security Systems, Fire Alarm

Systems, and other assets. The application of IT cybersecurity strategies is migrating into

PIT and Control Systems in response to emerging threats. The requirements within this scope apply to all versions of Design-Build (DB); Design-Bid-Build (DBB); and facilities

Sustainment, Restoration and Modernization (SRM) projects as well as Initial Outfitting (IO) requirements activities.

6.7.1 Applicability: Contractors shall agree to the DHA Cybersecurity requirements as outlined for those project-specific FRCS Systems selected from Military Standard (MIL-STD)

1691, (https://home.facilities.health.mil/military-standard-milstd-1691-equipment) and identified in the DBB design process, D-B RFP development, SRM procurement documentation, or IO requirements unless an exception has been granted for a system by the Government prior to project award or procurement order issuance.

6.7.2 Cybersecurity Design: Failure to meet the design requirements may result in

Government non-acceptance of submittals or termination of the procurement delivery order for cause, in accordance with project documentation and FAR 52.212-4(m).

6.7.2.1 The Contractor shall comply with Unified Facilities Criteria (UFC) 4-010-06

Cybersecurity of Facility-Related Control Systems, UFGS 25-05-11 Cyber Security for Facility-

Related Control Systems, and referenced standards to develop a Cybersecurity program for their FRCS products to be installed in DoD facilities. The UFC system is prescribed by MIL-https://aplits.disa.mil/processAPList https://home.facilities.health.mil/military-standard-milstd-1691-equipment

STD 3007 and provides planning, design, construction, sustainment, restoration, and modernization criteria, and applies to the Military Departments, the Defense Agencies, and the DoD Field Activities in accordance with Under Secretary of Defense Acquisition, Technologies, and Logistics Memorandum dated 29 May 2002. UFC will be used for all DoD projects and work for other customers where appropriate.

6.7.2.2 Contractors shall comply with the National Information Assurance Partnership

(NIAP) Common Criteria Cybersecurity Evaluation and Validation Scheme (CCEVS) evaluation

(https://www.niap-ccevs.org) which is published on the NIAP-CCEVS Products Compliance

List. The NIAP-certified products have been assessed from a security perspective, helping to reduce the existence of potential vulnerabilities. Contractors are required to continually maintain their products, mitigate vulnerabilities, and distribute fixes to licensed users.

6.7.2.3 The Contractor agrees to comply with security regulations and guidance listed in

Attachment 3, Cybersecurity Regulations and Guidance, and all RMF requirements. The

Contractor shall establish appropriate administrative and technical safeguards to ensure the confidentiality, integrity, and availability of Government data under their control.

6.7.3 Funding of FRCS System/Device Requirements: Projects requiring new or replacement

FRCS, or upgrade/extension of existing devices/systems, employ either SRM, DB, or DBB acquisition strategies. Many FRCS are categorized as Real Property and are project funded.

Others are categorized through Military Standard 1691 as Personal Property (PP) requiring

IO funding. The IO effort should preferably, and where feasible, be embedded in the SRM, DBB or DB contract through Contract Line Items or another vehicle. This will optimize coordination of project-funded infrastructure design/construction with FRCS device/system design, installation, testing and commissioning. Where the project delivery team (PDT) determines that acquisition of PP devices/systems will be through IO action entirely separate to the SRM, DBB, or DB contract, the same RMF-related activities are required.

These activities shall be fully integrated into the project master schedule.

6.7.3.1 Pricing for Cybersecurity: If there are any additional costs associated with any element of the Cybersecurity lifecycle including a test/laboratory environment, the

Contractor shall provide those costs as follows:

6.7.3.1.1 All costs to assist the Government to achieve a new ATO and maintain it during the equipment’s warranty shall be included in the initial quote/offer price for SRM, and in the proposal for DB/DBB projects.

6.7.4 FRCS Cybersecurity Requirements: The Contractor shall provide a POC responsible for the cybersecurity of the Contractor device or system, throughout the lifecycle of the product. The Contractor shall provide Subject Matter Experts to support all assessments of contracted products and materials.

https://www.niap-ccevs.org/

6.7.4.1 The Contractor shall establish and utilize a test/laboratory environment that duplicates all Contractor fielded equipment/product that falls within the FRCS system/device authorization boundary. The Contractor shall ensure that all fielded equipment/product is maintained during the construction/installation period of performance, and for fifteen (15) years post acceptance or as long as the Contractor commercially supports the equipment/product, whichever is longer.

6.7.4.2 The Contractor’s test/laboratory environment shall be used to submit to the

Government, either through the RFP response, procurement order offer/quote, or construction submittal process, with all sections of the FRCS Risk Assessment Questionnaire and a Nessus vulnerability assessment report.

6.7.4.3 Contractors must provide a fully credentialed Nessus scan of the laboratory environment utilizing the DoD policy template with the submission. In addition, Nessus scans shall be provided within ten (10) days of a request from the Government POC to ensure a continuous monitoring program. Nessus scanner must be procured by the

Contractor, at their own cost, in order to comply with RMF requirements. The Contractor shall request the latest versions through the CO.

6.7.4.4 Contractors shall notify the assigned Government POC FRCS analyst of any updates/changes to the system and attain Government approval from the Military

Treatment Facilities (MTFs) Change Control Board prior to installation. This should include operating system updates/patches; Contractor application and database upgrades, updates, and patches; other software/firmware updates/patches; and addition/removal of components.

6.7.4.5 The Contractor shall comply with DoDI 8500.01 Cybersecurity, Enclosure 3, paragraph 9.b.(11), requiring all cybersecurity products and IA-enabled products that require use of the product’s cybersecurity capabilities will comply with the evaluation and validation requirements of Committee on National Security Systems Policy 11, National

Policy Governing the Acquisition of IA and IA-Enabled Information Technology Products, June 2013, as amended.

6.7.4.6 The Contractor shall comply with DoDI 8510.01, Enclosure 6, para 2.f(6)(a), ensuring systems must be reassessed for reauthorization prior to the Authorization Termination

Date. Government Program Offices or appropriate facilities organizations plan for this activity. The results of an annual cybersecurity review or a negative change to the system or environment at any time (i.e., a change increasing the residual risk) may result in a need for reauthorization prior to the regular three-year reauthorization.

6.7.4.7 If the FRCS is Internet Protocol capable, the proposed system shall be Internet

Protocol Version 6 (IPv6) capable or the Contractor shall provide a detailed project, migration or planning documentation to show when the proposed system shall be IPv6 capable. The Contractor shall be able to demonstrate or provide documentation to prove that their product is IPv6 capable.

6.7.4.7.1 Minimum IPv6 capabilities include:

(a) Conformant with the IPv6 standards profile contained in the DoD IT Standards Registry

(DISR);

(b) Maintaining interoperability in heterogeneous environments with IPv4;

(c) Commitment to upgrade as the IPv6 standard evolves;

(d) Availability of Contractor IPv6 technical support.

6.7.4.8 The Contractor shall notify the Government POC and CO POCs in writing with any inabilities to comply with DoD security requirements. The Contractor will provide anticipated costs and timelines required to address any vulnerabilities in question.

6.7.5 Post Award Requirements: Contractor provided network infrastructure components

(e.g. switches, routers, etc.) shall be standardized to the existing MTF network infrastructure where possible and shall be listed on the DoD Information Network Approved Products List

(APL) (https://aplits.disa.mil). Operating systems and firmware shall be the most current government approved version approved for infrastructure components, workstations, and servers.

6.7.5.1 As technology requirements change and compliance requirements transition, the

Contractor shall maintain their solution and incorporate new system/device capabilities and requirements into their proposed design. Contractors should at a minimum provide documentation that details what changes/requirements cannot apply to the current version and provide a schedule when the capabilities will be incorporated into future versions to ensure continued compliance and functionality.

6.7.5.2 The Contractor’s installed device or system shall pass pre-validation technical screening including fully-credentialed vulnerability scans utilizing Nessus, Security Content

Automation Protocol scans, and STIGs checklists within 6 months of construction submittal acceptance, or procurement contract award, and prior to related commissioning activity or acceptance testing. All resulting documentation will be provided by the Contractor to the

Government POC for review. The Contractor shall mitigate or remediate all Very High, High, and Moderate severity vulnerabilities discovered during the RMF Assessment process according to the associated POA&M.

6.7.5.2.1 Successful pre-validation technical screening must meet the Cybersecurity criteria listed below:

(a) No unmitigated Very High or High severity, vulnerabilities as described in the appropriate DISA STIGs located on https://public.cyber.mil/stigs/.

(b) No unmitigated Moderate severity, vulnerabilities described in the appropriate DISA

STIGs located on https://public.cyber.mil/stigs/.

(c) No unmitigated Very High or High severity vulnerabilities from Nessus vulnerability scans.

(d) No unmitigated Moderate severity vulnerabilities from Nessus vulnerability scans.

6.7.5.2.2 The Contractor will provide the following documentation on their system/device:

(a) Manufacturer name/model, version, and functionality description

(b) Product specifications

(c) Technology Architecture Diagram (System topology)

(d) Provide Hardware, Software, and Firmware Inventory

(e) Provide Ports Protocols and Services that are required for System functionality

(f) Provide a data flow diagram with detailed topology (include any required interfaces to other Systems)

(g) Complete a DD Form 2930, Privacy Impact Assessment

6.7.5.3 In DBB and DB contracts, the Contractor shall submit requests for the templates and any additional technical documentation through the standard RFI process. Completed documents shall be provided to the Government though the standard Submittal process for

Government Approval.