Solicitation Attachment 1 - MDE PMO Cybersecurity_RMF Requirements.xlsx
XLSX spreadsheet 30 KB Posted
- Attached to
- Enterprise Dose Monitoring
- Solicitation number
- HT942726RE017
- Issued by
- Not on record
About this file
This is a vendor submission form outlining the government's minimum requirements and objectives for cybersecurity and Risk Management Framework (RMF) compliance under the Enterprise Dose Monitoring solicitation (HT942726RE017) for the Defense Health Agency.
Vendors must demonstrate compliance across 19 requirement areas addressing critical security and supply chain controls. Key technical requirements include: obtaining and maintaining RMF Authority to Operate (ATO) approval; completing Joint Medical Device Equipment Risk Assessment Questionnaires for all system components; providing current Nessus vulnerability scans completed within 30 days of submission; ensuring operating systems and major software applications have minimum 36 months before end-of-life with upgrade plans for those falling short; implementing FIPS 140-2 encryption for protected health information; establishing policies to deploy critical security patches within 15 calendar days; and maintaining individual user accounts with DoD-compliant password complexity. Vendors must also provide comprehensive Hardware and Software Bills of Materials (HBOM/SBOM) consistent with CISA frameworks, identify any components sourced from Foreign Adversary Countries, demonstrate secure development practices per NIST SP 800-218, and establish change management procedures with COR notification requirements. Post-award obligations include monitoring prohibited equipment lists and SAM.gov quarterly, notifying the Contracting Officer within 3 business days of discovering non-compliant components, providing detailed mitigation strategies within 30 days, and notifying DHA's Cyber Operations Center within 72 hours of discovering high or critical severity vulnerabilities. Prior to first unit delivery (within 30 days of award), vendors must submit system architecture diagrams, DHA Security Questionnaires, HBOM/SBOM documentation, and comprehensive Nessus scans; within 60 days, a completed Controls Selection Worksheet is required. All requirements must flow down to subcontractors and suppliers.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
System Capability b.Cyber VENDOR SUBMISSION FORM (Completed by Vendors)
| GOVERNMENT MINIMUM REQUIREMENTS AND OBJECTIVES - CYBERSECURITY/RMF (Factor 1) |
| Customer should copy description, minimum requirements and objectives from RFO section III. Statement of Work (1.) System Capability (Factor 1) (b.) DoD Cybersecurity/Risk Management Framework (RMF). |
The rest of form is to be completed by vendors.
| SRD# | DESCRIPTION OF TECHNICAL MINIMUM REQUIREMENT AND/OR OBJECTIVE | MINIMUM TECHNICAL REQUIREMENT | |
| 01 | Authority to Operate (ATO), or RMF Approval | Vendor agrees to Comply with IA Terms and Conditions necessary to achieve and maintain a RMF ATO for proposed solution. | |
| 02 | Joint Medical Device Equipment Risk Assessment Questionnaire | Provide a completed Joint Medical Device Equipment Risk Assessment Questionnaire for the offered system. |
All 3rd party components/applications included in the RFO must have their own MDERA filled out in its entirety.
03 3rd party Applications/ Components Any 3rd party applications/components must be clearly identified in the offering as being sold by the Prime Contractor.
Prime Contractor submitting the RFO must have an agreement in writing with any 3rd party, or component being resold in the RFO to hold the 3rd party vendor accountable to comply with the IA Terms and Conditions necessary to achieve a system RMF ATO for their system. If no agreement is in place, the Prime Contractor in the offering agrees in writing to be responsible for completion of the RMF ATO for all 3rd party components, to include the security lockdown (STIGS, Patching, Scans, etc.) of the equipment offered.
All 3rd party applications/components must meet all IA SRDs for the offering to be considered. Prime contractor is responsible for ensuring all information from 3rd parties are included and accurate.
| 04 | Provide Current Nessus Scans | Provide fully credentialed full audit/port scans using Nessus of all system components provided with the system, to include 3rd party applications/components listed in the offer. Scans must be completed within 30 days of submission date to be considered acceptable. |
| 05 | Operating System | Operating System used on the Medical Device must have no less than 36 months before reaching its commercial End of Life (OS EOL). |
For any OS with less than 36 months, provide a plan of action towards upgrading the OS. Include any costs associated with upgrading the OS after deployment, and specific timelines associated with availability of the updated OS. A strength or weakness may be assigned based on the details provided.
06 Application major Components All major component software applications (SQL, IIS, Net, Etc.) used on the Medical Device must have no less than 36 months before reaching their commercial End of Life (OS EOL).
For any major component software applications with less than 36 months, provide a plan of action towards upgrading the application. Include any costs associated with upgrading after deployment, and specific timelines associated with availability of the updated OS. A strength or weakness may be assigned based on the details provided.
| 07 | Vulnerability management | Vendor must describe established policies and procedures to distribute and install security updates within a documented timeframe to include all critical security patches within 15 calendar days. Response must include how often patches are reviewed/released, as well as information on how patches are distributed, and any costs associated with patch management. |
| 08 | Data At Rest Encryption | System utilizes FIPS 140-2 level encryption for all PHI/PII data. |
| 09 | Auditing | System is capable of providing a time specific audit trail on system events to include: |
1. Login/Logout information
2. modification and deletion of PHI/PII
3. The import and export of data to and from utilizing removable media
4. Execution of privileged/elevated functions.
5. Remote Service Activity 10 User accounts All general users of the system must have individual user IDs to log into the application.
All Admin accounts are separate from general user level access All accounts support DoD password complexity requirements.
11 Scanability
Live Environment Definition: System that is joined to the network and clinically in use. Vendor must indicate if the offered system can be scanned.
Must provide details and requirements for scanning and any directory exemptions necessary.
Must indicate if vendor intervention is required for scanning.
For systems/components that cannot be scanned, the vendor must detail how RMF configuration compliance is to be verified in the live environment.
| 12 | Prohibition on Foreign Adversary Sourcing and Certain Telecommunications and Video Surveillance Services and Equipment | Vendor must represents and warrants that the ‘company’ and its subcontractors or suppliers thereof do not incorporate hardware (including components), software, or firmware to be supplied under a contract that is manufactured, assembled, or otherwise sourced, in whole or in part, consisting of the product types or services contained in the ‘Covered List’ at https://www.fcc.gov/supplychain/coveredlist, or from any supplier who is an affiliate or otherwise controlled by a ‘Foreign Adversary Country’. "Foreign Adversary Country" is defined as the Peoples Republic of China, the Russian Federation, North Korea, Iran, and Venezuela (Madura Regime), and any other actor identified by the Secretary of War or Office or the Director of National Intelligence. With regard specifically to the supply of classes of equipment only, these prohibitions do not apply to equipment or components that “cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.” Representations and declarations shall be made consistent with FAR 52.204-24 and DFARS 252.204-7017, which are not limited to covered equipment or their components except as described in the “Covered List”. |
| 13 | Bills of Material (HBOM/SBOM) | Vendor must provide a comprehensive Hardware and Software Bill of Materials (HBOM/SBOM) for all products to be provided in response to this solicitation or to be provided under this contract. Reference the CISA Hardware Bill of Material Framework for Supply Chain Risk Management and the CISA 2025 Minimum Essential Requirements for Software Bills of Material. |
Vendor must include the supplier and/or manufacturer, and country of origin for each electronic component.
Vendor must provide identification of any components sourced (in whole or in part) from a Foreign Adversary Country, Prohibited Source of Supply, or any non-TAA Compliant Country.
Vendor must provide other information as is required under the representation provided in compliance to FAR 52.204-24 and DFARS 252.204-7017.
14 Secure Development Practices and ICT Supply Chain Risk Management (SCRM) Using NIST SP 800-218 as a reference, and as applicable to the vendors’ product(s) to be delivered under the contract, the vendor must demonstrate, based on its own documented procedures, a commitment to secure software development practices.
Vendor must also demonstrate that it has processes and procedures in-place for vetting third-party components (hardware and software), managing open-source software and related supplier and supply chain risks, managing changes to system and component configuration, and discovering and responding to vulnerabilities.
15 HBOM and SBOM Change Management The vendor shall be responsible for change management and notification to the Government in cases where there have been changes to the baseline HBOM and SBOM post award. Notification of the COR will be required under the following conditions:
•Upon any Software/Firmware Update: An updated SBOM shall be delivered within 15 business days of the release of any software or firmware update which would impact the product or component baseline for subsequent deliveries under the contract.
•Upon Hardware Component Revision: An updated HBOM shall be delivered if any hardware component of the system undergoes a revision or part substitution which would impact the configuration of devices delivered under the contract.
•Upon Government Request: The Contractor shall provide the most current SBOM and HBOM within 30 days of a request from the COR.
16 Vulnerability Management, Continuous Monitoring and Notification of Non-Compliance Post award, and every 90 days thereafter, the vendor shall monitor the list of prohibited equipment and or services at https://www.fcc.gov/supplychain/coveredlist, or otherwise posted to SAM.gov. Should the vendor based on these Government sources or through any other source including any subcontractor or supplier, determine that any equipment or component violates these requirements relative to prohibited sources of supply, the Vendor shall:
•Notify the Contracting Officer within 3 business days of discovery and follow the other reporting procedures under FAR 52.204-25 and DFARS 252.204-7018.
•Within 30 days of discovery, provide a detailed mitigation strategy to address any potential security risks, including required configuration changes and or upgrades that would remediate the potential risks.
•If the component is deemed critical to the operation of the system relative to the system functional requirements or specifications, and cannot otherwise be mitigated or remediated, provide an alternative sourcing plan for the affected component within 30 days of notification.
In addition, the vendor shall proactively monitor all components in the baseline SBOM/HBOM for new vulnerabilities. For any ‘High’ or ‘Critical’ severity vulnerability (CVSS v3.x score of 7.0 or higher), the Contractor shall notify the COR and the DHA Cyber Operations Center within 72 hours of discovery using secure mail or by contacting the DHA Cyber Operations Watch Desk at (866)-786-4432. This notification must include the CVE, a description of vulnerability, the affected components, potential impact, and immediate mitigation instructions. A formal remediation plan and timeline for corrective action shall be delivered within 30 days of notification.
| 17 | Government Review, Validation and Approval | All mitigation strategies, remediation plans, and alternative sourcing plans are subject to the Defense Health Agency's (DHA) review and written approval. The Vendor's ability to adequately address ICT supply chain risks to DHA's satisfaction will be a critical factor in the assessment of contract performance. Independent review and verification can include, but is not limited to, analysis of the delivered SBOM/HBOM and sources of supply, physical inspection of components, vulnerability scanning of the system or components to validate hardware, software and firmware configuration. In case of non-compliance with these requirements, or misrepresentations, the Agency may implement whatever remedies under the contract that it deems appropriate or necessary. Current policy and regulations state that in some cases, non-compliance with these requirements will render the vendor, company, or a supplier ineligible for subsequent awards. |
| 18 | Support for Risk Management Framework (RMF) | The Vendor shall provide all necessary cooperation and required artifacts for the Government to obtain and maintain the necessary approvals under the Risk Management Framework (RMF) as required to operate the system. A system or device which cannot attain the necessary approvals cannot reside on the DHA information network. Prior to first unit delivery, and not later than 30 days from the date of award, the vendor shall provide the following artifacts to the COR and Project Management Office’s designated Information Systems Security Manager: |
•System Architecture Diagram (required in all cases except where the configuration consists of a single stand-alone device) •Completed DHA Security Questionnaire •Hardware and Software Bills of Material (provided as part of the Solicitation or updated at time of Award) •Comprehensive discovery, configuration, and vulnerability scans (all system components and devices), using Tenable Nessus And within 60 days:
•Completed Controls Selection Worksheet (as provided by the Government for the system, component(s), or device(s)
| 19 | Flow-down Requirements | Relative to the requirements for prohibited sources of supply under FAR Subpart 4.21 and associated clauses, the Vendor (Contractor) shall insert the substance of these requirements as well as the clause at DFARS 252.204-7018 in all subcontracts and other contractual instruments for the acquisition of commercial products or commercial services under the prime contract. |
| Other features or value added offer beyond requirement and objectives above (vendor completes below) |
File details come from the government source that posted it. Updated .