Solicitation Attachment 2 - Cybersecurity_RMF Contracting Requirements.docx

Department of Defense (DOW) Defense Health Agency (DHA) Medical Device Program Management Office (MDE-PMO) Contracting Requirements for Medical Device and Equipment (MDE) Cybersecurity/Risk Management Framework (RMF) Version 3.0 21 May 2026

Version Matrix

DHA MDE Cybersecurity/RMF Contract/ordering Requirements 14 April 2026, Version 3.0

Table of Contents

DHA MDE Cybersecurity/RMF Contracting Requirements Version 3.0

This document establishes the minimum standards for cybersecurity, risk management, and supply chain risk management for all Medical Device and Equipment (MDE) acquisitions. These standards ensure alignment with federal, Department of War (DoW), and Defense Health Agency (DHA) policies, address emerging threats to the security and resilience of the DOW Information Network.

In accordance with Section 524B(c) of the Federal Food, Drug, and Cosmetic (FD&C) Act, a "cyber device" is defined as a device that: (1) includes software validated, installed, or authorized by the sponsor as a device or in a device; (2) has the ability to connect to the internet; and (3) contains any such technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats.

All MDE offered/quoted by a vendor must meet all requirements specified in this document. Vendor offers shall identify all part numbers and costs to meet the requirements stated in this document or declare there are no additional and separate charges. For any specific pricing/costs directly related to the requirements in this document, the items will be referenced within a Contract Line-Item Number (CLIN). For offers or quotes issued under a long-term Indefinite Delivery/Indefinite Quantity (IDIQ) contract, all related pricing and costs must be incorporated in the vendor’s long-term IDIQ contract.

The government will not enter into a Non-Disclosure Agreement (NDA) with the vendor. Federal law provides criminal prosecution of any Government employee disclosing confidential information, with or without an NDA (see 18 USC §1905).

All requirements in this document apply to stand-alone contracts as well as delivery or task orders under an ordering contract and call orders under a blanket purchase agreement. If the vendor receives a delivery or task order under an ordering contract or a call order under a blanket purchase agreement, the vendor shall ensure that all devices provided under the scope of said contract maintain the required/authorized security posture. The vendor shall not change versions without proper notification to both the program office responsible for device management, the contracting agency, and cybersecurity analysts. The vendor shall not make any delivery, nor receive payment prior to RMF approval on the updated version as detailed in the following sections.

A. Prohibition on Foreign Adversary Sourcing and Certain Telecommunications and Video Surveillance Services and Equipment.

1. The Vendor represents and warrants that the ‘company’ and its subcontractors or suppliers thereof do not incorporate hardware (including components), software, or firmware to be supplied under a contract that is manufactured, assembled, or otherwise sourced, in whole or in part, consisting of the product types or services contained in the ‘Covered List’ at https://www.fcc.gov/supplychain/coveredlist, or from any supplier who is an affiliate or otherwise controlled by a ‘Foreign Adversary Country’. "Foreign Adversary Country" is defined as the Peoples Republic of China, the Russian Federation, North Korea, Iran, and Venezuela (Madura Regime), and any other actor identified by the Secretary of War or Office or the Director of National Intelligence.

2. With regard specifically to the supply of classes of equipment only, these prohibitions do not apply to equipment or components that “cannot route or redirect user data traffic or cannot permit visibility into any user data or packets that such equipment transmits or otherwise handles.”

3. Identification of Cyber-Critical Components

a. Cyber-Critical Component is defined as any component that meets the following criteria:

i. (a.) Any component that is considered vital for the functioning of critical network infrastructure and/or communication system; AND

ii. That is involved in the transmission of data and whether by volume and/or sensitivity of data, are deemed high-risk components, from a cybersecurity standpoint.

b. Examples of cyber-critical components include, but are not limited to:

i. System Hardware/Firmware: Components required for the operation and clinical functionality of the device to include all servers, workstations, routers, switches, etc., including any 3rd party components.

ii. Operating Systems (OS), including proprietary OS, for each component listed in (a.) above.

iii. Installed Applications for each component listed in (a) above.

4. Representations and declarations shall be made consistent with FAR 52.204-24 and DFARS 252.204-7017, which are not limited to covered equipment or their components except as described in the “Covered List”.

5. A component provided, developed, or manufactured, in whole or in part, in a country that is not the United States (as defined in FAR 25.003), a Designated Country (as defined in FAR 25.003 but excluding Oman), or a Qualifying Country (as defined in DFARS 225.003), such as those including, but not limited to: China, India, Indonesia, Iran, Iraq, Malaysia, Pakistan, Philippines, Sri Lanka, Russia, and North Korea.

B. Bills of Material (HBOM/SBOM)

1. The Vendor shall provide a comprehensive Hardware and Software Bill of Materials (HBOM/SBOM) for all products to be provided in response to this solicitation or to be provided under this contract. Reference the CISA Hardware Bill of Material Framework for Supply Chain Risk Management and the CISA 2025 Minimum Essential Requirements for Software Bills of Material. The resultant BOMs must include:

a. The supplier and/or manufacturer, and country of origin for each electronic component.

b. Identification of any components sourced (in whole or in part) from a Foreign Adversary Country, Prohibited Source of Supply, or any non-TAA Compliant Country.

c. Other information is required under the representation provided in compliance with FAR 52.204-24 and DFARS 252.204-7017.

2. The SBOM and HBOM submitted and accepted by the Government at the time of award shall be considered the baseline for the delivered system and or equipment.

3. Upon any Software/Firmware Update: An updated SBOM shall be delivered within 15 business days of the release of any software or firmware update which would impact the product or component baseline for subsequent deliveries under the contract.

4. Upon Hardware Component Revision: An updated HBOM shall be delivered if any hardware component of the system undergoes a revision or part substitution which would impact the configuration of devices delivered under the contract.

5. Upon Government Request: The Contractor shall provide the most current SBOM and HBOM within 30 days of a request from the COR

C. Secure Development Practices and ICT Supply Chain Risk Management (SCRM)

1. Using NIST SP 800-218 as a reference, and as applicable to the vendors’ product(s) to be delivered under the contract, the vendor must demonstrate, based on its own documented procedures, a commitment to secure software development practices.

2. The vendor must also demonstrate that it has processes and procedures in place for vetting third-party components (hardware and software), managing open-source software and related supplier and supply chain risks, managing changes to system and component configuration, and discovering and responding to vulnerabilities

D. Vulnerability Management, Continuous Monitoring and Notification of Non-Compliance

1. Post award, and every 90 days thereafter, the vendor shall monitor the list of prohibited equipment and or services at https://www.fcc.gov/supplychain/coveredlist , or otherwise posted to SAM.gov. Should the vendor based on these Government sources or through any other source including any subcontractor or supplier, determine that any equipment or component violates these requirements relative to prohibited sources of supply, the Vendor shall:

2. Notify the Contracting Officer within 3 business days of discovery and follow the other reporting procedures under FAR 52.204-25 and DFARS 252.204-7018.

3. Within 30 days of discovery, provide a detailed mitigation strategy to address any potential security risks, including required configuration changes and upgrades that would remediate the potential risks.

4. If the component is deemed critical to the operation of the system relative to the system functional requirements or specifications, and cannot otherwise be mitigated or remediated, provide an alternative sourcing plan for the affected component within 30 days of notification.

5. In addition, the vendor shall proactively monitor all components in the baseline SBOM/HBOM for new vulnerabilities. For any ‘High’ or ‘Critical’ severity vulnerability (CVSS v3.x score of 7.0 or higher), the Contractor shall notify the COR and the DHA Cyber Operations Center within 72 hours of discovery using secure mail or by contacting the DHA Cyber Operations Watch Desk at (866)-786-4432. This notification must include the CVE, a description of vulnerability, the affected components, potential impact, and immediate mitigation instructions. A formal remediation plan and timeline for corrective action shall be delivered within 30 days of notification.

E. Government Review, Validation and Approval

1. All mitigation strategies, remediation plans, and alternative sourcing plans are subject to the Defense Health Agency's (DHA) review and written approval.

2. The Vendor's ability to adequately address ICT supply chain risks to DHA's satisfaction will be a critical factor in the assessment of contract performance.

3. Independent review and verification can include, but is not limited to, analysis of the delivered SBOM/HBOM and sources of supply, physical inspection of components, vulnerability scanning of the system or components to validate hardware, software and firmware configuration.

4. In case of non-compliance with these requirements, or misrepresentations, the Agency may implement whatever remedies under the contract are deemed appropriate or necessary.

5. Current policy and regulations state that in some cases, non-compliance with these requirements will render the vendor, company, or a supplier ineligible for subsequent awards.

F. DHA Overall Risk Assessment and Authorization Decision

To ascertain security compliance with United States Federal Government (USFG), Department of Defense (DOW), and Defense Health Agency (DHA) policies and directives, vendors shall provide a completed Medical Device and Equipment Risk Assessment (MDERA) Questionnaire, in addition to providing documentation identifying the manufacturer and country of origin for all hardware and software components that meet the definition of “cyber-critical component”. A “component” is any part of an end-item or of another component. This information must be provided at time of offer submission for a vendor to be eligible for award.

The relevant information provided as part of a vendor’s offer submission may be used in the Authorizing Official (AO’s) risk assessment/ ATO decision. Furthermore, the AO may require the vendor to provide additional information, clarification, and/or elements to address throughout the ATO process.

1. Risk Determination and Authorization Decision:

Every system used in the Department of War must have an AO responsible for the system’s operation based on achieving and maintaining an acceptance risk posture. The AO determines the risk to organizational operations. To make this determination, the AO considers the current security state of the system, as reflected by the risk assessment. The AO’s decision along with any terms or conditions the AO attaches to the decision produces the final risk determination.

The AO’s signature on the decision document indicates full acceptance of the risk associated with operating the system. However, an Authorization, Approval or Certification is not guaranteed, as throughout the ATO process the vendor may be required to address cybersecurity vulnerabilities (refer to Section B, paragraph 1.2 of this document) and/or provide additional information that substantiates the utilization of trusted/approved sources, including system components and their corresponding country of origin (refer to sub-paragraph 2.1.2 below). An ATO shall be denied for failure to remedy identified vulnerabilities to an acceptable extent, as determined by the AO, or for failure to provide the necessary documentation that substantiates the offered system meets the criteria set forth in sub-paragraph 2.1.2 below.

NOTE: Any system rejected/determined unable to obtain an ATO is grounds for delivery order termination. The Government shall not be responsible or liable for any costs accrued by the vendor during the ATO process.

G. General Defense Health Agency (DHA) Medical Device and Equipment (MDE) Cybersecurity/Risk Management Framework (RMF) Contracting Requirements

1. New MDE and Software Purchases RMF Requirements:

For the purposes of this contract/order, MDE is defined as any system, device, or software intended for use in, or in direct support of, the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, or equipment used in the direct support of the medical mission.

The vendor agrees to comply with References listed in Section:6 Cybersecurity Regulations and Guidance.

1.1 The Vendor shall provide all necessary cooperation and required artifacts for the Government to obtain and maintain the necessary approvals under the Risk Management Framework (RMF) as required to operate the system. A system or device which cannot attain the necessary approvals cannot reside on the DHA information network.

1.2 Prior to first unit delivery, and not later than 30 days from the date of award, the vendor shall provide the following artifacts to the COR and Project Management Office’s designated Information Systems Security Manager:

1.2.1 System Architecture Diagram (required in all cases except where the configuration consists of a single stand-alone device)

1.2.2 Completed DHA Security Questionnaire

1.2.3 Hardware and Software Bills of Material (provided as part of the Solicitation or updated at time of Award)

1.2.4 Comprehensive discovery, configuration, and vulnerability scans (all system components and devices), using Tenable Nessus

1.3 Within 60 days, the vendor will complete the controls selection worksheet as provided by the Government for the system, component(s), or device(s).

1.4 No system components or devices are to be delivered, nor will the Government be responsible for payment for any system component or device, subject to the RMF process, until the minimum required artifacts are delivered and accepted by the Government. If the complexity of the system, component, or device requires configuration or integration, such that validation of the security configuration cannot be done independently, the vendor may propose a vendor site inspection and validation to occur not later than 90 days from award.

1.5 The vendor will still be responsible for the 30- and 60-days deliverables listed above excluding the comprehensive discovery, configuration, and vulnerability scans which would be done at the vendor site.

1.6 Final artifacts will be due 30 days after the inspection and pending approval and acceptance by the Government.

1.7 The vendor shall establish and maintain a test/laboratory environment that includes all contract/ordered equipment, to include 3rd party components that fall under the authorization boundary, and/or included in this contract/order, to support the RMF/Cybersecurity requirements. The vendor test lab shall be used for all self-assessment activities, Independent Verification and Validation (IV&V) compliance testing, and post Authority to Operate (ATO), or RMF Approval (herein referred to as Approval) actions.

1.8 Any commercial cloud offerings hosted outside the DHA Med-COI network must be Federal Risk and Authorization Management Program (FedRAMP) approved prior to implementing DHA RMF/Cybersecurity activities for the MDE. FedRAMP certification falls outside the DHA Cyber Logistics’ (CyberLOG) or Program Management Office’s (PMO) purview and is the responsibility of the vendor. Information on FedRAMP certification can be found at www.fedramp.gov.

1.9 Software patches and updates: Many enterprises within the DOW automate patch installations and software updates for operating systems and DOWDOW standard software applications. For applications such as databases and developed applications, updates must be scheduled in coordination with DHA. Vendors shall notify the assigned DHA Cybersecurity Analyst and make available for DHA Contracting Officer’s Representative (COR) review if required, any updates/changes to the system prior to installation, to include but not limited to software updates, operating system, application upgrades, patches, and/or addition/removal of components. For purchases made through the DHA Medical Devices and Equipment (MDE) Program Management Office (MDE PMO), the vendor shall submit all requests to dha.detrick.PEO-Med-Sys-J-6.mbx.dha-ics-cyber-rmf@health.mil. For all other purchases, or if the analyst is unknown, the vendor shall submit all requests to dha.detrick.med-log.mbx.cyberlog@health.mil.

Software updates will be analyzed by the Government to determine if reauthorization is required by Department of Defense Instruction (DOWI) 8510.01, RMF for DOW Information Technology (IT). Patches normally address bug fixes and cybersecurity issues. Per the DOWI 8500.01, Cybersecurity, Enclosure 3, paragraph 9.b(11), “All CYBERSECURITY products and [Information Assurance] IA-enabled products that require use of the product’s CYBERSECURITY capabilities will comply with the evaluation and validation requirements of Committee on National Security Systems Policy 11, National Policy Governing the Acquisition of IA and IA-Enabled Information Technology Products, June 2013, as amended.”

2. Reauthorization in accordance with DOW RMF requirements: Per DOWI 8510.01, Enclosure 6, para 2.f.(6)(a), “In accordance with Appendix III of Office of Management and Budget (OMB) Circular A-130, systems must be reassessed and reauthorized every 3 years or as a result of a system update that negatively affects the security posture (whichever is less).” The vendor must disclose to the Government any changes to configuration, to include but not limited to, software version changes, operating system changes/upgrades, major application or architectural changes (database version, web hosting software, etc.) a minimum of three (3) months prior to delivery/implementation within the DHA. Minor system updates and cybersecurity maintenance patching are generally not considered major application changes but will be evaluated by the PMO prior to implementation. The Government will determine if a reauthorization is required based on vendor-initiated system updates or changes. Program Offices or appropriate logistics organizations plan for this activity. The results of an annual cybersecurity review or a negative change to the system or environment at any time (i.e., a change increasing the residual risk) may result in a need for reauthorization prior to the regular three-year reauthorization. The vendor will be notified by the Government one year prior to the Authorization Termination Date (ATD) to begin the reauthorization process.

3. The vendor shall ensure that all MDE provided under the scope of this contract/order maintains the required/authorized security posture; the vendor shall not change versions without proper notification to the program office responsible for device management, the contract agency, and the DHA cyber security analysts. The vendor shall not make any delivery, nor receive payment prior to RMF Approval on the updated version.

3.1. The vendor shall be responsible for change management and notification to the Government in cases where there have been changes to the baseline HBOM and SBOM post award.

3.2. Notification to the Government will be required upon any Software/Firmware Update: An updated SBOM shall be delivered within 15 business days of the release of any software or firmware update which would impact the product or component baseline for subsequent deliveries under the contract.

3.3. The vendor shall notify the Government upon Hardware Component Revision: An updated HBOM shall be delivered if any hardware component of the system undergoes a revision or part substitution which would impact the configuration of devices delivered under the contract.

3.4. The vendor shall notify the Government upon Government Request: The Contractor shall provide the most current SBOM and HBOM within 30 days of a request from the COR

H. DHA Cybersecurity/RMF Acceptance/MDE Delivery Requirements

1. System Security Requirements

1.1. The vendor shall provide a Point of Contact (POC) responsible for the completion of the RMF/Cybersecurity process for the vendor device or system throughout the lifecycle of the system. The vendor shall provide Subject Matter Experts (SMEs) to support all assessments of contract/ordered products and materials outlined in the chart in paragraph 2.

1.1. RMF documentation shall cover all possible configurations, including all 3rd party components supported by this contract/order.

1.2. The vendor shall provide updated Nessus technical scans using the DHA full safe scan policy (provided by the Government), on the 10th day of each month until an approval is granted.

1.2. The vendor device or system shall pass technical screening (vulnerability scans utilizing Nessus, Security Content Automation Protocol (SCAP) scans, and Security Technical Implementation Guides (STIGs) checklists) within six (6) months of contract/order award. All technical scans shall be provided by the vendor to the Government Program Manager (PM) for review and made available for COR review if required. Vendor MDE shall pass fully credentialed screening using ACAS Scanning Requirements, ACAS Best Practices, DHA ACAS Scanning Guide, and Best Practice Guidelines Policy. Successful pre-validation technical screening shall meet the Cybersecurity criteria listed below:

1.2.1. No unmitigated Very High or High Severity/ Category I (CAT I) vulnerabilities as described in the appropriate DISA STIGs located on https://public.cyber.mil/stigs/downloads/

1.2.2. No unmitigated Moderate Severity/Category II (CAT II) vulnerabilities described in the appropriate DISA STIGs located on https://public.cyber.mil/stigs/downloads/

1.2.3. No unmitigated Very High or High Severity/ Category I (CAT I) vulnerabilities from Nessus vulnerability scans.

1.2.4. No unmitigated Moderate Severity/ Category II (CAT II) vulnerabilities from Nessus vulnerability scans.

1.3. The vendor shall submit mitigation statements to the Government for approval for all Very High, High, and Moderate Severity/CAT I, and CAT II vulnerabilities discovered during the RMF Assessment.

1.4. For all MDE identified by the Government as requiring a full Assess and Authorize (A&A), including IV&V test, the vendor shall not make any delivery and shall not receive payment until the PMO has completed a review of submitted RMF documentation and technical results, and the IV&V has been scheduled. IV&Vs cannot be scheduled until all documentation requirements and technical requirements have been completed to the PMO’s satisfaction. Additionally, all identified Plan of Actions and Milestones (POA&Ms) must have been appropriately mitigated to reduce the risk to the Government network and Protected Health Information (PHI)/Personally Identifiable Information (PII)/Controlled Unclassified Information (CUI) data housed within the system. Delivery of all system components, including any 3rd party items, may take place prior to this milestone (IV&V scheduling) only if required for IV&V and written permission is provided by the Contracting Officer.

1.5. For all MDE identified by the Government as requiring an Assess and Incorporate (A&I) or Approve and Assess and Use (A&U) certification, the vendor shall not make any delivery and shall not receive payment until the PMO has completed a review of submitted RMF documentation and technical results, and the system has have been submitted for an approval. RMF Approval cannot be requested until all documentation requirements and technical requirements have been completed to the PMO’s satisfaction. Additionally, all identified POA&Ms must have been appropriately mitigated to reduce the risk to the Government network and PHI/PII/CUI data housed within the MDE. The vendor must receive written confirmation from the PMO or Contracting Officer that the system has been submitted for an assess only Approval and that the vendor may proceed with delivery. Delivery of all system components including any 3rd party items, may take place prior to this milestone only if written permission is provided by the Contracting Officer.

1.6. The vendor shall obtain a recommendation of Approval from a Government-appointed 3rd validator within twelve (12) months of contract/order award.

1.7. Prior to final acceptance and installation, as a part of site acceptance testing, the vendor shall provide procedures for the accepting sites to ensure the delivered device matches the DHA authorized configuration. The vendor shall coordinate running Nessus and SCAP scans, or the vendor prescribed alternative procedures required to validate the configuration, with the site and the assigned DHA Cybersecurity Analyst to verify compliance. Any deviations from the approved configuration will require the vendor to bring the system into compliance before final acceptance and payment.

1.8. Pursuant to warranty period and subsequent Service Maintenance Agreements (SMAs), the vendor shall, after the issuance of an Approval, ensure that the vendor’s device or system maintains its Approval for as long as the system is installed in the DHA network. The vendor shall ensure that RMF/Cybersecurity maintenance is included in all SMA offerings.

The vendor shall maintain an Approval on all equipment/product versions, owned or operated by the DHA, and covered under this contract/order. If the vendor cannot support the Approval for all DHA contract/ordered versions of the equipment/product, the vendor can meet this requirement by offering to provide all upgrades to the equipment/product that are required to maintain the Approval, either at no cost to the Government or at a fixed price that is included in a subsequent SMA offering under the vendor’s contract/order. During the period of time the vendor’s product is installed on the DHA network, the vendor shall provide all required cybersecurity patches/updates/upgrades, including Operating System and application upgrades where necessary. Maintaining the Approval shall be included as part of the vendor’s warranty. For updates/patches, executable files shall be distributed by the vendor accordingly, or implemented by the manufacturer’s technical staff, dependent on the contract/order processes.

1.9. The vendor shall notify the assigned DHA Cybersecurity Analyst, PMO POC, and Contracting Officer in writing of any inability to comply with DOW RMF/Cybersecurity requirements.

2. RMF Assessment Timeframes

1.2 Required Timeframes: The vendor and Government will complete their respective required actions within the referenced timeframes in Table 1 below, but no later than one

(1) year after order/contract/order award. If the vendor has completed all required actions in a timely and acceptable manner while the Government experiences delays, the vendor will be given additional time for future actions corresponding to the amount of Government delay. Vendor failure to meet specified timelines in the table below would be considered a vendor-caused delay.

Vendor to contact Gov POC, or identified Cybersecurity Analyst (must include Contract/PO information)

Table 1 - Required Timeframes

2.1 Informational Overview of the RMF Process: The following diagrams, Figure 1 and Figure 2, provide a summary overview of the entire process to obtain approval under DHA RMF/Cybersecurity requirements. These diagrams are for informational purposes only and are subject to change without notice.

Figure 1 Assess and Authorize Process DHA MDE Cybersecurity/RMF Contracting Requirements Version 3.0

2.3 A&I process specifically tailors the RMF process to MDE based on the unique system characters associated with these medical devices and systems. The process defines the method to identify in-scope MDE, and the necessary steps to assess and incorporate the MDE into an authorized DHA managed enclave (authorization boundary).

Figure 2 Assess and Incorporate/Assess and Use Process

Note: Not all above actions occur in a sequential manner, as some actions may be worked concurrently.

3. Business to Business (B2B) Connectivity Requirements

If a vendor requires a B2B connection, or remote access to government networks to maintain, analyze, or otherwise support its equipment/product, the vendor shall adhere to the following requirements:

3.1 Information Assurance contract/order Training and Certification. Contractors requiring a privileged-level account for administrative/maintenance support of systems/applications on the DHA network will meet DHA requirements for a privileged-level account before being granted a network account. Requirements include:

3.1. Cyber (IA/IT) certification. Per DOW Manual 8140.03 and DFARS 252.239.7001, the contractor personnel supporting Cyber (IA/IT) functions shall be appropriately certified upon contract award. Contractors will be defined at Information Assurance Technical Level I (IAT Level I) and be required to meet minimum Professional Baseline certifications at the time of contract/order award. Contractors will be given six (6) months to meet Computer Environment (CE) and Cyber Security Fundamental training requirements. Not meeting the requirements in accordance with DOWM 8140.03 will result in the contractor account and access being ‘Disabled’ or ‘Deleted’ until such time as those conditions are met.

3.2. Background Investigation. Tiered investigation based on role requirements (for more information see https://www.dcsa.mil/Portals/91/Documents/pv/fso/Tier_Investigations.pdf).

3.3. Professional Baseline Certification. The minimum Professional Baseline certification for IAT-II are: CCNA Security, CompTIA Cyber Security+. Higher certifications (GSCL, CISM, CISSP, SecurityX, etc.) will satisfy this requirement.

3.4. CE Certification. The CE certifications are determined by the role of the contractor and shall be met within six (6) months of contract or order issuance in accordance with DOW 8140.03.

3.5. Two-Factor Authentication. Contractors will authenticate to the B2B gateway using two-factor authentication. The only methods for authenticating are the Common Access Card (CAC) and NIPRNet Enterprise Alternate Token System (NEATS) tokens.

3.6. Network Account Request Package (Authorized & Privileged). The contractor will submit a request package through either the facility Provost Marshall Office in conjunction with the facility Information Management Department (for contractors requiring on-site access), or through the Information Assurance/Cyber Security Branch (for contractors requiring remote access to a DHA network). Remote access shall be through a DHA B2B solution.

3.7. Cybersecurity Training. DOW Cyber Awareness Challenge Training shall be completed by all contractor personnel and associated subcontractor personnel prior to issuance of network access and annually thereafter. DOW Cyber Awareness Challenge Training is available at the following website: https://public.cyber.mil/cyber-training/training-catalog/?_training_topics=cybersecurity-awareness-courses

3.8. PII Training. DOW PII Training shall be completed by all contractor personnel and associated sub-contractor personnel prior to issuance of network access and annually thereafter. DOW PII Training is available at the following website: https://public.cyber.mil/cyber-training/training-catalog/?_training_topics=cybersecurity-awareness-courses

3.9. Health Insurance Portability and Accountability Act (HIPAA) Training. DOW HIPAA Training shall be completed by all contractor personnel and associated subcontractor personnel prior to issuance of network access and annually thereafter. DOW HIPAA Training is available at the following website: https://jkodirect.jten.mil/Atlas2/page/login/Login.jsf?ORG=MHS

3.10. Acceptable Use Policy (AUP). All vendors/contractors shall sign/acknowledge the DHA Standard Acceptable Use Policy (AUP) prior to being granted a DHA network account. The DHA Standard AUP is available at the following website: https://health.mil/Reference- Center/Policies?query=Acceptable%20Use

4. Warranty and Post-Warranty Service Maintenance Agreement RMF/Cybersecurity Requirements/Continuous Monitoring/Risk Management.

4.1 During the initial warranty period of the device, the vendor is responsible for ensuring a continued positive security posture through DHA mandated Continuous Monitoring activities. Continuous Monitoring requires software updates/upgrades, patch management, application of DOW required security configurations via Security Technical Implementation Guides (STIGs), vulnerability scanning, and remediation of discovered vulnerabilities.

4.2 Post warranty cybersecurity maintenance will be covered in subsequent Service Maintenance Agreements.

4.3 In accordance with SEC. 524B. of the ‘Consolidated Appropriations Act, 2023’ titled ENSURING CYBERSECURITY OF DEVICES, the vendor shall design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure, and make available post-market updates and patches to the device and related systems on a reasonably justified regular cycle, or as soon as possible for critical vulnerabilities that could cause uncontrolled risks. The vendor shall disclose if patching can be accomplished by the government, or if a specialized support is required to maintain compliant cybersecurity Posture.

4.4 The vendor shall establish and maintain a test/laboratory environment that includes all contract/ordered equipment, to include 3rd party components that fall under the authorization boundary, and/or included in this contract/order, to support the RMF/Cybersecurity requirements. The vendor test lab shall be used for all self-assessment activities, Independent Verification and Validation (IV&V) compliance testing, and post Authority to Operate (ATO), or RMF Approval (herein referred to as Approval) actions for as long as the system is supportable by the vendor. Supportable is defined as serviceable by a qualified Service Engineer or Original Equipment Manufacturer (OEM).

4.5 The vendor shall update all ATO or approved products required supporting documentation in the event of a system policy, procedural, logical, or technical change to the system or device.

4.6 The vendor shall maintain the authorized security configuration and notify the government for approval prior to instituting changes to devices installed within the DHA network. A major upgrade such as major software or hardware revision must be reassessed for RMF Compliance, or addition to the approved products list. Minor upgrades must be assessed by the Government to determine if reauthorization is required. The vendor shall support reauthorizations due to both major and minor upgrades.

4.7 The vendor shall ensure its device or system is in compliance with the DOW IAVM program upon each deployment.

4.8 The vendor shall ensure any deployment post acceptance (including rebuilds) deploys with a fully patched, approved version. Prior to final acceptance and installation, the vendor shall coordinate running Nessus and SCAP scans, or the vendor prescribed alternative procedures required to validate the configuration, with the site and the assigned DHA Cybersecurity Analyst to verify compliance. Any deviations from the approved configuration shall require the vendor to bring the system into compliance prior to final acceptance and putting the system in operation.

4.9 The vendor shall maintain the system or device and update to comply with updated STIGs made available by the Government within three (3) months of notification by the Government.

4.10 The vendor shall provide vulnerability and configuration scan results using Nessus and the DHA policy to the Government monthly, providing raw scan results and administrative reports no later than the tenth (10th) calendar day of each month.

4.11 The vendor shall close all discovered vulnerabilities or shall submit to the Government for approval POA&Ms outlining mitigation and timelines for closing any open vulnerabilities within one (1) month of discovery.

4.12 The vendor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to the Government for approval.

4.13 The vendor shall use the Government-approved method for remote access administration (DHA B2B) of the system or device.

5. Flow-down Requirements

5.1 Relative to the requirements for prohibited sources of supply under FAR Subpart 4.21 and associated clauses, the Vendor (Contractor) shall insert the substance of these requirements as well as the clause at DFARS 252.204-7018 in all subcontracts and other contractual instruments for the acquisition of commercial products or commercial services under the prime contract.

6. Cybersecurity Regulations and Guidance

The vendor shall monitor and comply with the most current versions of all referenced regulations, guidance, and publications. Where conflicts exist between references, the more stringent requirement shall apply. Updates to any referenced document shall be incorporated into the vendor's processes within 90 days of publication, unless otherwise directed by the Government.

(a) United States Law

(i) The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

(ii) The Federal Information Security Management Act (FISMA)

(iii) The E-Government Act of 2002

(iv) H.R. 2617—Consolidated Appropriations Act, 2023, Section 524B, Ensuring Cybersecurity of Devices

(v) Section 889 of Public Law 115-232 (2019 National Defense Authorization Act (NDAA)), Parts (A) and (B)

(vi) 15 CFR Part 791, Securing the Information and Communications Technology and Services Supply Chain (December 6, 2024)

(b) Executive Orders

(i) Executive Order 13873, Securing the Information and Communications Technology and Services Supply Chain, May 2019

(ii) Executive Order 14028, Improving the Nation's Cybersecurity, May 2021

(c) Office of Management and Budget (OMB)

(i) OMB Circular A-130, Managing Information as a Strategic Resource

(ii) OMB Guidance M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12—Policy for a Common Identification Standard for Federal Employees and Vendors

(iii) OMB Memorandum M-26-05 (rescinding M-23-16 and M-22-18), Adopting a Risk-Based Approach to Software and Hardware Security, January 2026

(d) Federal Acquisition Regulation (FAR)

(i) FAR Subpart 4.21, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (October 1, 2025)

(ii) FAR 52.204-23, Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab Covered Entities (October 1, 2025)

(iii) FAR 52.204-24, Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment (October 1, 2025)

(iv) FAR 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (October 1, 2025)

(v) FAR 52.204-26, Covered Telecommunications Equipment or Services—Representation (October 1, 2025)

(vi) FAR 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition (October 1, 2025)

(vii) FAR Subpart 239.7300, Requirements for Information Related to Supply Chain Risk (November 10, 2025)

(e) Defense Federal Acquisition Regulation Supplement (DFARS)

(i) DFARS 252.204-7016, Covered Defense Telecommunications Equipment or Services—Representation (November 10, 2025)

(ii) DFARS 252.204-7017, Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services—Representation (November 10, 2025)

(iii) DFARS 252.204-7018, Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services (November 10, 2025)

(iv) DFARS 252.239-7017, Notice of Supply Chain Risk (November 10, 2025)

(v) DFARS 252.239-7018, Supply Chain Risk (November 10, 2025)

(f) National Institute of Standards and Technology (NIST)

(i) NIST Special Publication (SP) 800-37 Rev. 2, Guide for Applying the Risk Management Framework (RMF) to Federal Information Systems

(ii) NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View

(iii) NIST SP 800-53 Rev. 5, Security and Privacy Controls for Federal Information Systems and Organizations

(iv) NIST SP 800-60, Volume 1 Revision 1, Guide for Mapping Types of Information and Information Systems to Security Categories

(v) NIST SP 800-218, Secure Software Development Framework (SSDF)

(g) Federal Information Processing Standards (FIPS) The following publications are located at

(i) FIPS Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules

(ii) FIPS PUB 199, Standards for Security Categorization of Federal Information and Information Systems

(iii) FIPS PUB 200, Minimum Security Requirements for Federal Information and Information Systems

(iv) FIPS PUB 201-3, Personal Identity Verification of Federal Employees and Vendors

(h) Department of Defense (DOW)

(i) DOW Instruction 5200.02, DOW Personnel Security Program (PSP)

(ii) DOW Instruction 8500.01, Cybersecurity

(iii) DOW Instruction 8510.01, Risk Management Framework (RMF) for DOW Information Technology

(iv) DOW Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling

(v) DOW Instruction 8551.01, Ports, Protocols, and Services Management (PPSM)

(vi) DOW Instruction 8580.02, Security of Individually Identifiable Health Information in DOW Health Care Programs

(vii) DOW Instruction 6025.18, Privacy of Individually Identifiable Health Information in DOW Health Care Programs

(viii) DOW Directive 5400.11, DOW Privacy Program

(ix) DOW CIO Memorandum on Commercial Off-the-Shelf (COTS) Information and Communications Technology Supply Chain Risk Management, June 2025

(i) Cybersecurity and Infrastructure Security Agency (CISA)

(i) CISA Minimum Elements for a Software Bill of Materials (SBOM), August 2025 (Draft)

(ii) CISA Hardware Bill of Materials (HBOM) for Supply Chain Risk Management, September 2023

Appendix A. Memorandum for Senior Pentagon Leadership Regarding the Removal of Acronis AG Products image1.png image2.jpeg image3.jpeg image4.png image5.png