PWS_Siemens Maintenance 20260908.pdf

DHA PWS Template V13 November 16, 2021

Performance Work Statement

Siemens Maintenance Services

Landstuhl Regional Medical Center

Medical Device Sustainment

Solicitation Number:

HT9406-26-Q-E034

Version: 1

Date: 27 August 2026

PART 1

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide maintenance and repair services for

Landstuhl Regional Medical Center (LRMC) Siemens imaging equipment. Personnel rendering the service(s) are not subject, either by the contract’s terms or by the manner of its administration, to the supervisor and control usually prevailing in relationships between the Government and its employees.

1.2 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform maintenance and repair services on Siemens imaging equipment identified in Technical Exhibit C, except for those items designated as

Government-furnished property or services. As equipment is life-cycled, Technical Exhibit C may be updated to reflect the current equipment in use. Contractor personnel shall possess all manufacturer-required authorizations, training, credentials, tools, software, and access to

Siemens proprietary information necessary to perform the required services in accordance with manufacturer standards. The contractor shall perform all services to the standards set forth in this Performance Work Statement.

1.3 Background: LRMC utilizes Siemens imagining equipment to diagnose and determine patient care. To ensure the highest quality results, this equipment must be maintained and repaired.

1.4 Objectives: Ensure equipment on the equipment list in TECHNICAL EXHIBIT C is in a state of operational readiness, accurately calibrated and functioning in accordance with Original Equipment Manufacturing (OEM) technical and safety specifications.

1.5 Scope: Maintain and repair Siemens imagining equipment listed in TECHNICAL EXHIBIT

C, which may be updated as equipment is life cycled or moved to another facility within the local community. Services include OEM scheduled preventative maintenance, unscheduled routine service calls and emergency service visits. All parts provided by the contractor shall be covered by the terms and conditions of this contract. All work shall be performed in a professional manner by an authorized service representative. If any deficiencies are found due to the negligence of the service representative, the contractor will be required to correct the deficiency to a fully operational status in accordance with manufacturer specifications at no additional cost to the Government.

1.6 Period of Performance (PoP):

Base Year: 30 Sep 2026 – 29 Sep 2027

Option Year 1: 30 Sep 2027 – 29 Sep 2028

Option Year 2: 30 Sep 2028 – 29 Sep 2029

Option Year 3: 30 Sep 2029 – 29 Sep 2030

Option Year 4: 30 Sep 2030 – 29 Sep 2031

1.7 Administrative specifications

1.7.1 Place of performance: The work shall be performed at the LRMC CT Department, or, if updated, per the location listed on TECHNICAL EXHIBIT C.

1.7.2 Recognized Federal holidays:

U.S.A Holiday:

New Year’s Day Labor Day

Martin Luther King Jr.’s Birthday Columbus Day President’s

Day Veteran’s Day

Memorial Day Thanksgiving Day

Juneteenth Day Christmas Day

Independence Day

German Holiday:

New Year’s Day – January 1, Thursday

Good Friday – April 3, Friday

Easter Monday – April 6, Monday

Labor Day – May 1, Friday

Ascension Day – May 14, Thursday

Whit Monday – May 25, Monday

German Unity Day – October 3, Saturday

Christmas Day – December 25, Friday

Second Christmas Day – December 26, Saturday

1.7.3 Hours of operation: The contractor is responsible for conducting business Monday through Friday except for Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.7.4 Emergency Services: On occasion, services may be required to support an activation or exercise of contingency plans outside the normal duty hours.

1.8 Travel Contractor: Reserved

1.9 Other Direct Costs (ODC): Reserved

1.10 Quality

1.10.1 Quality Control (QC): The contractor shall develop and maintain an effective QC program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The contractor’s QC program is the means by which the work complies with stated requirements. The contractor’s proposed Quality Control Plan (QCP) shall be submitted to the Contracting Officer

(KO) through the Contracting Officer’s Representative (COR) for review 10 days after of contract award or 30 days prior to anticipated changes. After acceptance of the QCP the contractor shall receive KO’s acceptance in writing of any proposed change to the QC system. See Part 7, Technical Exhibit B - Deliverable A001.

1.10.2 Quality assurance (QA): The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.11 Reserved

1.12 Key personnel (Contractor): The contractor shall provide a contract manager who shall be responsible for the performance of the work. The name of this person and an alternate who shall act for the contractor when the manager is absent shall be designated in writing to the KO.

The contract manager or alternate shall have full authority to act for the contractor on all contract matters relating to daily operation of this contract. The contract manager or alternate shall be available between 8:00 a.m. to 16:30 p.m., Monday thru Friday except Federal holidays or when the government facility is closed for administrative reasons.

1.13 Reserved.

1.14 Reporting

1.14.1 Reserved

1.14.2 Reserved

1.14.3 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the KO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.14.4 Post award conference/periodic progress meetings: The contractor agrees to attend any post award conference convened by the contracting activity or contract administration office in accordance with FAR Subpart 42.5. The KO, COR, and other Government personnel, as appropriate, may meet periodically with the contractor to review the contractor's performance.

At these meetings the KO will apprise the contractor of how the government views the contractor's performance and the contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a contractor capacity in a government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom they have business dealings. The contractor shall ensure all those with whom the person interacts in any face-to-face dealings while supporting the Government understand that the person is contractor support personnel.

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order.

Contractor personnel shall make their contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.16 Reserved

1.17 Personnel Security

1.17.1 The contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce

Improvement Program, CH4” November 10, 2015 as amended; 8500.01, “Cybersecurity”, dated

March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance

Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care

Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA

Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM

5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. Contractor’s responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.17.1.1 Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security

Office can be reached at (314) 590-2039

1.17.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.17.1.3 DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing off on any access request.

1.18 Installation Access

1.18.1 Access to U.S. installations, buildings and controlled areas is limited to personnel who meet security requirements and are authorized by Host Nation to work in that country. Failure to submit required information/data and obtain required documentation or clearances will be ground for denying access to U.S. installations, building and controlled areas. The Contractor shall ensure that any subcontractors used in performance of this contract complies with these requirements and that all employees, of both the Contractor and any subcontractor utilized by the

Contractor, are made aware of and comply with these requirements.

The Contractor shall be aware of and comply with the requirements associated with Installation

Access Control. The Government is not liable for any costs associated with performance delays due soley to a firm’s failure to comply with Installation Access Control System (ISACS) processing requirements.

1.18.2 Upon completion, termination or cancellation of this contract, the Contractor shall collect all outstanding installation access passes and return to the issuing office within 5 business days (if applicable). See Part 7, Technical Exhibit B - Deliverable A002.

1.18.3 Installation access for U.S. Citizens. To receive an installation access pass or work on a

U.S. Government installation, a background check may be necessary dependent upon base access requirements. The installation security manager will determine the extent of background checks required. Should a contract employee receive an unfavorable background check and be denied installation access, the contractor shall send another contract employee to execute the required services.

1.18.4 Installation access for Local Nationals and Third Country Nationals. To receive an installation access pass or on a U.S. Government installation, a background check may be necessary dependent upon base access requirements. The installation security manager will determine the extent of background checks required. Base access passes require a favorable

Polizeiliche Fuehrungszeugnis to be provided to the COR and installation security manager.

Should a contract employee receive an unfavorable background check and be denied installation access, the contractor shall send another contract employee to execute the required services.

1.19 Operations Security (OPSEC) Requirements

1.19.1 Contractor personnel shall adhere to facility security policies and restrictions. The

Contractor shall immediately report suspicious activities to security personnel. Government issued access badges shall not be worn outside designated facilities where visible to the public.

1.20 Protection of Government and Contract Information

1.20.1 Per Public Use Notice of Limitations stated by Defense Imagery Management Operations

Center and contained at www.dimoc.mil/resources/limitations/, the Contractor shall not cite any information (e.g., contract information, pictures, locations, etc.) obtained through the performance of this contract on any hard copy or digital marketing tools to includes its company website.

1.21 Compliance Requirements

1.21.1 The Contractor shall comply with FAR 52.236-13, Accident Prevention, the references contained therein, and applicable Host Nation safety laws and regulations. The contractor shall also comply with all installation and Local National requirements governing safety and health protection on work sites and other applicable occupational safety codes.

1.21.2 The Contractor shall complete and provide safety notifications required by host nation authorities and will provide documented proof to the Contracting Officer via the COR, no later than 5 days that such notifications were made. See Part 7, Technical Exhibit B - Deliverable A003.

1.21.3 The Contractor shall ensure all its operations and activities conform to installation and

Host Nation environmental laws, regulations and policies. The Contractor shall ensure that all contract personnel have received appropriate levels of training in the handling, use, storage, and disposal of hazardous material as it pertains to this contract. If the contract requires the use of hazardous materials/substances, the Contractor shall, prior to arrival, inform the COR of the types and amounts of hazardous materials needed to be brought onto the installation in order to fulfill contractor requirements. The Contractor shall provide the Safety Data Sheets, storage requirements and proposed storage locations for the hazardous material. The COR shall provide a copy of this information to the appropriate departments. Prior to contract completion, the

Contractor shall remove all hazardous materials and dispose of all hazardous waste generated in accordance with Final Governing Standards Germany and applicable German environmental laws/standards. A copy of the hazardous waste disposal documents must be forwarded to the

COR. The Contractor shall clean up, at its own expense, any contamination, including soil and ground water contamination, caused by hazardous materials/substances brought onto the installation, or by Contractor activities. The Contractor must immediately report any hazardous substance spills to the COR.

1.21.4 The Contractor certifies that all electrical and electronic equipment and appliances furnished follow the Electromagnetic Compatibility Directive 2014/30/EU. For radio transmitting and telecommunication devices furnished in Germany, the Contractor certifies that all such items have been approved by the Bundesamt fuer Zulassungen. Any penalties for noncompliance imposed by the Government of the Host Nation or product liability claims caused by interference generated by furnished appliances or equipment are solely the responsibly of the

Contractor.

1.21.5 Contractors performing services in Germany shall comply with Germany law. The

Contractor shall determine whether performance requires registration with Germany authorities or authorization to do business in Germany and, if so, shall comply with all requirements.

Whether or not registration or authorization to do business is required, the Contractor shall determine what documents or authorization its employees and any subcontractor employees must http://www.dimoc.mil/resources/limitations/ possess to work in Germany. The Contractor shall ensure affirmatively that its employees and subcontractor employees possess such documents or authorizations.

1.21.6 Contractor employees who: (a) are not nationals of Germany or other European Union countries; (b) are not members of the force, the civilian component or their dependents; or (c)do not have assimilated status under Articles 71, 72 or 73 of the Supplementary Agreement to the

North Atlantic Treaty Organization Status of Forces Agreement shall possess work and residence permits.

1.21.7 By acceptance of and performance under this contract, the Contractor affirms that it has complied with the requirements above. Compliance with this requirement and Germany law is a material contract requirement. Noncompliance by the Contractor or subcontractor at any tier shall be grounds for issuing a negative past performance evaluation and terminating this contract for cause.

1.21.8 Contractor and subcontractor personnel performing work under this contract may receive, have access to or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.) or perform evaluation services which may create a current or subsequent OCI as defined in FAR Subpart 9.5. The Contractor shall notify the Contracting Officer immediately whenever it becomes aware that such access or participation may result in any actual or potential OCI and shall promptly submit a plan to the Contracting Officer to avoid or mitigate any such OCI. The Contractor’s OCI Mitigation Plan will be determined to be acceptable solely at the discretion of the Contracting Officer. In the event the Contracting Officer unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may affect other remedies as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI. See Part 7, Technical Exhibit B - Deliverable A004.

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE

PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Contracting Officer (KO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.2 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the KO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.3 Deliverable – means anything that can be physically delivered but may include non-manufactured things such as meeting minutes or reports.

2.1.4 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.5 Physical Security – means that part of security concerned with physical measures designed to safeguard personnel; to prevent unauthorized access to equipment, installations, material, and documents; and to safeguard against espionage, sabotage, damage, and theft.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The

Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the

Government’s plan.

2.2 Acronyms: (List all acronyms used in the PWS and what they represent. At a minimum, insert the acronyms provided below).

ACOR Alternate Contracting Officer’s Representative

AE Army in Europe

AQL Acceptable Quality Level

AR Army Regulation

AT Anti-terrorism

ATCTS Army Training Certification Tracking System

CAC Common Access Card

CFR Code of Federal Regulations

CDRL Contract Data Requirement List

CMR Contractor Manpower Reporting

CONUS Continental United States (excludes Alaska and Hawaii)

COR Contracting Officer Representative

COTR Contracting Officer's Technical Representative

CUI Controlled Unclassified Information

DA Department of the Army

DFARS Defense Federal Acquisition Regulation Supplement

DHA Defense Health Agency

DISA Defense Information System Agency

DoD Department of Defense

DoDD Department of Defense Directive

DoDI Department of Defense Instruction

DoDM Department of Defense Manual

DPCLO DHA Privacy and Civil Liberties Office

EULA End User License Agreement

FAR Federal Acquisition Regulation

FSO Facilities Security Officer

HA Health Affairs

HIPAA Health Insurance Portability and Accountability Act

HCA Head of the Contracting Activity

HIT Health Information Technology

IGCE Independent Government Cost Estimate

IA Information Assurance

KO Contracting Officer

MHS Military Health System

MIL-STD Military Standard

MTFs Military Treatment Facilities

NDA Non-Disclosure Agreement

OCONUS Outside Continental United States (includes Alaska and Hawaii)

ODC Other Direct Costs

OPM Office of Personal Management

OSD Office of the Secretary of Defense

PHI Protected Health Information

PII Personally Identifiable Information

POC Point of Contact

PMO Program Management Office

PoP Period of Performance

PP Personal Property

PRS Performance Requirements Summary

PSP Personnel Security Program

PWS Performance Work Statement

QA Quality Assurance

QAP Quality Assurance Program

QASP Quality Assurance Surveillance Plan

QC Quality Control

QCP Quality Control Plan

RFP Request for Proposal

RFQ Request for Quotation

SPRS Supplier Performance Risk System

SRM Sustainment, Restoration and Modernization

SRG Security Requirements Guides

STIG Security Technical Implementation Guides

TE Technical Exhibit

US United States

UFC Unified Facilities Criteria

USAG United States Army Garrison

USAREUR-AF United States Army Europe-Africa

VPN Virtual Private Network

XML Extensible Markup Language

2.3 Applicable Publications, DHA Administrative Instructions (AI), etc.

2.3.1 Army Regulation 40-61 Medical Logistics Policies

2.3.2 Army Regulation 750-1 Army Material Maintenance Policy

2.3.2 Installation Access Control AE Reg 190-16

2.3.3 The Army Physical Security Program AR 190-13

2.3.4 Contractor Identification AE Reg 27-715

2.3.5 U. S Army Corps of Engineers Safety and Health Requirements Manual EM 385-1-1

2.3.6 Information Assurance Workforce Improvement Program DoD 8570-M

2.3.7 Information Assurance Training Certification and Workforce Management Director DoDD

8570.01

2.3.8 Information Assurance AR 25-2

2.3.9 Electromagnetic Compatibility Directive (2004/108/EC)

2.3.10 Policies and Procedures for Property Accountability AR 735-5

2.3.11 Current Environmental Stewardship Policy (Command policy Number 11) is available at the

Garrison website:

https://home.army.mil/rheinland-pfalz/application/files/4716/0501/6392/CP_11_Environmental_Stewardship.pdf

2.3.12 Current Hazardous Waste Handling Policy (Garrison policy Number 10) is available at the Garrison website:

https://home.army.mil/rheinland-pfalz/application/files/6216/0501/8981/SOP_Hazardous_Waste.pdf

2.3.13 Current Refuse Collection and Recycling Policy is available at the Garrison Website https://home.army.mil/rheinland-pfalz/application/files/5616/0501/9038/SOP_Refuse_and_Recycling.pdf https://home.army.mil/rheinland-pfalz/application/files/4716/0501/6392/CP_11_Environmental_Stewardship.pdf https://home.army.mil/rheinland-pfalz/application/files/4716/0501/6392/CP_11_Environmental_Stewardship.pdf https://home.army.mil/rheinland-pfalz/application/files/6216/0501/8981/SOP_Hazardous_Waste.pdf https://home.army.mil/rheinland-pfalz/application/files/5616/0501/9038/SOP_Refuse_and_Recycling.pdf

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government:

X Will NOT provide Government Furnished Services in support of this contract. As a result, this paragraph is Not Applicable.

☐ WILL provide Government Furnished Services required in support of this contract/task orders. These Services are described below:

3.2 Facilities: The Government:

☐ Will NOT provide Facilities in support of this contract. As a result, this paragraph is Not

Applicable.

X WILL provide Facilities in support of this contract. The Government provided Facilities are described below: Workspace will be provided for service technicians, while onsite, to maintain and repair Siemens (MRIs, Gamma Cameras, Radiographic/Fluoroscopic, and

Radiographic/Fluoroscopic-Angiography/Interventional imaging equipment.

3.3 Utilities: The Government:

☐ Will NOT provide Utilities in support of this contract. As a result, this paragraph is Not

X WILL provide Utilities in support of this contract. The Government provided Utilities are described below: Electricity and water will be provided at the work site as needed.

3.4 Equipment: The Government:

X Will NOT provide Equipment in support of this contract. As a result, this paragraph is Not Applicable.

☐ WILL provide Equipment in support of this contract. The Government provided Equipment is described below:

3.5 Physical Security: The Contractor shall safeguard all Government equipment, information, and property provided for Contractor use. At the close of each work period, Government facilities, equipment, and materials shall be secured in accordance with Army Physical Security

Program (AR 190-13).

3.5 Materials: The Government:

X Will NOT provide Materials in support of this contract. As a result, this paragraph is Not

☐ IS providing Materials in support of this contract. The Government-provided Materials are described below:

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 Services: The Contractor:

☐Will NOT provide Contractor Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

X WILL provide Contractor with the Furnished Services required in support of this contract/task orders.

4.2 General: The contractor shall furnish all supplies, equipment, facilities and services required to perform work listed under Section 5 of this PWS.

4.3 Secret Facility Clearance: Reserved

4.4 Materials: The Contractor shall provide personnel protective equipment, supplies, materials and all other items required to perform required services.

4.5 Equipment: The Contractor shall provide all necessary vehicles and equipment to perform the work described in this PWS. Contractor’s vehicles and equipment used in the performance of this contract shall meet all local and Host Nation traffic, safety, and environmental requirements. Vehicles and equipment found to be unsafe shall be removed from the installation and replaced. The Contractor shall not use any Government owned tools, materials, or parts to maintain Contractor vehicles and equipment without prior written approval of the KO. The COR may inspect the Contractor’s vehicles and equipment at any time.

4.6 Facilities: Reserved

PART 5

5.0 SPECIFIC TASKS

5.1 Work Order Reception: The Contractor shall establish a Work Reception System for tracking all requests for routine/emergency services, preventative maintenance and maintaining active and historical workload records.

5.1.1 The Work Reception Desk (WRD) and telephone support shall be attended continuously during normal working hours, including lunchtime. The Contractor shall provide voice messaging service management and telephonic support in English. The Contractor shall return calls for repair service left on voice messaging services within 1 business day.

5.1.2 The WRD shall inform the KO through the COR on expected timelines for phone support, field service engineer on-stie time or expected delivery date of parts.

5.1.3 The Contractor shall notify the COR of the exact date and time, within 10 business days, prior to scheduled preventative maintenance services.

5.1.4 The Contractor service technicians shall provide remote support/troubleshooting, if the repair condition allows, over the phone when available to limit equipment downtime.

5.1.5 All Contractor representatives interfacing with the KO and COR shall be proficient in

English to effectively communicate.

5.1.6 All correspondence, service reports and invoicing shall be in English and clearly legible.

5.2.7 Receipt of services, and acceptance of invoices in WAWF, will be acknowledged after receiving all completed service reports for any services performed during the respective quarters.

Receiving reports will not be prepared and submitted until all such completed service reports containing all required information are in the possession of the COR.

5.2.8 The Contractor shall complete DD Form 2164 (X-Ray Verification/Certification Worksheet) in accordance with instructions provided in TB 38-750-2 if the equipment requires such documentation. A continuation sheet shall be attached to DD Form 2164 indicating the manufacturer, model, serial number and date of the calibration expiration of all items of test, measurement and diagnostic equipment used to perform the calibration.

5.2.9 If the Contractor’s calibration equipment produces a printed summary of the calibration procedure used, attach the printed summary to the DD Form 2164. Ensure the heading of the DD

Form 2164 is filled out and the form is properly signed.

5.2 Unscheduled Repairs: The Contractor shall respond to and resolve all equipment failures.

5.2.1 The Contractor service technician shall arrive on-site within five working days of a service request from the COR.

5.2.2 The repair shall be completed within two working days after the Contractor service technician arrives on-site. All repairs shall be in accordance with OEM standards. Any delay in gaining physical access to the equipment caused solely by Government administrative or security constraints shall temporarily halt the performance completion clock.

5.2.3 Prior to performing work, the Contractor service representative will report to the Clinical

Engineering Branch (LRMC, Bldg. 3760) and sign for a Visitor’s Badge. The badge must be returned to the Clinical Engineering Branch prior to departing LRMC.

5.2.4 The contractor shall obtain authorization from the COR, or alternate COR, prior to starting any repair that is attributable to instrument abuse and/or instrument misuse, theft, neglect, fire and anything else not covered in this contract. If these types of repairs are performed without the prior approval of the COR, or alternate COR, the contractor shall not be paid by the U.S. government. If approved, a separate purchase order shall be issued prior to performance.

5.2.5 The Contractor shall furnish all software updates issued by the OEM.

5.2.6 Within 5 business days after completion of services (scheduled and/or unscheduled), the

Contractor service technician shall prepare and initial a legible, preferably typed service report in

English and present it to the COR for signature. This report shall include the following information:

i. Services performed

ii. What systems or components failed (reason for call)

iii. Start date/time

iv. Completion date/time

v. Name of service technician

vi. Part numbers, nomenclatures, quantities and prices of replaced parts

vii. Travel time

viii. Repair time

ix. Travel, repair and parts cost

5.3 Preventative Maintenance Inspections: (The Government is responsible for releasing the equipment from clinical use to the Contractor at the scheduled maintenance start time)

5.3.1 Preventive Maintenance Inspections (PMIs) shall be performed in accordance with the

OEM’s standards and procedures. PMIs shall be accomplished by OEM schedules. PMIs shall be accomplished by a Contractor service representative that has completed the Siemens training course on the equipment listed in TECHNICAL EXHIBIT C prior to working on this equipment.

5.3.2 Safety shall be performed in accordance with NFPA 99, Chapter 7. This regulation can be reviewed in full text at the Equipment Management Branch. When required, the contractor’s service representative will comply with the Occupational Safety and Health Administration lockout/tagout standards while performing maintenance on equipment. The government and the contractor’s service representative will exchange hazard communication information before the commencement of any repair.

5.3.3 The PMI shall include, but is not limited to safety, calibration, completed operational testing, adjustments and cleaning of equipment to which the operator does not have access. It also includes installation of all parts required to ensure proper operation. During PMIs, the Contractor shall have access to all necessary diagnostic software. PMIs shall include cleaning, replacement of missing or defective parts, modules, covers, a complete inspection, an inspection or repair of cables, plugs and wiring, a thorough function test of the input and safety circuits, checking the topicality of the operator manuals and information and training of new personnel. The safety inspection shall include a mechanical check (examination of the casing, the readings, user interfaces, connections, cables, labeling, soiling that would affect safety, etc.) and function test, as services include written documentation of servicing, cleaning, adjustments, operational tests and calibration/verification in accordance with the OEM’s specifications and all applicable U.S. government and Army regulations. AR 40- 61 and AR 750-1

5.3.4 The Contractor shall provide all software updates issued by the OEM.

5.4 Replacement Parts Quality and Certification

5.4.1 All replacement parts utilized by the Contractor shall be new or OEM-authorized factory-refurbished exchange parts (as further detailed in Section 5.4.2). All parts must meet or exceed the

Original Equipment Manufacturer (OEM) design and performance specifications.

• For Radiation-Producing Equipment: Replacement parts must be certified in accordance with 21 CFR 1020.30.

• For Non-Radiation-Producing Equipment (e.g., MRI Systems): Replacement parts must be explicitly certified by the OEM (Siemens) or the authorized manufacturer as fully tested, calibrated, and compliant with all OEM operational standards prior to installation.

This regulation can be reviewed in full context at the Equipment Management Branch.

5.4.2 In place of new parts, factory refurbished exchange parts by the manufacturer’s spare parts procedures and policies may be used. The contractor’s representative shall inform the POC and request approval prior to the use of a refurbished part.

5.4.3 The contractor shall furnish a detailed listing of any replacement parts provided under the terms of this contract. This listing shall contain the part number, nomenclature, normal life expectancy and price and shall indicate whether the item is an exchange part.

PART 6

6.0 INFORMATION TECHNOLOGY & SECURITY

6.1 All work under this contract is unclassified.

6.2 TIER 2: Non-critical sensitive position.

6.3 Personally Identifiable Information (PII)/Protected Health Information (PHI), Procurement, and Federal information requirements:

6.3.1. Data Sharing Agreements (DSAs): Contractors requiring access to PII, which includes

PHI, or access to de-identified data, are subject to the DHA Privacy and Civil Liberties Office

(DPCLO) (Privacy Office) Data Sharing Program. This program requires DHA to enter into

DSAs with parties outside the MHS who use or create MHS data. A DHA contract may use the term Data Use Agreement (DUA) rather than DSA. DSAs assure that outside parties protect

MHS data in accordance with the Privacy Act and the HIPAA Rules. To apply for a DSA, the contractor submits a Data Sharing Agreement Application (DSAA) to the DHA DPCLO. The contractor submits the DSAA even if a subcontractor will be the party accessing MHS data.

After review and approval of the DSAA, the Privacy Office provides a DSA to the contractor for execution.

6.3.2. Processing Procurement Sensitive Information: All individuals shall seek guidance from the CO regarding the coordination of documents, dissemination, and transmission of procurement sensitive information. Procurement sensitive information shall not be transmitted electronically unless encryption is utilized. Depending on a particular procurement, other restrictions may apply.

6.4 Training - RESERVED

6.5 Cybersecurity Requirements for Non-DoD IT or Covered Contractor IS:

6.5.1 The contractor shall, at time of award, have implemented the security requirements prescribed in the National Institute of Standards and Technology (NIST) Special Publication

(SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information

Systems and Organizations” (available via the internet at http://dx.doi.org/10.6028/NIST.SP.800-

171), in accordance with DFARS clause 252.204-7012.

http://dx.doi.org/10.6028/NIST.SP.800-http://dx.doi.org/10.6028/NIST.SP.800-

6.5.2 NIST SP 800-171 DoD Assessment Methodology. The DFARS provision 252.204-7019 introduces the “NIST SP 800-171 DoD Assessment Methodology” requirement. This requirement enables a strategic assessment of a contractor’s implementation of the NIST SP 800-

171 requirements as required in DFARS clause 252.204-7012. The DoD Assessment

Methodology requirement flows down to subcontractors.

6.5.2.1 Basic Assessment: The contractor shall obtain and maintain access to the Supplier

Performance Risk System (SPRS) via the PIEE, (available via the internet at https://www.sprs.csd.disa.mil/)

6.5.2.1.1 The contractor shall perform a Basic Assessment, using the NIST SP 800-171 DoD

Assessment Scoring Template, and enter the results electronically in SPRS for each covered contractor information system that is relevant to an offer, contract, task order, or delivery order.

6.5.2.1.2 The contractor shall ensure that applicable subcontractors also have their results of a current assessment posted in SPRS prior to awarding a subcontract or other contractual instrument in accordance with DFARS clause 252.204-7020.

6.5.3 The contractor shall provide the government with access to its facilities, systems, and personnel when necessary to conduct or renew a higher-level (i.e., Medium or High) assessment in accordance with DFARS clause 252.204-7020.

6.5.4 Cybersecurity Maturity Model Certification (CMMC) (Reserved)

6.5.5 The contractor shall submit requests to vary from NIST SP 800-171 in writing to the CO or COR, for consideration by the DoD Chief Information Officer (CIO). The contractor need not implement any security requirement adjudicated by an authorized representative of the DoD CIO to be non-applicable or to have an alternative, but equally effective, security measure that may be implemented in its place.

6.5.6 If the DoD CIO has previously adjudicated the contractor’s requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the CO or COR when requesting its recognition under this contract.

https://www.sprs.csd.disa.mil/

6.5.7 Cloud Computing: If the contractor intends to use an external cloud service provider, on their behalf, to store, process, or transmit any DoD CUI in performance of this contract, the contractor shall require the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management

Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/) and that the cloud service provider complies with requirements in paragraphs 6.5.8 through 6.5.14 for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment.

6.5.7.1 If the information is DoD CUI-specific (e.g., PII/PHI), then the contractor shall ensure the external cloud service provider meets the security requirements equivalent to FedRAMP

High baseline.

6.5.8 Cyber Incident Reporting Requirement

6.5.8.1 When the contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the contractor shall:

6.5.8.1.1 Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident, as well as other IS on the contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the contractor’s ability to provide operationally critical support; and

6.5.8.1.2 In accordance with DFARS clause 252.204-7012, rapidly report (within 72 hours) cyber incidents involving DoD CUI to DoD Cyber Crime Center (DC3) via https://dibnet.dod.mil/portal/intranet/. In the event of a cybersecurity incident involving a CUI-

Specific breach (i.e., PII/PHI), the contractor, in addition to reporting to the DC3, shall follow the incident reporting guidance prescribed in the TRICARE Operations Manual, Chapter 1, Section 5, “Compliance with Federal Statutes” at https://manuals.health.mil/

6.5.8.2 Cyber incident report: The cyber incident report shall be treated as information created by or for DoD and shall include, at a minimum, the required elements as prescribed at the https://dibnet.dod.mil/portal/intranet/.

6.5.8.3 Medium assurance certificate requirement: In order to report cyber incidents in accordance with this clause, the contractor or subcontractor shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents. For information on obtaining a

DoD-approved medium assurance certificate, see https://public.cyber.mil/ https://www.fedramp.gov/ https://dibnet.dod.mil/portal/intranet/ https://manuals.health.mil/ https://dibnet.dod.mil/portal/intranet/ https://public.cyber.mil/

6.5.9 Malicious software: When the contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, submit the malicious software to DC3 in accordance with instructions provided by DC3 or the Contracting Officer. Do not send the malicious software to the Contracting Officer.

6.5.10 Media preservation and protection: When a contractor discovers a cyber incident has occurred, the contractor shall preserve and protect images of all known affected IS and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DoD to request the media or decline interest.

6.5.11 Access to additional information or equipment necessary for forensic analysis: Upon request by DoD, the contractor shall provide DoD with access to additional information or equipment that is necessary to conduct a forensic analysis.

6.5.12 Cyber incident damage assessment activities: If DoD elects to conduct a damage assessment, the CO will request that the contractor provide all of the damage assessment information gathered in accordance with paragraph (e) of DFARS clause 252.204-7012.

6.5.13 Apply other IS security measures when the contractor reasonably determines that IS security measures may be required to provide adequate security in a dynamic environment or to accommodate special circumstances (e.g., HIPAA) and any individual, isolated, or temporary deficiencies based on an assessed risk or vulnerability. These measures may be addressed in a system security plan.

6.5.14 The contractor shall maintain within the US or US territories all Government data that is not physically located on DoD premises, unless the contractor receives written notification from the CO to use another location, in accordance with DFARS 239.7602-2(a).

6.5.15. The contractor shall mitigate supply chain risk to the government by complying with

DFARS 252.239-7018 and only utilizing unified capability equipment identified on the DODIN

Unified Capabilities Approved Products List (https://aplits.disa.mil/processAPList), unless granted a waiver in accordance with DODI 8100.04, DOD Unified Capabilities (UC).

6.6 Risk Management Framework (RMF) for DoD IT: All IS, Platform Information

Technology (PIT) and IT Services or Products under this requirement, that receive, transmit, store, or process nonpublic government data must be accredited in accordance with DoDI

8510.01, Risk Management Framework (RMF) for DoD IT and comply with annual Federal

Information Security Modernization Act (FISMA) security control testing. IS and PIT systems must be categorized in accordance with Committee on National Security Systems Instruction

(CNSSI)

https://aplits.disa.mil/processAPList

1253, implement a corresponding set of security controls from the NIST SP 800-53, and use assessment procedures from NIST SP 800-53A with additional DoD-specific assignment values, overlays, implementation guidance, and assessment procedures as required.

6.6.1 All systems subject to RMF must present evidence of authorization in the System Security

Plan, Security Assessment Report) a Plan of Action and Milestones (POA&M) and authorization decision document or show that the system has a DoD RMF or equivalent DoD Component PIT system accreditation decision that is current within 3 years within 5 business days of CO request.

Evidence of FISMA compliance must be presented in the form of a POA&M. Systems must have and maintain an Authority to Operate (ATO) or Authority to Operate with Conditions

(ATO-C) by contract award.

6.6.2 The contractor shall implement security controls in accordance with NIST implementation and validation requirements specified in the NIST SP 800-37 Risk Management Framework

(RMF) and DoDI 8510.01, Risk Management Framework (RMF).

6.6.3 The contractor shall configure the information system in accordance with Defense

Information Agency (DISA) Security Requirements Guides (SRGs) and security technical implementation guides (STIGs).

6.6.4 The contractor shall ensure that the information system conforms to the requirements of

DoDI 8551.01 “Ports, Protocols, and Services Management (PPSM)”.

6.6.5 The contractor shall ensure that the information system shall authenticate all entities as specified in DoDI 8520.03 “Identity Authentication for Information Systems” prior to granting access.

6.6.6 The contractor shall Public Key (PK) enable the information system, implementing digital signature and encryption requirements specified in DoDI 8520.02, “Public Key Infrastructure

(PKI) and Public Key (PK) Enabling”.

6.6.7 The contractor will be responsible for compliance with the Joint Force Head Quarters –

Department of Defense Information Network issuances and IA Vulnerability Management

(IAVM) issuances by ensuring that the issuances are assessed, implemented and maintained throughout development and sustainment in accordance with specified timelines.

6.6.8 The contractor shall support reciprocity, by providing all directed information in NIST security documents to the government.

6.6.9 The contractor shall implement system level protection and detection capabilities that are consistent with their contract for NIST Security requirements that meet DoD and DHA

Cybersecurity Architectures.

6.6.10 Cyber Incident Reporting Requirement: The contractor shall comply with the incident management requirements of Chairman of the Joint Chiefs of Staff Manual (CJCSM) 6510.01B, “Cyber Incident Handling Program”.

6.6.11 Information security continuous monitoring (ISCM): ISCM is defined as maintaining ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions. ISCM is a critical part of the risk management process to ensure that IS and PIT operations remain within an acceptable level of risk despite any changes that occur. The Contractor shall maintain ongoing monitoring, analysis and incident response procedures for all ARRT and PIT systems under this requirement in accordance with NIST SP

800-137.

6.6.12 The contractor shall mitigate supply chain risk to the government by complying with

DFARS 252.239-7018 and only utilizing unified capability equipment identified on the DODIN

Unified Capabilities Approved Products List (https://aplits.disa.mil/processAPList), unless granted a waiver in accordance with DODI 8100.04, DOD Unified Capabilities (UC).

6.7. Facility Related Control Systems: RESERVED

6.8. System Communications - RESERVED

6.9 MHS Demilitarized Zone (DMZ) Medical Community of Interest (MedCOI)…