PWS Software Maintenance IBE Rev 1 .docx

Performance Work Statement (PWS)

William Beaumont Army Medical Center (WBAMC) Interface Interoperability Solution on 2 virtual servers

1. General: William Beaumont Army Medical Center (WBAMC) has a requirement to obtain critical implementation services to reinstitute the existing IntelliBridge Enterprise (IBE) interface interoperability solution on two new virtual servers to provide redundancy. The IBE Solution interfaces with MHS Genesis to import and monitor physiological readings/vitals.

2. Description of Services/Introduction: The contractor shall provide all personnel, supplies, facilities, transportation, materials, supervision, and other items to provide non-personal services at WBAMC as defined in this Performance Work Statement except for those items specified as government furnished property and services.

3. Background: The existing IBE solution interfaces with MHS Genesis to import physiological readings/vitals. The current WBAMC IBE server is experiencing connectivity issues with the MHS Genesis application and patient physiological readings are presently having to be entered into MHS Genesis manually creating potential for human error and inaccuracy.

4. Scope: The Contractor shall include all services required to rebuild failed instance of IBE server which includes redundancy system. The latest version of the physiological monitoring software will be reconfigured on new server(s). Contractor will provide phone and on-site technical assistance and emergency support services. Contractor will assist in ensuring that Philip's Cyber Security Authority to Operate (ATO) stays current and meets all cyber security elements to be able to utilize the government network.

1. Vendor shall provide services for installation and implementation of IBE software vB.20 on Windows Server 2019 environment.

2. Vendor shall provide services to coordinate manufacturing, delivery, installation

3. Implementation and field service engineer integration, installation, labor and equipment configuration.

5. Government COR and vendor will annually review the Equipment.

6. Government will provide Cyber Security assistance to maintain Vendor’s ATO status

5. Period of Performance: The period of performance shall be for one (1) base year of 12 months and 2 (two) option years:

6. Security: All contractor personnel are required to be identity proofed prior to entry onto the hospital medical campus and approved by and WBAMC Security Office. Additionally, all personnel accessing information systems shall have an IAT Level II Baseline Certification and shall complete the Annual Cyber Awareness Challenge Exam, the Health Insurance Portability and Accountability Act (HIPAA) and Privacy Act Training Course on Joint Knowledge Online (JKO).

7. Cyber Security: The contractor shall design, develop, and integrate Cybersecurity (CS) (to include, but not limited to, all hardware, software and/or equipment) IAW Department of Defense (DoD) standards, per. DoD 8500.01, 8510.01 and DoD 8530.01. Per the DoD 8500.01, all information technologies (IT) systems, also known as devices, communications, security and control systems are required to be assessed and authorized by an authorizing official (AO) via a formal authority to operate (ATO) utilizing the Risk Management Framework (RMF) process.

7.1 The IT systems and components provided for this facility by the contractor / vendor shall be able to obtain and maintain a favorable ATO using the RMF Process to all requisite Government networks. All network and communication equipment provided shall be listed on the unified capabilities approved products list (UC APL). Contractor shall work with the WBAMC and perform all cybersecurity activities associated with Appendix-10.1, Cyber Security (CS), of this PWS. The contractor shall provide CS that is IAW current policies, procedures, and statutes, to include (but not limited to) the following:

· Army Regulation (AR) 25-1, Army Information Technology

· Army Regulation (AR) 25-2, Information Assurance

· The Federal Information Security Management Act (FISMA)

· Committee on National Security Systems, Policy No. 11

· Federal Information Processing Standards

· Defense Information Systems Agency (DISA) Secure Technical Implementation Guides (STIGs)

· DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD (IT)

· DoD Directive 8140.01, Cyberspace Workforce Management

· NIST SP 800-37, RMF for Information Systems and Organizations

· NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations

7.2 All requirements in this document will be referenced by a single Not Separately Priced (NSP) Contract Line Item (CLIN) in the contract/order and shall be included in vendor’s pricing with no additional or separate charges.

The government will not enter into a Non-Disclosure Agreement (NDA) with the vendor. Federal law provides criminal prosecution of any Government employee disclosing confidential information, with or without an NDA (see 18 USC §1905).

If the vendor receives a delivery or task order under an ordering contract or a call order under a blanket purchase agreement, the vendor shall ensure that all devices provided under the scope of said contract maintain the appropriate security posture; the vendor shall not change versions without proper notification to both the program office responsible for device management, the contract agency, and the cyber security analysts. The vendor shall not make any delivery, nor receive payment prior to RMF approval on the updated version.

7.3 Warranty and Post-Warranty Service Maintenance Agreement RMF/Cybersecurity Requirements/Continuous Monitoring/Risk Management.

During the initial warranty period of the system, the vendor is responsible for ensuring a continued positive security posture through DHA mandated Continuous Monitoring activities. Continuous Monitoring requires software updates/upgrades, patch management, application of DoD required security configurations via Security Technical Implementation Guides (STIGs), vulnerability scanning, and remediation of discovered vulnerabilities.

Post warranty cybersecurity maintenance will be covered in subsequent Service Maintenance Agreements.

7.3.1 In accordance with SEC. 524B. of the ‘Consolidated Appropriations Act, 2023’ titled ENSURING CYBERSECURITY OF DEVICES, the vendor shall design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure, and make available post-market updates and patches to the device and related systems on a reasonably justified regular cycle, or as soon as possible for critical vulnerabilities that could cause uncontrolled risks. The vendor shall disclose if patching can be accomplished by the government, or if a specialized support is required to maintain a compliant cybersecurity posture.

7.3.2 The vendor shall establish and maintain a test/laboratory environment that includes all contract/ordered equipment, to include 3rd party components that fall under the authorization boundary, and/or included in this contract/order, to support the RMF/Cybersecurity requirements. The vendor test lab shall be used for all self-assessment activities, Independent Verification and Validation (IV&V) compliance testing, and post Authority to Operate (ATO), or RMF Approval (herein referred to as Approval) actions for as long as the system is supportable by the vendor. Supportable is defined as serviceable by a qualified Service Engineer or Original Equipment Manufacturer (OEM).

7.3.3 The vendor shall update all ATO or approved products required supporting documentation in the event of a system policy, procedural, logical, or technical change to the system or device.

7.3.4 The vendor shall maintain the authorized security configuration and notify the government for approval prior to instituting changes to devices installed within the DHA network. A major upgrade such as major software or hardware revision must be reassessed for RMF Compliance, or addition to the approved products list. Minor upgrades must be assessed by the Government to determine if a reauthorization is required. The vendor shall support reauthorizations due to both major and minor upgrades.

7.3.5 The vendor shall ensure its device or system is in compliance with the DoD IAVM program upon each deployment.

7.3.6 The vendor shall ensure any deployment post acceptance (including rebuilds) deploys with a fully-patched, approved version. Prior to final acceptance and installation, the vendor shall coordinate running Nessus and SCAP scans, or the vendor prescribed alternative procedures required to validate the configuration, with the site and the assigned DHA Cybersecurity Analyst to verify compliance. Any deviations from the approved configuration shall require the vendor to bring the system into compliance prior to final acceptance and putting the system in operation.

7.3.7 The vendor shall maintain the system or device and update to comply with updated STIGs made available by the Government within three (3) months of notification by the Government.

7.3.8 The vendor shall provide vulnerability and configuration scan results using Nessus and the DHA policy to the Government monthly, providing raw scan results and administrative reports no later than the tenth (10th) calendar day of each month.

7.3.9 The vendor shall close all discovered vulnerabilities or shall submit to the Government for approval POA&Ms outlining mitigation and timelines for closing any open vulnerabilities within one (1) month of discovery.

7.3.10 The vendor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to the Government for approval.

7.3.11 The vendor shall use the Government-approved method for remote access administration (DHA B2B) of the system or device.

8. Information Assurance (IA) Requirements:

8.1 AT Level I Training. All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities, controlled access areas, or require network access, shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. Upon request, the contractor shall submit certificates of completion for each affected contractor

8.2 Access and General Protection/Security Policy and Procedures. All contractor employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation/facility access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any installation or facility change, the Government may require changes in contractor security matters or processes.

9. SAFETY

9. 1 The Contractor shall comply with the latest version of U.S. Army Corps of Engineers (USACE) Safety and Health Requirements Manual 385-1-1, https://www.usace.army.mil/Missions/Safety-and-Occupational-Health/Safety-and-Health- Requirements- Manual/, including any updates and interim revisions, in effect at the time of the solicitation.

9.2 The Contractor shall report to the COR, immediately, any mishaps in accordance with EM 385-1-1 Section 01.D.

10. Warranty and Customer Service Support: Software, videos modules, and installations warranty shall be at least one year after award.

10. 1 Software Service Support

10.1.1 IBE SMA Standard: Software Maintenance Agreement IBE will include Upgrades and Updates with implementation for every software upgrade and every update on your current revision (remotely).

10.1.2 Remote software technical support 24 x 7, (excluding holidays).

10.1.3. On-Site software escalation support Monday through Friday, 08:00 through 17:00 (local time) next business day are also included (if issues cannot be resolved remotely)

10.2 Video modules Interface Support.

10.2.1. Vendor shall support the DICOM and HL7 communication to and from the Equipment, as they exist at the Site at the time of installation. If the vendor’s interoperability mapping engine, or biomedical device is upgraded to the latest version, vendors will restore the inbound /outbound communication to the pre- upgrade condition with like-for-like parameters.

10.2.2 Remote technical support 24 x 7, (excluding holidays).

10.2.3. On-Site escalation support Monday through Friday, 08:00 through 17:00 (local time) next business day are also included (if issues cannot be resolved remotely)

10.3 Software Versions and Updates.

If a software version or update is available for the Equipment, the Vendor shall upgrade the Equipment application software accordingly by notifying the Government COR prior to updating. The updates shall be at no additional cost to the government.

11. Place of Performance: The primary place of performance will be at the following location:

12. WBAMC On-site support hours: Contractor shall provide services from 0800-1700MST, Monday thru Friday excluding Federal Holidays as designated below: