RQI PWS.docx

Department of Defense Defense Health Agency Performance Work Statement

Resuscitation Quality Improvement (RQI-P GO) CPR Simulation and Competency Sustainment Services

White House Medical Unit

Medical Simulation

Solicitation Number:

Version:

Date:

PART 1

1.0 GENERAL INFORMATION

1.1 This is a non-personal services contract to provide RQI-P GO CPR Simulation, Competency Sustainment, and Learning Management Services.

1.2 Description of services/introduction: The contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform RQI-P GO CPR Simulation, Competency Sustainment, and Learning Management Services as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this PWS.

1.3 Background:

RQI Partners, LLC is a partnership between the American Heart Association and Laerdal Medical Corporation established to sell, service, and support the Resuscitation Quality Improvement (RQI) Program. The RQI portfolio is designed to support continuous improvement of resuscitation skills utilizing simulation learning stations, adaptive eLearning, performance feedback, analytics, and rolling electronic credential maintenance systems. The Defense Health Agency requires an enterprise commercial off-the-shelf solution capable of providing decentralized CPR skills sustainment and competency verification for healthcare personnel.

1.4 Objectives:

• Provide portable RQI-P GO simulation stations supporting decentralized clinical locations.

• Sustain BLS, ALS, and PALS competency utilizing low-dose, high-frequency training.

• Provide learner analytics, reporting, and electronic credential sustainment.

• Maintain operational readiness of CPR competency systems and learning platforms.

1.5 Scope: Commercial CPR simulation, competency sustainment, analytics, software licensing, and support services. Services include simulation learning stations, adaptive eLearning, HeartCode integration, learner management systems, quarterly competency verification, analytics, implementation services, and equipment support. The contractor shall accomplish continuous sustainment and verification of high-quality CPR readiness across DHA-supported healthcare personnel.

1.6 Period of Performance (PoP): One 12-month base period with four 12-month option periods.

1.6.1.1.1 The contractor shall comply with transition-in requirements of the DHA, as listed in paragraph 1.11.1, for contractors needing to be issued Common Access Card (CAC) identification, including Department of Defense (DoD) and DHA-directed training and forms submission, prior to network access.

1.7 Administrative specifications

1.7.1 Place of performance: The work shall be performed in Washington, DC.

1.7.2 Recognized Federal holidays: The contractor is not required to perform routine services on Federal holidays unless specifically authorized by the Government.

Independence Day

1.7.3 Hours of operation: The contractor is responsible for conducting business Monday thru Friday except Federal holidays or when the Government facility is closed due to local or national emergencies, administrative closings, or similar Government directed facility closings. The contractor must at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons.

1.8 Contractor travel: Contractor personnel may be required to travel within CONUS to support system activation, installation, implementation, maintenance, training, and sustainment activities at DHA-supported medical facilities. Contractor shall be authorized travel expenses consistent with the cost principles and procedures in Federal Acquisition Regulation (FAR) Part 31.2, Travel Costs and the limitations of funds specified in this contract. All travel requires Government approval/authorization and notification to the Contracting Officer Representative (COR). (For proposal purposes, a Not to exceed amount for travel can be established or you can include in your Independent Government Cost Estimate (IGCE) and the workload summary, a projected listing of travel locations to include frequency and number of persons required to travel so the offerors can provide pricing. If travel outside the CONUS will or may be required, then contact the Contracting Office for additional guidance, as specific language will be required within the PWS.)

1.9 Other Direct Costs (ODC): (If applicable) Other Direct Costs (ODCs) shall require prior approval by the Contracting Officer and may include authorized travel, shipping, replacement training materials, and implementation-related expenses.

1.10 Quality

1.10.1 Quality Control (QC): The contractor shall develop and maintain an effective QC program to ensure services are performed in accordance with this PWS. The contractor shall develop and implement procedures to identify, prevent, and ensure nonrecurrence of defective services. The contractor’s QC program is the means by which the work complies with stated requirements. Within 30 calendar days after contract award, the contractor shall submit a Quality Control Plan (QCP) to the Contracting Officer and COR., i.e., within 30 days after contract award or with the contractors proposal if it is an evaluation factor, a comprehensive written QCP shall be submitted to the CO and COR within 5 working days when changes are made thereafter.] After acceptance of the Quality Control Plan (QCP) the contractor shall receive the CO’s acceptance in writing of any proposed change to his QC system. See Part 7, Technical Exhibit 1 - CDRL A001.

1.10.2 Quality assurance (QA): The government will evaluate the contractor’s performance under this contract in accordance with the Quality Assurance Surveillance Plan (QASP). This plan provides a systematic method for the Government to evaluate performance and to ensure that the contractor has performed in accordance with the performance standards. It defines how the performance standards will be applied, the frequency of surveillance, and the minimum acceptable defect rate(s).

1.11 Contractor personnel: NOT APPLICABLE

1.13 Data rights: As between RQIP and Customer, all data obtained by RQIP from Customer through the provision of the Service, including all data results compiled by RQIP in providing the Service (“Customer Data”) is owned exclusively by Customer. Customer Data shall be considered Confidential Information subject to the terms of this Agreement. Customer grants RQIP, the American Heart Association and Laerdal Medical, an unrestricted, royalty-free, irrevocable license to maintain and distribute aggregated compilations of Customer Data (“Aggregated Data”) and to use such Aggregated Data for future studies and reports; provided, that the Aggregated Data will not reveal any personal information or the identity of Customer or any information in violation of FERPA (as defined below).

Learning Service Data. RQIP may access Customer's User accounts, including Customer Data, solely to respond to service or technical problems or at Customer's request. Customer agrees that RQIP may distribute certain Customer Data to support service, licensing and accreditation organizations for the benefit of Users. RQIP will release the minimum data required to adequately credit Users for educational activities completed.

1.14 Reporting: NOT APPLICABLE

1.14.1 Contractor Manpower Reporting (CMR): RESERVED.

1.14.3 Government’s COR: The COR monitors all technical aspects of the contract and assists in contract administration. The COR is authorized to perform the following functions: assure that the contractor performs the technical requirements of the contract; perform inspections necessary in connection with contract performance; maintain written and oral communications with the contractor concerning technical aspects of the contract; issue written interpretations of technical requirements, including Government drawings, designs, specifications; monitor contractor's performance and notifies both the CO and contractor of any deficiencies; coordinate availability of government furnished property; and provide site entry of contractor personnel. A letter of designation issued to the COR, a copy of which is sent to the contractor, states the responsibilities and limitations of the COR, especially with regard to changes in cost or price, estimates or changes in delivery dates. The COR is not authorized to change any of the terms and conditions of the resulting contract.

1.15 Contractor Identification

1.15.1 Contractor personnel performing services in a contractor capacity in a Government facility are required to possess and wear an identification badge that displays his or her name and the name of their company. All contractor personnel shall identify themselves as contractor support personnel in all forms of communication with all entities with whom DHA/Deputy Assistant Director for Acquisition (DAD-A)/Head of the Contracting Activity (HCA) has business dealings. The contractor shall: Answer all telephone calls and have a personalized voice message with an introductory statement that includes the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting the DAD-A understands that the person is contractor support personnel. Include a title block in all emails that states the fact that the person is contractor support personnel. Ensure all those with whom the person interacts in any face-to-face dealings while supporting DHA/DAD-A/HCA understands that the person is contractor support personnel.

1.15.2 Contractor personnel will be required to attend meetings or otherwise communicate with Government and/or other contract representatives to meet the requirements of this order. Contractor personnel shall make their contractor status known during introductions.

1.15.3 Contractor personnel, while performing in a contractor capacity, are prohibited from using their retired or reserve component military rank or title in any written or verbal communications associated with the contracts in which they provide services.

1.1.17 Personnel Security

1.17.1 The contractor shall comply with DoD 8570.01-M, “Information Assurance Workforce Improvement Program, CH4” November 10, 2015 as amended; 8500.01, “Cybersecurity”, dated March 14, 2014; DoD Manual (DoDM) 6025.18, “Implementation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule Compliance in DoD Health Care Programs” dated March 3, 2019, Department of Defense Instruction (DoDI) 6025.18 “HIPAA Privacy Rule Compliance in DoD Health Care Programs”, dated March 13, 2019; and DoDM 5200.02 “Procedures for the DoD Personnel Security Program (PSP),” incorporation change 3, effective September 24, 2020. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

1.17.1.1 Follow the DHA Personnel Security Office guidelines for submittal of security clearances. Contact the DHA Personnel Security Office for guidance on the appropriate background investigation required for personnel on the contract. The DHA Personnel Security Office can be reached at (703) 275-6038.

1.17.1.2 Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Controlled Unclassified Information (CUI).

1.17.1.3 DHA Personnel Security Office does not deny any access to any automated information system (AIS), network, or Controlled Unclassified Information (CUI). If a contractor receives an unfavorable background investigation, the request for access will be sent back to the FSO for further action. Any unfavorable adjudication will result in DHA Personnel Security Office not signing off on any access request.

PART 2

2.0 DEFINITIONS, ACRONYMS, AND APPLICABLE PUBLICATIONS/INSTRUCTIONS

2.1 Definitions:

2.1.1 Category D: Information Technology (IT) and Telecommunications Services (called D-Services)

2.1.2 Category R: Support (Professional/Administrative/Management) Services (called R-Services)

2.1.3 Contracting Officer (CO): A person with the authority to enter into, administer, and/or terminate contracts and make related determinations and findings.

2.1.4 Contracting Officer’s Representative (COR): An individual, including a contracting officer’s technical representative (COTR), designated and authorized in writing by the CO to perform specific technical or administrative functions. This individual does NOT have authority to change the terms and conditions of the contract.

2.1.5 Nonpersonal services contract: a contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control usually prevailing in relationships between the Government and its employees.

2.1.6 Quality Assurance Surveillance Plan (QASP): An organized written document specifying the surveillance methodology to be used for surveillance of contractor performance. The Government may either prepare the QASP or require the offerors to submit a proposed quality assurance surveillance plan for the Government’s consideration in development of the Government’s plan.

2.1.7 “RQI” means the Program portfolio as described in Section 2 and the subject of this Agreement.

2.1.8 “HeartCode” means the branded program, or its successors, which forms a part of the RQI Portfolio and delivers a program eLearning activity to enable learners to achieve a traditional AHA course completion ecard.

2.1.9 “System Activation” or “Activation” means the satisfactory installation of any equipment to be provided as a part of the Service, configuration of the learning platform, and proof that the system is operational evidenced by activation of systems for ten users.

2.1.10 Order Form means the ordering document representing purchase of any Services agreed to between the parties signed under this Agreement. The term “Order Form” also includes any subsequent document intended by the Parties to effect a change to the Service, such as a Change Order Form or Order Modification Form or Quotation.

2.1.11"Service" means all services ordered by the Customer to be included in RQI Order Forms that are subject of this Agreement.

2.1.12 "Users" means Customer's employees, consultants, contractors, clients or agents who are authorized to use the Service and have been supplied user identifications and passwords by Customer, or by RQIP at Customer's request.

2.1.13 “NRP” means the Neonatal Resuscitation Program of the American Academy of Pediatrics.

2.1.14 “NRP ILT Licenses” means licenses for the instructor led training program of the American Academy of Pediatrics NRP Program.

2.1.15 “Subscription” means the unit of purchase for the Resuscitation Quality Improvement portion of the Program and involves a recurring program of activity over the defined period of the Agreement.

2.1.16 “License” means the unit of purchase for HeartCode and NRP ILT portion of the Program and involves the participation in learning activities as a one time or single activity.

2.2 Acronyms:

2.3 Applicable Publications, DHA Administrative Instructions (AI), etc.

PART 3

3.0 GOVERNMENT FURNISHED PROPERTY, EQUIPMENT, AND SERVICES

The Requiring Activity Authority has assessed the need for Government Furnished Property, Equipment, and Services and determined:

3.1 Services: The Government:

☐ Will NOT provide Government Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Government Furnished Services required in support of this contract/task orders.

3.2 Facilities: The Government:

☒ Will NOT provide Facilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Facilities in support of this contract/task orders

3.3 Utilities: The Government:

☐ Will NOT provide Utilities in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Utilities in support of this contract/task orders. The Government provided Utilities are described below:

Electrical Outlets

3.4 Equipment: The Government:

☒ Will NOT provide Equipment in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ WILL provide Equipment in support of this contract/task orders.

3.5 Materials: The Government:

☒ Will NOT provide Materials in support of this contract/task order. As a result, this paragraph is Not Applicable.

☐ IS providing Materials in support of this contract/task orders.

PART 4

4.0 CONTRACTOR FURNISHED ITEMS AND SERVICES

4.1 Services: The Contractor:

☐ Will NOT provide Contractor Furnished Services in support of this contract/task order. As a result, this paragraph is Not Applicable.

☒ WILL provide Contractor Furnished Services required in support of this contract/task orders. These Services are described below:

1.1. System Activation – services to ensure that equipment installed at the Customer’s site is operational and that site administrators have been orientated to enable them to manage and operate the provided systems. An Activation Fee shall be included on the Order Form to cover such establishment charges.

1.2. Equipment Support – services to ensure that the provided equipment for the Service remains operational and functional. In the case of failure of equipment RQIP will, as far as commercially reasonable, undertake to repair or replace at its own discretion and expense within five working days of the reported failure.

1.3. Customer Support - standard telephone and online support to Customer’s Authorized Support Contacts during normal RQIP Support Hours (generally Monday-Friday, 8 a.m. to 8 p.m. and Saturday 10 a.m. to 6 p.m. Eastern time, except holidays), which are subject to change.

1.4. Software and Data Handling - use of commercially reasonable efforts to make the Service available 24 hours a day, 7 days a week, except for: (i) planned downtime; or (ii) any unavailability caused by circumstances beyond RQIP’s reasonable control, including acts of God, acts of government, flood, fire, earthquakes, acts of terror, strikes or other labor problems (other than those involving RQIP employees), computer, telecommunications, internet service provider or hosting facility failures or delays involving hardware, software or power systems not within RQIP possession or reasonable control, and network intrusions or denial of service attacks.

4.2 General: The contractor shall furnish all supplies, equipment, facilities and services required to perform work listed under Section 5 of this PWS.

Simulation Learning Stations- all equipment for skills simulation activities as provided on the Order Form (not including the use of any consumables required to operate the equipment). Except in the case of an out of box failure or product defect, Customer is responsible for replacing, where applicable, manikin faces and lungs, wipes, adult and infant bag, adult and infant clothing. Customer acknowledges that in receiving the Service it does not take title or ownership to any of the equipment provided for the Services under this Agreement.

4.4 Materials: The contractor shall The contractor shall furnish all consumable materials, replacement components, software updates, and training support materials necessary to support the RQI program., i.e., furnish materials, supplies, and equipment necessary to meet the requirements under this PWS.]

4.5 Equipment: The contractor shall The contractor shall furnish RQI-P GO simulation stations, associated hardware, adaptive learning software, tablet systems, feedback devices, and associated implementation equipment., i.e., furnish tractors, lighting and sound, containers, etc. to meet the requirements under this PWS.]

PART 5

5.0 SPECIFIC TASKS

5.1 The contractor shall provide skills learning activities for the practice of resuscitation skills using special simulation learning stations deployed at all locations.

5.2 The contractor shall provide Simulation Stations that include all necessary equipment to ensure completion of skills learning activities.

5.2 The contractor shall provide Knowledge and decision-making e-learning activities and may include interactive web-based and video content;

5.3 The contractor shall provide HeartCode Program an e-learning system which provides an alternative method of delivery of traditional AHA healthcare provider and course completion ecard;

5.4 The contractor shall provide a learning management system to ensure the suitable management of learning activities within, reporting and administration of the program of services delivered to the customer;

5.5 The contractor shall provide Debriefing of Case Performance to provide guidance on system improvement;

5.6 The contractor shall provide Rolling electronic eCredential maintenance system that maintains the electronic credential for Verified Competence, compliance documents for the Customer, and the validity periods;

5.7 The contractor shall provide Team Practice Activities that provide the opportunity for participants to engage with teams in the practice of resuscitation events. If Team Practice Activities are to be added to the service, additional terms and conditions of delivery of the service will be provided with the Order Form.

5.8 The contractor shall provide System Activation – services to ensure that equipment installed at the Customer’s site is operational and that site administrators have been orientated to enable them to manage and operate the provided systems. An Activation Fee shall be included on the Order Form to cover such establishment charges.

5.9 The contractor shall provide Equipment Support – services to ensure that the provided equipment for the Service remains operational and functional. In the case of failure of equipment RQIP will, as far as commercially reasonable, undertake to repair or replace at its own discretion and expense within five working days of the reported failure.

5.10 The contractor shall provide Customer Support - standard telephone and online support to Customer’s Authorized Support Contacts during normal RQIP Support Hours (generally Monday-Friday, 8 a.m. to 8 p.m. and Saturday 10 a.m. to 6 p.m. Eastern time, except holidays), which are subject to change.

5.11 The contractor shall provide Software and Data Handling - use of commercially reasonable efforts to make the Service available 24 hours a day, 7 days a week, except for: (i) planned downtime; or (ii) any unavailability caused by circumstances beyond RQIP’s reasonable control, including acts of God, acts of government, flood, fire, earthquakes, acts of terror, strikes or other labor problems (other than those involving RQIP employees), computer, telecommunications, internet service provider or hosting facility failures or delays involving hardware, software or power systems not within RQIP possession or reasonable control, and network intrusions or denial of service attacks.

5.12 Special Qualifications: Contractor personnel shall possess demonstrated experience supporting RQI systems, CPR simulation technologies, or equivalent healthcare resuscitation training platforms. Personnel performing installation or technical support shall possess manufacturer-authorized training or certification where applicable. Reference DOD COR Handbook (pages 137-138) and FAR 39.104]

PART 6

6.0 INFORMATION TECHNOLOGY & SECURITY

6.1 All work under this contract is unclassified.

6.2.1 TIER II: Non-critical sensitive position

PART 7, ATTACHMENT 1

PERFORMANCE REQUIREMENTS SUMMARY

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Performance Objective (The Service required—usually a shall statement from Part 5)

Performance Requirements Summary (PRS) # 1.

The contractor shall provide Skills learning activities for the practice of resuscitation skills using special simulation learning stations deployed at all locations;

PRS # 2

Simulation Stations that include all necessary equipment to ensure completion of skills learning activities;

PRS # 3

HeartCode Program an e-learning system which provides an alternative method of delivery of traditional AHA healthcare provider and course completion ecard;

PRS # 4

5 Learning management system to ensure the suitable management of learning activities within, reporting and administration of the program of services delivered to the customer;

PRS #5

6 Debriefing of Case Performance to provide guidance on system improvement;

PRS #6

7 Rolling electronic eCredential maintenance system that maintains the electronic credential for Verified Competence, compliance documents for the Customer, and the validity periods;

7.2 Other Attachments

Attachment 2, Deliverable Schedule Table (Paragraph 6.5.2.1.1)

Attachment 3, Cybersecurity Regulations and Guidance (Paragraph 6.7.2.3)

Attachment 4, FRCS Responsibility Matrix (Paragraph 6.7.5.3)

Attachment 5, Risk Assessment Timeframes (Paragraph 6.7.7)

PART 7, ATTACHMENT 6

ESTIMATED WORKLOAD DATA

PART 7, TECHNICAL EXHIBIT 1

DELIVERABLES SCHEDULE

CDRL A001 – Quality Control Plan

RQI-P GO Specific Performance Tasks

• The contractor shall provide RQI-P GO simulation stations and associated simulation hardware for decentralized CPR competency training.

• The contractor shall provide adaptive eLearning activities supporting BLS, ALS, and PALS competency sustainment.

• The contractor shall provide quarterly low-dose, high-frequency competency verification and learner assessment capability.

• The contractor shall provide rolling electronic credential maintenance and learner tracking.

• The contractor shall provide equipment support services, including repair or replacement of failed equipment.

• The contractor shall provide standard telephone and online customer support during normal support hours.

• The contractor shall provide system activation services, including installation, configuration, testing, and administrator orientation.

• The contractor shall provide analytics and reporting capability supporting competency measurement and program oversight.

• The contractor shall maintain commercially reasonable system availability and software support.

DHA PWS Template V13 November 16, 2021 image1.png image2.emf

Attachment 2-Deliverable Schedule Table.docx Attachment 2

DELIVERABLE SCHEDULE TABLE

Deliverable

Frequency

Medium/Format

Submit To

Appliable To

Basic Assessment

30 days prior to contract award, and annually thereafter 30 days before anniversary date during each option year

Electronic

COR via SPRS

6.5.2.1.1

CMMC

At time of award, and every 3 years thereafter 30 days before anniversary date during option period

Electronic

COR via SPRS

6.5.4 image3.emf

Attachment 3-Cybersecurity Regulations and Guidance.pdf

Attachment 3

Cybersecurity Regulations and Guidance

The Vendor shall use and comply with the most recent published versions of the following references, as well as all regulations or guidance referenced within those publications:

(a) United States Law

(i) The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

(ii) The Federal Information Security Management Act (FISMA)

(iii) The E-Government Act of 2002

(b) Office of Management and Budget (OMB)

The following publications are located at https://www.whitehouse.gov/omb/agency/default

(i) Circular A-130

(ii) Guidance M-05-24, Implementation of Homeland Security Presidential Directive

(HSPD) 12-Policy for a Common Identification Standard for Federal Employees and Vendors

(c) National Institute of Standards and Technology (NIST) The following publications are located at http://www.nist.gov/publication-portal.cfm

(i) NIST Special Publication (SP) 800-37 – Guide for Applying the Risk Management

Framework (RMF) to Federal Information Systems

(ii) NIST SP 800-39—Managing Information Security Risk: Organization, Mission and

Information System View

(iii) NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations

(iv) NIST SP 800-60—Volume 1 Revision 1: Guide for Mapping Types of Information and Information Systems to Security Categories

(d) Federal Information Processing Standards (FIPS) The following publications are located at http://www.nist.gov/itl/fipscurrent.cfm

(i) FIPS Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic

Modules

(ii) FIPS PUB 199 – Standards for Security Categorization of Federal Information and

Information Systems

(iii) FIPS PUB 200: Minimum Security Requirements for Federal Information and

Information Systems

(iv) FIPS PUB 201-2, Personal Identity Verification of Federal Employees and Vendors

(e) Department of Defense (DoD)

The following publications are located at http://www.dtic.mil/whs/directives/

(i) DoD Instruction 5200.2, DoD Personnel Security Program (PSP)

(ii) DoD Instruction 8500.1, Cybersecurity https://www.whitehouse.gov/omb/agency/default http://www.nist.gov/publication-portal.cfm http://www.nist.gov/itl/fipscurrent.cfm http://www.dtic.mil/whs/directives/

(iii) DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling

(iv) DoD Instruction 8510.01, Risk Management Framework Process (RMF)

(v) DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM)

(vi) DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs

(vii) DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in

DoD Health Care Programs

(viii) DoD Directive 5400.11, DoD Privacy Program

(f) The following publications are located at https://home.facilities.health.mil/low-voltage-system.

(i) DHA PM Standard Isolation Architecture for Cybersecurity of FRCS

(ii) Security Categorization for Facility-Related Control Systems (FRCS)

(iii) Facility-Related Control Systems (FRCS) Overlay

(iv) Standard Operating Procedure (SOP) for Facility-Related Control Systems (FRCS)

Assessments

(v) Guidance for Facility-Related Control Systems (FRCS) Continuous Monitoring https://home.facilities.health.mil/low-voltage-system image4.emf

Attachment 4-FRCS Responsibility Matrix.pdf

Attachment 4

FRCS Responsibility Matrix

Approval (A) [Final Approval Authority] Consulted (C) [In coordination with or makes recommendations]

1391 Concept, Planning & Development Identify the facility control systems required under the project R, A C I I X I I X Review Parametric Design via PDRS R, A I I I X I I X Preliminary categorize the systems/identify the CIA impact level C R A I X C C X Identify the System Owner and Authorizing Official C R A I X C C X Include budgetary line item for Cybersecurity $250 k/per system R, A C I I X I I X

Establish RMF Team, including USACE responsibility and assignments C R, A I I X C C X Include cybersecurity requirements in A/E SOW & include cybersecurity in contract evaluation R C,A I I X C C X Request Funds for Final Design R C,A I I X I I X

Design Determine if system is stand-alone or networked C C, A I R X C C X Prepare design in compliance with UFC 4-010-06 C, A I I R X I I X Develop list of relevant security controls C I I R X C C X Develop initial Sysytem Security Plan C C, A I R X C C X Provide final basis of design for inclusion into System Security Plan C, A I I R X I I X

Construction RFP Identify eMASS responsibilities of construction contractor R, A C I X I C C X Identify tasks/responsibilities/submittals of contractor R, A C I X I C C X

Construction Implement controls IAW Final Design C, A C I X R C C X Develop required submittals for approval C, A C I X R C C X Review contractor submittals and approve/disapprove/provide comments R, A C I X I C C X Conduct Nessus/SCAP scans, patch vulnerabilities, document remaining STIG deviations C C, A I X R C C X Submit request to NETCOM BidTracker website & select SCA-V (Army Only) C R, A I X C C C I Schedule SCA-V (*Needs to occur 12 Months out from OP need date) C R, A I X C C C I Develop continious monitoring strategy C R,C, A C X C C C I Complete controls self assessment C C I, A X R C C I Resolve issues identified in the self-assessment C C I, A X R C C I Complete eMASS requirements C R, A I X R C C I Assess security controls C C I X C C C R, A Track status of reviews, returns for rework and approval/disapprovals in eMASS C R,C, A I X R,C C C I Provide Security Assessment Report in eMASS I I I X I I I R, A Perform functional testing of the systems (*Full end-to-end testing will require limited duration ATO) C, A C I X R I I X

Re-Confirm RMF Team, including USACE responsibility and assignments C R, A I X I C C X Deliver all cybersecurity documentation and verify SO can log into their applications C, A C I X R C C X Verify the SA can login C, A C I X R C C X SA change all passwords on devices and in applications C R, A I X C C C X Request authority to connect C R C X C A C X Resolve issues identify by Network Provider C R I X C C, A C X

Authorize System Attend collaboration meeting with AODR C R C X X C C C Receive Decision from AO I I R,A X X I I C Perform full system acceptance testing C, A C I X R I I X

Monitor Security Controls Apply Continious Monitoring Strategy to system C R I, A X C C C X Updates and Patching C R,A I, A X X* C C X Decommission I R A X X* C C X

Post Construction and Warranty

MILCON Initiation & Development Phase

Roles-Responsibilities Matrix

Responsible (R) [Party responsible for task]

Le ge nd

NotesSC A-

V

De sig ne r o f R ec or d

Au th izi ng O ff ici al

Sy st em w ne r

U

SA

CE

P

DT

G6 /N

EC

/D

IM

Co ns tr uc to r C on tr ac to r

Informed (I) [Be informed of decision or status] IS

SM

/I

SS

SRM (O&M) RACI:

Approval (A) [Final Approval Authority] Consulted (C) [In coordination with or makes recommendations]

Manage Task Order Ensure Contractor provides required deliverables R C C C X Modify Task Order when required R C C C X Task Manager R C C C X Provide funding required to execute tasks C X R X X

System Design Determine if stand-alone or networked C I R C, A X Determine if child under parent ATO or stand-alone ATO C I C R, A X Define network configurations / architecture options available C R C C, A X Determine if hard server or virtualized C I C R, A X Define network configurations / architecture "allowable" C I C R, A X Develop Network Diagram C R I C, A X Develop Data Flow Diagram C R I C, A X

Cybersecurity Requirements Register System APMS C I R C, A X Register System eMASS C I R C, A X Categorize System (Requires Signed AO Approval Memo) C I R C, A X

Select Security Controls Apply CNNSI 1253 to determine System Classification C I R C, A X Apply DoD 800-53 Control Set I I R C, A X Apply DoD 800-53A Control Set I I R C, A X Determine Supplemental Controls I I R C, A X Import results from CSET into eMASS C C R C, A X Reach Agreed Baseline with customer / system owner C C R C, A X Determine all Data Types to be used in system, per RMF Guidance C C R C, A X Overlay Application and Selection C C R C, A X Import System Diagrams C C R C, A X Develop Monitoring Strategy C C R C, A X Finalize Control Set C C R C, A X Request Reciprocity Agreements from G6 C C R C, A X

Implement Security Controls Apply appropriate STIGs to system C R I C, A X Obtain Licensing for ACAS Server C C C R, A X Install Converged Security Scanning Server into lab environment C R C C X Gather existing system documentation from G6 C C R C X Develop Contingency Plan C C R C, A X Develop COOP Plan C C R C, A X Develop System Security Plan C C R C, A X Scan/Fix Process C R I I X Develop Security Assessment Report C R I I X Upload system documentation to eMASS C C R C X

Assess Security Controls Develop Security Assessment Plan C C C C X Submit Security Assessment Plan for approval C R C C, A X Prepare site for Validation team C C R C C Host Validation Team C C R C C Collaborate with Validation team to receive results from validation scan C R I C C Apply any necessary Scan/Fixes resulting from Validation Team C R I C C Prepare system POA&M C R I C X upload POA&M into eMASS C C R C X Prepare any final system documentation C R C C X Submit RMF Package to AODR C C R C X

Authorize System Collaboration meeting with AODR C I R C X Receive Decision from AO I I R C, A X

Monitor Security Controls Apply Monitoring Strategy to system I I R C X Updates and Patching I C R C X

Third Party Validation Documents and Reports Review I C I C R Scans & Test I C I C R Apply any necessary Scan/Fixes resulting from Validation Team I R I C C 3rd Party Recommendation to AO I I C C, A R

Request ATC I I R C, A X Authority to Connect (ATC) Process

Informed (I) [Be informed of decision or status] SC A-

V

Roles-Responsibilities Matrix

U

SA

CE

-P

DT

Co nt ra ct

Cu om er

Cu om er

G6

/N

EC

/D

IM

Notes

Responsible (R) [Party responsible for task] Le ge nd

Attachment 4

FRCS Responsibility Matrix

SRM (O&M) RACI:

image5.emf

Attachment 5-Risk Assessment Timeframes.pdf

Attachment 5

RMF ASSESSMENT TIMEFRAMES

Design-Bid-Build (DBB) Timeframes:

Lead Requirements DBB: Document Requirements Timeline Vend Contact Gov POC and requests templates and any additional cybersecurity technical documentation through the standard RFI process N/A

Within 30 days of construction contract award

Gov Provides templates and additional technical document RFI response

FRCS-RA, DoD Nessus policy templates, other cybersecurity templates/documents as requested

Within 15 business days post request

Vend Provides FRCS-RA and Nessus vulnerability assessment/report Submittal of test/laboratory System/device

Completed FRCS-RA and fully-credentialled DoD templated Nessus scan report.

Within 30 days of RFI response

Gov Cybersecurity System/device Kickoff Meeting (Government, Contractor, and Vendors)

Network configuration, architecture options, ATO status Contractor Memorandum for Record

10 business days post receipt of completed test/laboratory FRCS-RA and Nessus scans

Gov eMASS registration, Control Selection, Implementation Plan

Tasks, Responsibilities, and Submittals required of Vendor

5 business days post Cybersecurity Kickoff Meeting

Security Assessment Plan Review Meeting

Security Assessment Plan, RMF Templates, Categorization Memo, Applicable STIGs, Tasks, Responsibilities, and Submittals required of Vendor

Vend Provides Submittal of test/laboratory self-assessment matching the proposed System/device

Assessment boundary diagram;

data flow diagram; hardware inventory; software/firmware inventory; ports, protocols, and

Within 30 after Government

FRCS-RA for Government approval services (PPS); privacy assessment; completed STIG checklists; detailed fully-credentialled DoD templated Nessus scan report; SCAP scan report, POAMs, other as identified

Kickoff meeting

Gov Provides test/laboratory self-assessment Submittal responses (may result in re-iterations of self-assessment Submittal until accepted)

N/A 15 business day post receipt

Contracting Officer provides approval to proceed with installation

Upon approved self-assessment Submittal of test/laboratory

Vend Implements Controls;

Installs, integrates, secures, and documents the System/device that matches test/laboratory approved self-assessment configuration. N/A

Upon Contracting Officer Approval

Vend

Provides self-assessment Submittal of the installed System/device matching the test/laboratory for Government Approval detailed diagram with data flow;

hardware inventory; software and firmware inventory; ports, protocols, and services (PPS);

privacy assessment; completed STIG checklists; detailed fully-credentialled DoD templated Nessus scan report; SCAP scan report; POAMs, Continuous Monitoring plan, other as identified

Prior to any Commissioning or Acceptance Testing

Gov Provides installation self-assessment response (may result in re-iterations of self-assessment until accepted)

Gov ATO-Conditional recommendation submitted to 3rd party validator eMASS Security Plan and associated artifacts

Upon acceptance of installation

Vend Resolves Issues; (may result in re-iterations of self-

ATO-C Upon AO Approval

Gov Independent Verification and

Validation (IV&V) request

Upon ATO- Conditional of

Proceeds with scheduling Commissioning and Functional Acceptance Testing N/A

Upon approval

System/device

Submittal

Vend Transitions to IV&V;

maintains cybersecurity posture

Vendor remediation, Nessus and SCAP scan reports, resulting mitigations, and POAMs

Monthly reports until BOD

Completes successful IV&V and achieves ATO ATO

Within 18 months of or prior to BOD

Vend Performs full System Acceptance Testing N/A Upon ATO

Transitions to warranty support, maintenance, and continuous monitoring

Continuous monitoring:

IAVA vulnerability management, patching, updates, upgrades, Nessus/ACAS and SCAP reports, resulting mitigations, and POAMs Begins at BOD

Transitions to post-warranty patching, updates, upgrades, Nessus/ACAS and SCAP reports, resulting mitigations, and POAMs;

Reauthorizations when required

Post Warranty;

life cycle

Design-Build (DB) Required Timeframes:

Vend Contact Government POC requests updated templates and any additional cybersecurity technical documentation through RFI

RFI

65% Design Review

Gov Provides templates and additional technical document RFI response

FRCS-RA, DoD Nessus policy templates, other cybersecurity templates/documents as requested

Within 15

Nessus vulnerability assessment/report Submittal credentialled DoD templated Nessus scan report as Submittal

60 days post receipt of Corrected Final Design

Kickoff Meeting

30 business days completed test/laboratory

Security Assessment Plan, RMF Templates, Categorization Memo, Applicable STIGs, Tasks, Responsibilities, and Submittals required of Vendor

Provides Submittal of test/laboratory self-assessment matching the proposed System/device FRCS-RA for Government inventory; software/firmware inventory; ports, protocols, and services (PPS); privacy assessment; completed STIG checklists; detailed fully-credentialled DoD templated

Within 30 after Government

Kickoff meeting assessment Submittal responses (may result in re-iterations of self-assessment Submittal until accepted)

Contracting Officer provides

Upon final

Approved of self-assessment Submittal of test/laboratory and documents the System/device that matches assessment configuration N/A

Officer Approval

Submittal of the installed System/device matching the test/laboratory for Government Approval detailed diagram with data flow;

hardware inventory; software and firmware inventory; ports, protocols, and services (PPS);

privacy assessment; completed STIG checklists; detailed fully-credentialled DoD templated Nessus scan report; SCAP scan report; POAMs, Continuous

Prior to any Commissioning or Acceptance Testing

Upon acceptance

ATO-Conditional Upon SCA/AO

Upon ATO- Conditional of

Proceeds with scheduling Commissioning and

Upon approval

System/device

Vendor remediation Nessus and

Within 18 or prior to BOD patching, updates, upgrades, resulting mitigations, and POAMs Begins at BOD

Transitions to post-warranty patching, updates, upgrades, Nessus/ACAS and SCAP reports, Reauthorizations when required

Post Warranty;

Facilities Sustainment, Restoration and Modernization (SRM) Required Timeframes:

Lead Requirements SRM: Document Requirements Timeline Vend Contact Gov POC and requests templates and any additional cybersecurity technical documentation post award

Gov Provides requested templates and cybersecurity technical documentation

FRCS-RA, DoD Nessus templates, other cybersecurity documents as requested

15 business days

Nessus vulnerability report credentialled, DoD templated Nessus scan report.

25 business days completed test/laboratory

Security Assessment Plan, System Categorization, RMF Templates, Applicable STIGs. Contractor Memorandum for Record

Vend Provides test/laboratory self-assessment matching the

60 business days submitted System/device FRCS-RA for Gov approval inventory; software/firmware inventory; ports, protocols, and services (PPS); privacy assessment; completed STIG checklists; detailed fully-credentialled DoD templated

Gov Contracting Officer provides

Upon approved and documents the System/device that matches assessment configuration N/A

Officer notice to proceed submittal of the installed System/device for Gov

Boundary diagram; data flow diagram; hardware inventory;

software/firmware inventory;

ports, protocols, and services (PPS); privacy assessment;

completed STIG checklists; fully-credentialled DoD templated Nessus/ACAS report; SCAP report; POAMs, Continuous

Prior to acceptance testing post approved

ATO-Conditional Upon SCA/AO

Vend Proceeds with scheduling

Upon SCA/AO

N/A 5 business days post ATO-C

Vendor remediation Nessus and

Within 12 patching, updates, upgrades, resulting mitigations, and POAMs

Acceptance

Upon warranty expiration, Vendor transitions to post-warranty…