SPE2DH21R00020008- AMENDMENT 0008.PDF

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NO.

See Block 14

4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (If applicable)

6. ISSUED BY CODE SPE2DH 7. ADMINISTERED BY (If other than Item 6) CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code)

CODE FACILITY CODE

SPE2DH21R0002

X

2021 DEC 02

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 13)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of OffersX is extended, is not extended.

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

12. ACCOUNTING AND APPROPRIATION DATA (If required)

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO.

IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc. ) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A NAME AND TITLE OF SIGNER (Type or print)

NSN 7540-01-152-8070

Previous edition unusable

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA FAR (48 CFR) 53.243

16B. UNITED STATES OF AMERICA15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

(a) By completing Items 8 and 15, and returning

DLA TROOP SUPPORT

MEDICAL SUPPLY CHAIIN FSH

700 ROBBINS AVENUE

PHILADELPHIA PA 19111

15C. DATE SIGNED 16C. DATE SIGNED

D. OTHER (Specify type of modification and authority)

3. EFFECTIVE DATE

See Attached Continuation Sheet(s).

(X)

CHECK ONE

9A. AMENDMENT OF SOLICITATION NO.

9B. DATED (SEE ITEM 11)

13. THIS APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

CONTINUATION SHEET REFERENCE NO. OF DOCUMENT BEING CONTINUED: PAGE 2 OF 3 PAGES

CONTINUED ON NEXT PAGE

SPE2DH21R0002 - 0008

SECTION C - SPECIFICATIONS/SOW/SOO/ORD

The subject solicitation is hereby amended as follows:

(1) Page 8, reference CAUTION NOTICE, hereby includes Section O:

All Department of Defense (DoD) orders must adhere to either the Defense Health Agency's Cybersecurity/Risk Management Framework (RMF) requirements /or individual Military Service RMF requirements for all offered medical systems/devices that receive, process, store, display, or transmit data to government systems.

To ascertain security compliance with United States Federal Government (USFG), Department of Defense (DoD), and Defense Health Agency (DHA) policies and directives, vendors are required to complete and provide the latest version of the Medical Device and Equipment Risk Assessment (MDERA) CyberLOG questionnaire, upon request by the DoD customer.

*All Medical Systems/Devices are required to meet DoD cybersecurity and National Institute of Standards and Technology (NIST) standards, regardless of network connection type.

Compliance is required for the following procedures/standards:

a. Vendors are required to complete and provide the latest Medical Device and Equipment Risk Assessment (MDERA) CyberLOG questionnaire to a DHA POC (listed in b.), upon request by the DoD customer.

DHA may require more documentation, than The Medical Device and Equipment Risk Assessment (MDERA) CyberLOG questionnaire, to identify medical devices'/systems', and equipment classification:

• Assess and Use (A&U) Certification

• Assess and Incorporate (A&I) Certification

• Assess and Authorize (A&A) o Each classification has its own set of Cybersecurity/RMF requirements to obtain approvals

b. Vendors will be responsible for contacting the DHA CyberLog Office (DHA.DETRICK.MED-LOG.MBX.

CYBERLOG@MAIL.MIL) or DHA ICS (DHA.DETRICK.PEO-MED-SYS-J-6.MBX.DHA-ICS-CYBER- RMF@HEALTH.MIL), immediately after receiving an order to start the RMF process. *Email correspondence/ submission must include an attachment of the delivery order.

c. Any DoD requirement accepted in ECAT must comply with the latest DHA Cybersecurity/RMF requirements.

Vendors must:

• Have a valid approval (A&U, A&I, or A&A), or

• Partake in the RMF approval process to obtain A&U, A&I, or A&A (and subsequent approvals for the life of the equipment).

d. If there is a medical device/system that will not meet the specified DHA Cybersecurity/RMF requirements, the vendor shall reject (kill) that requirement in ECAT and notify both the DoD customer and the DLA Contracting Officer of the issue.

e. Vendors may be required to adhere to site-specific Cybersecurity Requirements, upon request by any DoD customer.

f. By accepting any DoD requirement in ECAT, the vendor also agrees to comply with the site-specific Cybersecurity Requirements.

g. If there is a medical device/system that will not meet the specific individual site-specific requirements, the vendor

CONTINUATION SHEET REFERENCE NO. OF DOCUMENT BEING CONTINUED: PAGE 3 OF 3 PAGES

SPE2DH21R0002 - 0008

SECTION C - SPECIFICATIONS/SOW/SOO/ORD (CONTINUED)

shall reject (kill) that requirement in ECAT and notify both the customer and DLA Contracting Officer of the issue.

h. Vendors may offer systems that do not meet DHA Cybersecurity/RMF requirements under their contract solely for purchase by non-DoD customers

(2) All other terms and conditions remain unchanged, in full force or effect.