PWS FIAR AUDIT - Draft.pdf

Department of Defense Defense Health Agency

Performance Work Statement

Financial Improvement & Audit Remediation (FIAR) and Audit Services Support

Defense Health Network National Capital Region (DHN-NCR)

Date: January 8, 2025

PART 1

1.0 GENERAL INFORMATION

1.1 General: This is a non-personal services contract providing Financial Improvement & Audit Remediation (FIAR) and Audit Services Support for the US Department of Defense (DOD), Defense Health Agency (DHA), National Capital Region (NCR), Defense Health Network National Capital Region (DHN).

1.2 Description of Services: The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and non-personal services necessary to Financial Improvement & Audit Remediation (FIAR) and Audit Services Support services, except for those items specified as Government furnished property and services, as defined and in accordance with (IAW) the terms and conditions of the contract and the included PWS.

1.3 Background: The Defense Health Network National Capital Region (DHN-NCR) was established 1 October 2023 as the Defense Health Agency (DHA) transitioned from a market to a Defense Health Network (DHN) construct, aligning every Military Treatment Facility (MTF), including current standalone MTFs to nine (9) Flag Officer / General Officer (FO / GO) led DHNs. The DHN-NCR is the integrated health care delivery system of choice for those we are privileged to serve. The DHN-NCR consists of more than 12,000 staff members across 34 medical facilities and 11 dental facilities in the largest multi-service market serving active-duty service members and their family members, and eligible TRICARE beneficiaries.

The DHN-NCR is responsible for achieving DHA goals of driving positive audit outcomes, while improving business processes and efficiencies across the Military Health System (MHS).

DHN-NCR is responsible for preparing and responding to annual Defense Health Program (DHP) financial statement audits and implementing a Risk Management and Internal Controls (RMIC) program in accordance with the Office of Management and Budget (OMB) Circular A- 123, “Management’s Responsibility for Enterprise Risk Management and Internal Control” and Government Accountability Office (GAO) Standards for Internal Control in the Federal Government, GA0-14-704G "Green Book," September 10, 2015.

1.4 Objectives: The service objectives of this contract are to provide four primary goals: (1) Rigorously execute its progress on DHA FIAR goals and objectives through greater execution effectiveness, transparency, and compliance; (2) Prioritize and remediate audit and operational findings, strengthen internal controls and improve the performance of business operations; (3) Strengthen the deployment of RMIC Program with further integration of Enterprise Risk Management (ERM) principles across the network. (4) Through FIAR and RMIC Programs, further standardize core business operations to achieve improved network performance.

1.5 Scope: Contractor personnel must be able to support DHN-NCR and MTFs overall strategic development, integration, oversight, and execution of activities related to the FIAR Program and the RMIC Program, including program management and integration, audit strategy development and implementation, independent assessment of remediation activities and progress, monitoring and mitigation of mission critical risks and internal controls. Performance will require integration and coordination with relevant stakeholders, including all DHN-NCR and MTF Directors, DHA

Directorates and the DHP Independent Public Accountant (IPA) Auditor. In addition, expertise and coordination will be required with multiple DHN-NCR service providers.

1.6 The period of performance shall be for a one (1) Base Period of 12 - months and four (4) 12-month option year, as follow):

Base Period: February 26, 2025 through February 25, 2026 Option 1: February 26, 2026 through February 25, 2027 Option 2: February 26, 2027 through February 25, 2028 Option 3: February 26, 2028 through February 25, 2029 Option 4: February 26, 2029 through February 25, 2030

1.6 Administrative Specifications:

Place of Performance: The work to be performed under this contract shall be performed in the National Capital Region (Washington, DC, Maryland, Virginia). Contract personnel may be required to work at the Government’s designated MTF location located at 6000 Macarthur Blvd, Bethesda, MD 20816, Dalecarlia Office building, 8901 Wisconsin Ave, Bethesda, MD NSA Bethesda or 9300 DeWitt Loop Ft Belvoir, VA 22060

1.6.1 For work performed at sites other than the Government site, the individual personnel must provide services from their authorized telework worksite location in accordance with Department of Defense Instructions (DoDI) 1035.01, Telework Policy (http://www.dtic.mil/whs/directives/corres/pdf/103501p.pdf).

1.6.2 Situational Telework: For this requirement, situational telework is a discretionary alternative work arrangement. Situational telework is to be performed during the duty hours stated in the PWS. The terms and conditions of situational telework must be mutually agreed upon by the Government and the Contractor, and the Contractor must submit their telework policy for review/concurrence to the Government prior to approval. All situational telework must be approved, in writing, by the Government prior to the commencement of each situational telework instance by the Contractor employee.

1.6.3 Recognized Federal Holidays: The Contractor is not required to perform services on holidays.

New Year’s Day Labor Day Martin Luther King Jr.’s Birthday Columbus Day President’s Day Veteran’s Day Memorial Day Thanksgiving Day Independence Day Christmas Day Juneteenth Day

1.6.4 Hours of Operation: The Contractor is responsible for conducting business Monday through Friday, except Federal holidays or when the Government facility is closed due to local or http://www.dtic.mil/whs/directives/corres/pdf/103501p.pdf national emergencies, administrative closings, or similar Government directed facility closings.

The Contractor must always maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.6.5 Conduct: Contractor personnel shall adhere to standards of conduct as established by the DHA Commander.

1.7 Contractor The contractor will not be reimbursed for actual costs of travel. Costs for travel outside the NCR shall be billed in accordance with FAR 31.205-46 “Travel Costs,” which shall be approved by the Contracting Officer prior to any travel. Contractor travel costs shall not exceed the maximum per diem rates allowed at the time of travel consistent with the substantive provisions of the Federal Travel Regulation and the limitation of funds specified in this contract.

The contractor will not be compensated for any travel, including daily commuting and related daily travel expenses such as parking when serving at any locations within the NCR.

1.8 Other Direct Costs (ODC): TBD

1.9 Quality:

1.9.1 Quality Control (QC): The contractor shall develop and maintain an effective Quality Control Program (QCP) to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The contractor’s QCP is the means by which the assures that the work complies with the requirement of the contract. The QCP is to be delivered, i.e., within 30 calendar days after contract award. One copy of a comprehensive written QCP shall be submitted to the KO and COR within 5 working days when changes are made thereafter. After acceptance of the quality control plan the contractor shall receive the contracting officer’s acceptance in writing of any proposed change to his quality control system.

1.9.2 Quality Assurance: The government will evaluate the Contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the Contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.10 Contractor Personnel

1.10.1 Common Access Card (CAC) requirements: The Contractor shall complete or provide to the Government all information required per the DHA CAC request process, current version 2.1, January 2018, or more recent when updated. See process attached in Section Part 7.1.1 of the PWS. A CAC is the standard identification for eligible DOD Contractor personnel.

1.11.1.1 The contractor shall return all CACs to the COR upon the departure of the contractor(s).

1.11.2 Contractor onboarding and training. The contractor shall complete all requirements, training, and forms as prescribed in the following requirements:

1.11.2.1 The DHA’s “Onboarding Checklist for Contractor Employees” is located at the DHA Onboarding and Offboarding Portal at https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx

1.11.2.2 The DHA’s contractor training instructions embedded at Part 7 Section 7.1.2.

https://info.health.mil/sites/DOP/OnboardingCtr/Contractor_OnBoarding_Checklist.pdf and embed most up-to-date form in Part 7, Section 7.1.2.

1.11.2.3 The contractor shall comply with onboarding requirements of the DHA for contractors needing to be issued CAC identification, including DoD- and DHA-directed training and forms submission, prior to network access, as displayed in the In/Out-Processing Portal at:

https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx (note: Public Key Infrastructure (PKI)-restricted, printed versions available).

1.11.3 Type of Contract: The government will award a Firm-Fix Price contract for this requirement.

1.11.4 Security Requirements: This effort involves the contractor having access to Unclassified, Sensitive but Unclassified (SBU), and classified information/material. Interim Secret clearances may be authorized by the NCR PSO prior to being submitted to DHA NCR. All interim clearance requests will be justified and approved by the CIO prior to being submitted to OSEC.

Contractor personnel performing work under this contract must have a minimum of a secret clearance at time of the proposal submission and must maintain the level of security required for the life of the contract.

1.11.5 Physical Security: The Contractor shall be responsible for safeguarding all government equipment, information and property provided for Contractor use. At the close of each work period, government facilities, equipment, and materials shall be secured.

1.11.6 Key Control: The Contractor shall establish and implement methods of making sure all keys/key cards issued to the Contractor by the Government are not lost or misplaced and are not used by unauthorized persons. NOTE: All references to keys include key cards. No keys issued to the Contractor by the Government shall be duplicated. The Contractor shall develop procedures covering key control that shall be included in the QCP. Such procedures shall include turn-in of any issued keys by personnel who no longer require access to locked areas. The Contractor shall immediately report any occurrences of lost or duplicate keys/key cards to the

COR.

1.11.6.2 In the event, keys, other than master keys, are lost or duplicated, the Contractor shall, upon direction of the COR, re-key or replace the affected lock or locks; however, the Government, at its option, may replace the affected lock or locks or perform re- keying. When the replacement of locks or re-keying is performed by the Government, the total cost of re-keying https://info.health.mil/cos/admin/hr/IO/SitePages/Home.aspx https://info.health.mil/sites/DOP/OnboardingCtr/Contractor_OnBoarding_Checklist.pdf https://info.health.mil/cos/admin/hr/IO/SitePages/home.aspx or the replacement of the lock or locks shall be deducted from the monthly payment due the Contractor. In the event a master key is lost or duplicated, all locks and keys for that system shall be replaced by the Government and the total cost deducted from the monthly payment due the Contractor.

1.11.6.3 The Contractor shall prohibit the use of Government issued keys/key cards by any persons other than the Contractor’s employees. The Contractor shall prohibit the opening of locked areas by Contractor employees to permit entrance of persons other than Contractor employees engaged in the performance of assigned work in those areas, or personnel authorized entrance by the COR.

1.11.7 Lock Combinations: The Contractor shall establish and implement methods of ensuring that all lock combinations are not revealed to unauthorized persons. The Contractor shall ensure that lock combinations are changed when personnel having access to the combinations no longer have a need to know such combinations.

1.12 Key Personnel:

The personnel listed below are considered essential to the work being performed here under.

Prior to substituting, removing, replacing, or diverting any of the specified individuals, the Contractor shall notify the Contracting Officer 15 working days in advance and shall submit a written request and justification (including proposed substitutions) in sufficient detail to permit evaluation of the impact on this Contract. The proposed substitution of personnel must meet or exceed the education, experience, and other technical requirements of the personnel being replaced. No change in personnel shall be made by the Contractor without the prior written consent of the Contracting Officer. In the event the proposed substitution of key personnel does not meet or exceed the education, experience, and other technical requirements of the personnel being replaced, the Government reserves the right to require continued performance of previously approved key personnel or to require substitution of acceptable replacements for the individuals specified below.

Task # Position Minimum Qualifications 5.2-5.7 Program Manager Education: Bachelor’s degree in business administration, Health Care

Security Clearance:

Certification: PMP or CPA Experience: 10 + years of experience with MHS Processes and IT Systems

• 8 + years of experience performing risk management and process standardization within the MHS.

• 8 + years of Financial Improvement and Audit Readiness (FIAR) experience within the MHS

• 5+ years of experience performing process improvement, gap analysis and/or corrective actions.

• 5+ years of experience with developing and maintaining project schedules; tracking and monitoring the progress of project activities; reporting status, risks, and issues; and recommending adjustments to ensure the successful completion of projects.

• Experience applying Agile development life cycle methodologies, tools, and processes for schedule management, risk management, and requirements management.

• Experience performing financial and business analyses, risk management and performance management within the MHS or DoD

• Experience developing and facilitating high-impact presentations for senior leaders within the MHS or DoD

Non-Key Personnel

The personnel listed below are non-key personnel. However, non-key personnel are considered important and critical to the work being performed for the Department.

Task # Position Minimum Qualifications 5.4, 5.5 Level III Financial &

Actuarial Manager Education: Bachelor’s degree in accounting or business management related field from an accredited institution Security Clearance:

Certification: PMP, CPA, CISA, CDFM or CGFM certification Experience: 5 + years of experience with MHS Processes and IT Systems

• 5 + years of experience providing Financial Improvement and Audit Readiness (FIAR) support within the MHS or DoD

• 3 + years of experience performing risk management and process standardization within the MHS.

• Experience with and knowledge of Generally Accepted Accounting Principles (GAAP)

• Experience with OMB policies and procedures, such as A-136, A-123, etc.

• Working knowledge of the Financial Management Regulation (FMR)

• Experience with financial internal controls, processes, and systems.

• Experience developing Statement of Assurance (SoA) with the MHS or DoD

• Experience deploying process improvement with control and optimization strategies for substantiating continuous success with the MHS or DoD

• Experience with DoD audit readiness requirements and policies such as Financial Improvement and Audit Readiness (FIAR) and Federal Financial Management Improvement Act (FFMIA)

• Experience in assembling technical documents and providing detailed analysis of various business system functions within the MHS or DoD

• Experience with Microsoft Excel, PowerPoint, and Word

5.4, 5.5 Level I Financial & Actuarial Analyst

Education: Four (4) year degree from an accredited institution Security Clearance:

Certification: PMP, CPA, CISA, CDFM or CGFM certification Experience: 0 - 2 years of experience supporting DoD, Military Health, Federal Government agencies, and / or similarly sized organizations

• Experience with Generally Accepted Accounting Principles (GAAP)

• Knowledge of OMB policies and procedures, such as A-136, A-123, etc.

• Working knowledge of the Financial Management Regulation (FMR)

• Experience with financial internal controls, processes, and systems.

• Highly organized and detail-oriented with advanced ability to set priorities and to respond to changing demands from multiple sources in a fast-paced environment.

• Experience with Microsoft Excel, PowerPoint, and Word

5.3.4, 5.4.3, 5.4.4, 5.5.11

Level I Strategic & Communications Analyst

Education: Four (4) year degree from an accredited institution Security Clearance:

Certification:

Experience: 0 - 2 years of experience supporting DoD, Military Health, Federal Government agencies, and / or similarly sized organizations

• Knowledge of principles, methods, practices, and techniques of strategic communication, by selecting and using the appropriate communication tools to assist in facilitating and implementing a command information program.

• Experience developing strategic communications within the MHS or DoD.

• Experience with Adobe, Microsoft Outlook, Excel, PowerPoint, and Word

5.4.5, 5.5.6- 5.5.10

Level I Enterprise Performance Analyst

Education: Four (4) year degree from an accredited institution Security Clearance:

Certification:

Experience: 0 - 2 years of experience supporting DoD, Military Health, Federal Government agencies, and / or similarly sized organizations

• Organized and detail-oriented with advanced ability to set priorities and to respond to changing demands in a fast-paced environment.

• Experience with Adobe, Microsoft Outlook, Excel, PowerPoint, and Word

1.13 Reporting:

1.13.4 Contractor Manpower Reporting (CMR):

(a) The Contractor shall report all Contractor labor hours (including Subcontractor labor hours) required for performance of services provided under this contract via a secure data collection site. The Contractor is required to completely fill in all required data fields using the following web address: https://www.sam.gov/.

Reporting inputs will be for the labor executed during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year. The Contractor shall completely fill in all required data fields. The Contractor shall enter initial data into https://www.sam.govto establish the basic contract record no later than 15 business days after receipt of contract award or contract modification incorporating this clause. The Contractor shall notify the Contracting Officer when the basic contract record has been established in https://www.sam.gov.

(b) Contractors may direct technical questions to the help desk at: https://www.sam.gov.

Reference: Memorandum of Revised Department of Defense Contractor Manpower Reporting Initiative dated October 16, 2019, https://www.acq.osd.mil/dpap/cpic/cp/docs/New_Contractor_Manpower_Memo_16_Oct_20 19.pdf

1.13.5 Non-Disclosure Agreement (NDA): All DHA Government Contractor personnel who will obtain access to proprietary, classified, or confidential information or any information release of which is protected or governed by law or regulation associated with DHA acquisitions shall be required to complete and sign a DHA Contractor NDA (DHA Form 49) prior to beginning work on the subject contract. The Contractor shall execute an NDA on behalf of the company and shall ensure that all staff assigned to, including all subcontractors and consultants, or other personnel performing on contract execute an NDA protecting the procurement sensitive information of the Government and the proprietary information of other Contractors. The NDA shall be executed not later than five days of employment and to be renewed upon exercising a contract option period. Assignment of staff who has not executed this statement or failure to adhere to this statement shall constitute default on the part of the Contractor. The Contractor shall maintain originally signed NDAs of individual employees and provide and copy to the COR.

1.13.6 Contracting Officer Representative (COR): The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of http://www.sam.gov/ http://www.sam.govto/ http://www.sam.gov/ http://www.sam.gov/ http://www.acq.osd.mil/dpap/cpic/cp/docs/New_Contractor_Manpower_Memo_16_Oct_2019.pdf http://www.acq.osd.mil/dpap/cpic/cp/docs/New_Contractor_Manpower_Memo_16_Oct_2019.pdf contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.13.7 Post Award Conference/Periodic Progress Meetings: The Contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with Federal Acquisition Regulation Subpart 42.5. The KO, COR, and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings, the KO will apprise the Contractor of how the government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a contractor capacity in a Government facility is required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings. The contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is contractor support personnel.

Include a title block in all emails that states the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is contractor support personnel.

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order.

Contractor personnel shall make their contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16 Contractor Access to Health Affairs (HA)/DHA Network(s)

1.16.1 FSO/Company's Security POC shall notify the DHA Personnel Security Office after being awarded a contract that requires access to a DoD system (If applicable, if not delete 1.16.1 and 1.16.2 and replace to 1.16 Reserved). Contractor personnel requiring access to the HA/DHA networks for performance of their tasks require a background investigation and the security awareness training. The contractor shall be prepared for this process as it could take two (2) or more weeks. The FSO/Security POC shall submit a Standard Form (SF) 85/86 to DHA's Personnel Security Office for a background investigation.

1.16.2 Company’s FSO/Security POC must notify the Personnel Security Office when the contractor has submitted the SF-85/86. The FSO/Security POC, or the COR must notify the DHA Personnel Security Office in writing of a contractor's termination from the contract, including the termination date.

1.17 Personnel Security

1.17.1 The contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce Improvement Program, CH4” November 10, 2015 as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM

5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.17.1.1 Follow the DN7 or MTF Personnel Security Office guidelines for submittal of security clearances. Contact the DN7 or MTF Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DN7 or MTF Security Office can be reached at (301)366-2997.

1.17.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.17.1.3 DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing off on any access request.

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE

PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D- Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R- Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated, and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.2 Acronyms:

AIS Automated Information System APL Approved Products List APL AQL Acceptable Quality Level ARRT Acquisition Requirements Roadmap Tool ATO Authority to Operate B2B Business-2-Business CAC Common Access Card CAP Cloud Access Point CCEVS Common Criteria Cybersecurity Evaluation and Validation Scheme CDI Covered Defense Information CE Computer Environment CDRL Contract Data Requirement List

CIO Chief Information Officer CJCSM Chairman of the Joint Chiefs of Staff Manual CMMC Cybersecurity Maturity Model Certification CMR Contractor Manpower Reporting CNSSI Committee on National Security Systems Instruction CO Contracting Officer(s) CONUS Continental United States (excludes Alaska and Hawaii) COR Contracting Officer Representative COTR Contracting Officer's Technical Representative CSP Cloud Service Provider CSSP Cyber Security Service Provider CUI Controlled Unclassified Information DAD-A Deputy Assistant Director for Acquisition DC3 DoD Cyber Crime Center DD Form 254 Department of Defense Contract Security Requirement List (if applicable) DB Design-Build DBB Design-Bid-Build DFARS Defense Federal Acquisition Regulation Supplement DHA Defense Health Agency DISA Defense Information System Agency DoD Department of Defense DoDD Department of Defense Directive DoDI Department of Defense Instruction DSAs Data Sharing Agreements DSAA Data Sharing Agreement Application DMZ Demilitarized Zone DoDM Department of Defense Manual DPCLO DHA Privacy and Civil Liberties Office DUA Data Use Agreement eMSM Enhanced Multi-Service Markets EULA End User License Agreement EVM Earned Value Management FAR Federal Acquisition Regulation FCI Federal contract information FE Facilities Enterprise FedRAMP Federal Risk Authorization and Management Program FISMA Federal Information Security Modernization Act FRCS Facility Related Control Systems FSO Facilities Security Officer HA Health Affairs HIPAA Health Insurance Portability and Accountability Act HCA Head of the Contracting Activity HIT Health Information Technology IGCE Independent Government Cost Estimate IA Information Assurance IO Initial Outfitting

I/O In/Out Processing Portal IPv Internet Protocol Version IS Information System ISP Internet Service Provider IT Information Technology ISCM Information Security Continuous Monitoring IV&V Independent Verification & Validation MedCOI Medical Community of Interest MHS Military Health System MIL-STD Military Standard MTFs Military Treatment Facilities NCR National Capitol Region NDA Non-Disclosure Agreement NIAP National Information Assurance Partnership NIST National Institute of Standards and Technology OCONUS Outside Continental United States (includes Alaska and Hawaii) ODC Other Direct Costs OPM Office of Personal Management OSD Office of the Secretary of Defense P-ATO Personal Authorization to Operate P&R Personnel and Readiness PGI Procedures, Guidance, and Information PDT Project Delivery Team PHI Protected Health Information PII Personally Identifiable Information PIT Platform Information Technology PK Public Key PKI Public Key Infrastructure POA&M Plan of Action and Milestones POC Point of Contact PMO Program Management Office PoP Period of Performance PP Personal Property PPSM Ports, Protocols, and Services Management PRS Performance Requirements Summary PSP Personnel Security Program PWS Performance Work Statement QA Quality Assurance QAP Quality Assurance Program QASP Quality Assurance Surveillance Plan QC Quality Control QCP Quality Control Plan RFP Request for Proposal RFQ Request for Quotation RMF Risk Management Framework SP Special Publication

SPRS Supplier Performance Risk System SRM Sustainment, Restoration and Modernization SRG Security Requirements Guides STIG Security Technical Implementation Guides TOS Terms of Service US United States UFC Unified Facilities Criteria VPN Virtual Private Network XML Extensible Markup Language

2.3 Applicable Publications, DHA Administrative Instructions (AI), etc. Not Applicable.

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government:

☐ Will NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Government Furnished Services required in support of this contract/task orders. These Services are described below:

The Government may provide personnel to assist with locating, escorting, and directing Contractor personnel to the areas covered in this PWS.

3.2 Facilities: The Government:

☐ Will NOT provide Facilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Facilities in support of this contract/task orders. The Government provided Facilities are described below:

The Government will provide facilities required for contract performance. This encapsulates the necessary workspace for the contractor staff to provide the support outlined in the PWS to include desk space, telephones, computers, and other items necessary to maintain an office environment. Space used by contract employees in performance of services may be used for other purposes during their absence. Items of clothing, personal effects, or equipment cannot be secured during their absence. The Government will not incur any liability for theft, damage to, or loss of such personal items. Contract employees shall keep Government furnished supplies, equipment, and work areas in a safe, orderly, and clean condition. Contract employees shall notify the Government whenever maintenance of equipment is required. Contract employees shall abide by all MTF and Government requirements for physical security of Government property and equipment.

3.3 Utilities: The Government:

☐ Will NOT provide Utilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Utilities in support of this contract/task orders. The Government provided Utilities are described below:

The Government will provide all utilities in the facility available to the Contractor for the Contractor’s use in performance of tasks outlined in this PWS. The Contractor shall instruct employees in utility The Government will provide telephones, computers, and other items necessary to maintain an office environment and enable the contractor to provide the services needed. Items issued will remain the property of the Government and will not be removed from the hospital. They are to be used, turned in, or disposed of as directed. Telephones, facsimile machines, copiers, and computer equipment are authorized for transaction of official Government business only and shall not be used for personal business. Personal long-distance calls are not authorized, and the cost of all personal long-distance calls made may be deducted from the Contractor’s invoice payments. Telephones, facsimile machines, and computer equipment are subject to communications security monitoring at all timeliest conservation practices.

3.4 Equipment: The Government:

☐ Will NOT provide Equipment in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Equipment in support of this contract/task orders. The Government provided Equipment is described below:

The Government will provide telephones, computers, and other items necessary to maintain an office environment and enable the contractor to provide the services needed. Items issued will remain the property of the Government and will not be removed from the hospital. They are to be used, turned in, or disposed of as directed. Telephones, facsimile machines, copiers, and computer equipment are authorized for transaction of official Government business only and shall not be used for personal business. Personal long-distance calls are not authorized, and the cost of all personal long-distance calls made may be deducted from the Contractor’s invoice payments. Telephones, facsimile machines, and computer equipment are subject to communications security monitoring at all times.

3.4.1 Procurement Integrated Enterprise (PIEE), GFP Module Application The contractor shall be responsible for obtaining and maintaining access, training, and successful operation of the PIEE/GFP Module application for the entirety of the contract/task order PoP.

The PIEE GFP Module application is located at the following website: https://wawf.eb.mil/piee-landing/. Access to PIEE/GFP Module application training materials and in-depth information applicable to the contractor’s responsibilities regarding GFP can be found at the following website: https://dodprocurementtoolbox.com/.

Contracting Office Responsibilities:

The Contracting Office shall ensure close coordination and validation of the GFP items with the COR and DHA Accountable Property Officer prior to uploading the GFP Attachment into the PIEE/GFP Module. At the time GFP is anticipated and identified, the Government will upload the GFP Attachment into the PIEE/GFP Module. It is the Contracting Office’s responsibility to prepare, upload and maintain the GFP Attachment in the PIEE/GFP Module in accordance with the GFP Attachment instructions provided at the DoD Procurement Toolbox. The CO and COR shall manage and keep an inventory of any GFP associated with contract/task orders awarded https://wawf.eb.mil/piee-landing/ https://wawf.eb.mil/piee-landing/ https://dodprocurementtoolbox.com/ through DHA, in accordance with applicable FAR Part 45, DoD FAR Supplement (DFARS) 245 with respective clauses, DHA AI 095 and PD 45-01 following the change in disposition of items listed on that PIEE/GFP Module Attachment.

The contracting office will also review, acknowledge, reject and/or approve shipment orders provided by the contractor as appropriate. Functional roles can be determined within the Contracting Office and requested within the PIEE/GFP Module system.

Contractor Responsibilities:

A key contractor responsibility is to work with the CO and COR to ensure the PIEE/GFP Module data, to include the PIEE/GFP Attachment, provides a timely, complete, and accurate accounting of the GFP applicable to the contract/task order. Contractors are required to report the receipt of any GFP shipped to them, regardless of whether it is listed on the GFP Attachment for their contract. Similarly, contractors are required to utilize the GFP Module application in conjunction with the shipment of GFP to the Government, or in reporting Property Loss of GFP issued (such as destruction or loss). Discrepancies or disputes regarding property shipped to or shipped from the contractor must be reported via the GFP Module application, with the CO having authority over final designation of status.

The contractor shall report semi-annually 100% inventories, reconciliations, and final disposition of GFP provided by the government. Final invoices will not be paid pending GFP reconciliation.

Contractors shall be aware of and ensure compliance with applicable FAR Part 45, DFARS 245 and 252.245, Defense Pricing and Contracting Policies, Procurement Integrated Enterprise Environment Standards, DHA Administrative Instruction 094 and DHA Guidance.

3.5 Materials: The Government:

☐ Will NOT provide Materials in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ IS providing Materials in support of this contract/task orders. The Government-provided Materials are described below:

The Government will provide materials necessary for the contractor to perform these needed services.

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 Services: The Contractor:

☒ Will NOT provide Contractor Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Contractor Furnished Services required in support of this contract/task orders.

These Services are described below: provide

4.2 General: Not Applicable

4.3 Secret Facility Clearance: Not Applicable

4.4 Materials: Not Applicable

4.5 Equipment: Not Applicable

4.6 Facilities: Not Applicable

PART 5

5.0 SPECIFIC TASKS

Specific Tasks: The following constitute the tasks to be performed under this Performance Work Statement. The exact scope of actual subtasks required in a year can only be estimated. The Contractor shall provide Financial Improvement & Audit Remediation (FIAR) and Audit Services Support for the Defense Health Network National Capital Region.

5.1 Financial Improvement & Audit Remediation (FIAR) and Audit Services Support to multiple DHA organization: The contractor shall provide Program Management Support for the services provided under this contract. In order to meet this requirement, the contractor is required to provide:

• Provide General Accepted Accounting Principles (GAAP) support to (ERP) commercial and/or federal Healthcare organizations of similar size and complexity as the DHN-NCR

• Provide financial statement audits and examinations to organizations of similar size and complexity.

• Assist in remediating audit-related material weaknesses to help achieve and sustain a clean audit opinion at CFO act agencies, and publicly held companies, of similar size and complexity. Assist in advising and evaluating compliance with Federal “Green Book” and Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control—Integrated Framework

• Assist in internal management control program under DoD Instruction (DoDI) 5010.40, · “Managers' Internal Control Program Procedures

Experience of all Enterprise Resource Planning systems within the MHS

• Provide change and communication management for Audit, RMIC and transition items within the MHS/NCR

• Assist in NDAA implementation and impact to Defense Health Program

5.2 Focus Areas:

The DHN-NCR requires support with a deep understanding of Health Network-aligned technical domains, while also having the flexibility to respond to changes in priorities across a continually evolving mission. To provide mission critical resources and support across the DHN-NCR, the following support services are required for technical expertise, leading edge process, and specialized support for the specific needs of the DHN-NCR. DHN-NCR’s approach for structuring and sequencing this work promotes effective coordination and support of the DHA, while also optimizing limited Health Network resources. Support is required across multiple key focus areas including but not limited to:

5.2 Program Management: The contractor shall provide Program Management Support for overseeing the performance of all requirements under this PWS Program Management Support consists of, but is not limited to, the following:

• Responsible for completing contractor responsibilities associated with phase in, phase out transition periods, on and off boarding, invoicing, security, travel, personnel time off request, etc.

• Plan Site Assessment / Support Visits Coordination

• Responsible for Strategy Development and Governance, to support a recommended strategy or procedures that ensure effectiveness and compliance of actions taken.

• Contractor shall advise Executive Advisor Support

• Contractor shall ensure Agency personnel are knowledgeable and kept current about records management principles and requirements, Change Management and that they receive records management training appropriate to their needs.

• In-Progress Reviews (IPR). The contractor shall conduct a monthly, formal IPR to report overall project performance and contract status to the COR. The IPR shall discuss issues and recommend courses of action pertaining to tasks specified in the PWS. The IPR is intended to address information and issues at a higher level than the MSR (Monthly Status Report) and provides the contractor the opportunity to present and discuss topics that may require decisions by the COR and/or contracting officer. Following each IPR, the contractor shall prepare and distribute minutes with an Action Item Status Report. The contractor or COR may schedule additional formal and informal progress reviews/project briefings to discuss tasks and deliverables, address and eliminate potential issues, or for general discussions regarding the contract.

• Mandatory Contractor Manpower Reporting (CMR): The Contractor shall report ALL Contractor labor hours (including Subcontractor labor hours) required for performance of services provided under this contract via a secure data collection site. The Contractor is required to fill in completely all required data fields using the following web address https://sam.gov. Reporting inputs will be for the labor executed during the period of performance during each Government fiscal year (FY), which runs October 1 through September 30. While inputs may be reported any time during the FY, all data shall be reported no later than October 31 of each calendar year, beginning with 2025. Contractors may direct technical questions to the help desk at: https://sam.gov.

5.2.8 FIAR Program:

Assist in Audit & IPA Liaison and Audit & IPA Remediation. Attend Audit Training & Meeting Support, prepare and conduct training and report compliance. Estimate between 5- 8 training sessions per year and provide Executive Level Support/Metrics for the client. The contractor support shall utilize Microsoft (MS) Office to include MS PowerPoint, MS Word, MS Access, and MS Excel.

5.2.9 RMIC Program & DHN-NCR Compliance:

Contractor shall assist in the functions of this contract in addition to:

• Provide Risk Management and Internal Controls Implementation

• Provide Risk Management & Internal Controls Governance & Reporting – Statement of

Assurance

• Provide Risk Identification and Assessment

• Provide Risk Mitigation and Corrective Action Plan Development

• Provide Risk Monitoring & Testing

• Provide Risk Profile & Dashboarding

• Provide Fraud Risk Management Integration

• Provide Transitional Management Support

• Establish and maintain Business Process Improvement, Documentation & Standardization

• Provide on-going Sampling, Data Analytics, Special Projects

• Provide and maintain Strategic Communications, Change Management, and Training

5.2.10 Military Treatment Facility Support:

• Walter Reed National Military Medical Center (WRNMMC) Direct Support

• Alexander T. (AT) Augusta Military Medical Center Direct Support

The DHN-NCR requires support that possesses not only technical expertise, but also deep experience delivering value within the MHS. All mission support areas have mutual dependencies and must be closely coordinated throughout execution, utilizing specific relevant experience. The DHN-NCR would benefit from organizational capabilities across a wide range of skillsets to support the volume and complexity of this work. These skill sets include but are not limited to program management, supporting risk management activities, supporting financial statement audits, conducting audit remediation activities in the DHN-NCR business environment, experience supporting processes in DHN-NCR in conjunction with DFAS, experience building and executing OMB Circular A-123 Programs in Federal Agencies, and experience performing activities in Army-owned ERP systems.

5.3 Program Management:

The contractor shall provide support to assist the Government in designing and implementing disciplined, comprehensive, and flexible portfolio, program, and project management processes.

The Program Manager(s) will manage the contract staff and the Government Point of Contact will manage the Program Manager(s). Specific areas of support include but are not limited to:

• Proactively manage quality and integration of support across all key focus areas

• Develop briefs and executive planning sessions as needed by DHN-NCR leadership.

• Facilitate / support DHN-NCR Action Teams coordination and project plans execution.

• Monitor trends and focus areas across initiatives to identify gaps and potential points of coordination.

• Proactively identify, manage, and communicate key program risks and dependencies relevant to DHN-NCR support.

• Support the development, review and presentation of position papers and technical guidance on topics, as identified by DHN-NCR leadership.

• Prepare and adhere to a Quality Control Plan (QCP). The QCP will initially be submitted within 30 days of contract award and within 30 days of option period renewal. The QCP shall document how the Contractor will meet and comply with the quality standards established in this statement of work. At a minimum, the QCP must include a self-inspection plan, an internal staffing plan, and an outline of the procedures that the Contractor will use to maintain quality, timeliness, responsiveness, customer satisfaction, and any other requirements set forth in this solicitation.