W9114F-17-T-0105_Amendment_0001.pdf

W40M REG HEALTH CONTRACT OFFICE- EUROPE

CONTRACTING OFFICE KO

POC: HENNING MAYER-GOLDSTEIN

CMR 402

APO AE 09180

0011061510

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print)

30-105-04EXCEPTION TO SF 30

APPROVED BY OIRM 11-84

STANDARD FORM 30 (Rev. 10-83) Prescribed by GSA

FAR (48 CFR) 53.243

The purpose of this amendment is to publicize the questions and answ ers.

1. CONTRACT ID CODE PAGE OF PAGES

J 1 10

16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

16C. DATE SIGNED

BY 18-Sep-2017

16B. UNITED STATES OF AMERICA15C. DATE SIGNED15B. CONTRACTOR/OFFEROR

(Signature of Contracting Officer)(Signature of person authorized to sign)

8. NAME AND ADDRESS OF CONTRACTOR (No., Street, County, State and Zip Code) X W9114F-17-T-0105

X 9B. DATED (SEE ITEM 11)

23-Aug-2017

10B. DATED (SEE ITEM 13)

9A. AMENDMENT OF SOLICITATION NO.

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipt of Offer is extended, X is not extended.

Offer must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended by one of the following methods:

(a) By completing Items 8 and 15, and returning 1 copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted;

or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN

REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE

CONTRACT ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(B).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

10A. MOD. OF CONTRACT/ORDER NO.

2. AMENDMENT/MODIFICATION NO. 5. PROJECT NO.(If applicable)

6. ISSUED BY

3. EFFECTIVE DATE

18-Sep-2017

CODE

W40M REG HEALTH CONTRACT OFFICE- EUROPE

CONTRACTING OFFICE KO

CMR 402

APO AE 09180

W9114F 7. ADMINISTERED BY (If other than item 6)

4. REQUISITION/PURCHASE REQ. NO.

CODE W9114F

FACILITY CODECODE

EMAIL:TEL:

W9114F-17-T-0105

SECTION SF 30 BLOCK 14 CONTINUATION PAGE

SUMMARY OF CHANGES

SECTION SF 1449 - CONTINUATION SHEET

SUPPLIES OR SERVICES AND PRICES

CLIN 0006

The CLIN extended description has changed from:

Travel expenses to cover air/hotel/food/etc. in accordance with the DOD Joint Travel Regulation (JTR). - This includes one 4-day trip to site for super-user training and go-live support. Receipts of Travel Expenses must be submitted with the invoice. Profit is not authorized on this item. The amount of this item is a NOT-TO-EXCEED AMOUNT. The U.S. Government will not pay for business class or first-class travel. Lodging and meals shall be reimbursed in accordance with the standard per diem rates in the DOD Joint Travel Regulation (JTR). There may be circumstances when the JTR authorizes a discretionary travel and transportation expense, but the task order remains silent. In such circumstances, the expense is not allowable and will not be reimbursed. Reimbursable costs will be reviewed by the COR and certified by the KO. The website for per diem rates is:

http://www.defensetravel.dod.mil/site/perdiem.cfm.Additional trips have to be prior approved by the COR and paid outside this contract.

To:

Travel expenses to cover air/hotel/food/etc. in accordance with the DOD Joint Travel Regulation (JTR). - This includes one 4-day trip to site for super-user training and go-live support. Receipts of Travel Expenses must be submitted with the invoice. Profit is not authorized on this item. The amount of this item is a NOT-TO-EXCEED AMOUNT. The U.S. Government will not pay for business class or first-class travel. Lodging and meals shall be reimbursed in accordance with the standard per diem rates in the DOD Joint Travel Regulation (JTR). There may be circumstances when the JTR authorizes a discretionary travel and transportation expense, but the purchase order remains silent. In such circumstances, the expense is not allowable and will not be reimbursed. Reimbursable costs will be reviewed by the COR and certified by the KO. The website for per diem rates is:

http://www.defensetravel.dod.mil/site/perdiem.cfm.Additional trips have to be prior approved by the COR and paid outside this contract..

The following have been added by full text:

QUESTIONS AND ANSWERS

Questions and Answers

Question 1: The Quantity is set to 12. Does that mean you would like the unit price to be a monthly price?

Note: Most DoD contracts have a quantity for each year of 1 and a unit of ‘Each’, thus have the unit price be the annual price.

Answer: The unit of issue on line item 0001 and 0002 and their subsequent optional periods are ‘Month’.

This was done to the benefit of the contractor. With a quantity of ‘1’, a unit of issue of ‘Each’ and a period of performance of a year, the contractor would have to wait until the year is over to be able to submit the invoice. On the other hand, with the same period of performance of a year, a quantity of ‘12’ and unit of issue of ’Month’, the contractor has the opportunity to invoice at the end of each month, if they desire to do so.

Question 2: It might be too late, but we suggest 2 trips instead of only 1. The go-live and super-user training is already covered in the current Request for Quotation. However, we suggest a second one for workflow preparation, IT consultation and clinical leadership preparation for a length of 2-3 days.

Answer: As already mentioned in the Request for Quotation (RFQ), there is only one trip authorized under this purchase order.

Question 3: On RFQ page 13 it states the following: "2. Scope of Work. The Contractor shall address the need to enable the patient and the provider to digitally sign an informed consent form that clearly identifies the procedure and associated risks, in Spanish and English. Informed consent documents shall be stored electronically and meet legal and Joint Commission requirements for informed consent of the patient. Software will require connectivity and integration with existing RHCE systems."

We suggest removal "form that clearly identifies the procedure and associated risks" and "and meet legal and Joint Commission requirements for informed consent of the patient" from the paragraph mentioned above.

Answer: The following verbiage was removed: “form that clearly identifies the procedure and associated risks”

Question 4: On RFQ page 13 it states the following: "3.1. Deliver a solution capable of providing procedure specific informed consent documents, patient education documents (both standard and easy reading format), pre and post procedure patient instructions, anatomical and procedure specific images, standard patient forms for use in hospital or clinic and patient information sheets for prescription and over the counter medication."

We suggest removal "standard patient forms for use in hospital or clinic" from the above mentioned paragraph.

Answer: The following verbiage was removed: “standard patient forms for use in hospital or clinic”

Question 5: On RFQ page 13 it states the following: "3.4. Perform the server setup and system installation on a

Government furnished server."

We suggest removal " server setup and " from the above mentioned paragraph because we think that this should not be the Contractors responsibility.

Answer: Paragraph 3.4 was changed to read: “3.4 Issue recommendations for server setup and system installation on Government furnished server”

Question 6: On RFQ page 13 it states the following: "3.5. Test the software to ensure proper functionality."

AND "3.6. Establish redundancy to ensure availability."

We suggest removal of both paragraphs because we think that this should not be the Contractor's responsibility.

Answer: Paragraph 3.5 was changed from “Test the software to ensure proper functionality” to “Reserved”.

Paragraph 3.6 was changed from “Establish redundancy to ensure availability” to “Enable redundancy to ensure availability”.

Question 7: On RFQ page 14 it states the following: "4.3. General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Army data, to ensure the confidentiality, integrity, and availability of Army data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow:

We suggest replacement of the word "ensure" with "enable".

Answer: The word “ensure” was replaced with “enable”.

Question 8: RFQ page 14 it states the following: "4.5.1. Contractor Information Systems (IS)/networks that are involved in the operation of systems in support of the Army’s Health System shall operate in accordance with controlling laws, regulations, and Army policy."

We suggest removal of this paragraph because we think that this is not applicable.

Answer: Paragraph 4.5.1 was changed to read “Reserved” as requirements rolled into RMF A&A.

Question 9: On RFQ page 14 it states the following: "4.5.2. Assessment & Authorization (A&A) requirements apply to all Army and contractor's IS/networks that receive, process, display, store or transmit Army information. The contractor shall comply with the A&A process for safeguarding SI.

Certification is the determination of the appropriate level of protection required for IS/networks.

Certification also includes a comprehensive evaluation of the technical and non-technical security features and countermeasures required for each system/network."

May we see these requirements?

Answer: All federal agencies must be in compliance with the Risk Management Framework (RMF) which is based up National Institute of Standards and Technologies (NIST) Special Publications 800-37 and 800-53. These two publications clearly define compliance and FISMA regulations that all DoD entities must follow.

Question 10: On RFQ page 16 it states the following: "4.5.14. Disposing of Electronic Media. Vendors shall follow the Army standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with Army Regulation 25–2, "Information Assurance” and Army Best Business Practices (BBP), “Reuse of Computer Hard Drives.”"

We suggest removal of this paragraph because we think that this should not be the Contractor's

Answer: Paragraph 4.5.14 was changed to read as follows: “4.5.14. Disposing of Electronic Media. If vendor owned and managed hardware is required to meet the requirements of the contract, the vendor shall follow the Army standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with Army Regulation 25–2, "Information Assurance” and Army Best Business Practices (BBP), “Reuse of Computer Hard Drives.””

Question 11: On RFQ page 16 it states the following: "4.5.16. Public Key Infrastructure and Encryption.

Vendors shall follow the Army standards, policies, and procedures related to the use of Public Key Infrastructure (PKI) certificates and biometrics for positive authentication. Where interoperable PKI is required for the exchange of unclassified information between the Army and its vendors and contractors, industry partners shall obtain all necessary certificates. Vendors must turn over to the Army all encryption keys for deployed systems, backdoor algorithms, and procedures for their use in remote support. The Vendor must provide a written report detailing all of the above, prior to task order expiration, regardless of modifications or extensions."

Could you please explain which extensions you are referring to?

Answer: The extensions referred to in question 11 pertain to any modification or extensions requests for the implementation task order after the system has been purchased and approved for use on the DoD network. However, as this acquisition does not include any “task orders”, this was replaced with “purchase order” in paragraph 4.5.16 and in line item 0006.

Question 12: On RFQ page 16 it states the following: "4.6.1.The contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Army Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with Army regulations."

We suggest removal of this paragraph because we think that this should not be the Contractor's

Answer: Paragraph 4.6.1. was changed to read as follows: “4.6.1.The contractor shall employ logical security controls for IS/Networks involved in processing or storage of Army Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with Army regulations.”

(End of Questions and Answers)

The following have been modified:

ADDENDUM TO FAR 52.212-4

Addendum to 52.212-4 – Add Paragraph (g) (3) Invoicing, Receipt, Acceptance and Property Transfer (iRAPT) iRAPT is the authorized method to electronically process vendor request for payment. This application allows DOD vendors to submit and track Invoices and Receipt/Acceptance documents electronically. Contractor shall (i) register to use iRAPT at https://wawf.eb.mil and (ii) ensure an electronic business point of contract (POC) is designated in the System for Award Management at https://www.sam.gov within ten (10) calendar days after award of this contract/order.

iRAPT Instructions:

Questions concerning payments should be directed to the Defense Finance and Accounting Service (DFAS) DFAS- Europe Attn: Rome, Kleber Kaserne (Block 18a of your purchase order/contract) at 011-49-631-411-6522/6523 or faxed to 011-49-631-411-6171. Please have your purchase order/contract number ready when calling about payments.

You can easily access payment and receipt information using the DFAS web site at http://www.dfas.mil/contractorsvendors.html. Your purchase order/contract number or invoice number will be required to inquire status of your payment.

The following codes and information will be required to assure successful flow of iRAPT documents.

Foreign Vendors will submit banking information in the Comments Tab of the iRAPT invoice.

TYPE OF DOCUMENT

X Invoice and Receiving Report (COMBO)

CAGE CODE: TBD

ISSUE BY DODAAC: W9114F

ADMIN BY DODAAC: W9114F

INSPECT BY DODAAC: W91M4F

ACCEPT BY DODAAC: W91M4F

SHIP TO DODAAC: W91M4F

PAYMENT OFFICE FISCAL STATION CODE: HQ0672

EMAIL POINTS OF CONTACT LISTING:

INSPECTOR/ACCEPTOR: Kelly.A.Darby.civ@mail.mil

RECEIVING OFFICE POC: Kelly.A.Darby.civ@mail.mil

CONTRACT ADMINISTRATOR/ SPECIALIST: Henning Mayer-Goldstein

HenningFalk.Mayer-Goldstein.LN@mail.mil

DSN: 314-590-6789

Phone: 011-49-6371-9464-6789 Fax 011-49-6371-86-8070

CONTRACTING OFFICER: See Block 31b on SF1449 for email address.

ADDITIONAL CONTACT: MAJ Husbands

Jennifer.B.Husbands.mil@mail.mil

DSN: 314-590-4525

Phone: 011-49-6371-9464-4525

Mr. Dominick J. Pecora Dominick.J.Pecora2.civ@mail.mil

DSN 314-590-5403

Phone: 011-49-6371-9464-5403

Modification requests must be in writing and submitted to:

Regional Health Contracting Office-Europe Bldg. 3705, Room 307, Attn: Henning Mayer-Goldstein 66849 Landstuhl Germany

Add paragraph 52.212-4(w) - The non-FAR Part 12 discretionary FAR, DFARS, AFARS, and LOCAL clauses included herein are incorporated into this contract either by reference or in full text. If incorporated by reference, see clause 52.252-2 herein for locations where full text can be found.

Add paragraph 52.212-4(x) - SHARP - Advisory publications Army Regulation 600-20, Army Command Policy, 6 November 2014.

OTSG/MEDCOM Policy Memo 16-033, OTSG/MEDCOM Policy Memo 16-033, Sexual Harassment/Assault Response and Prevention (SHARP) Program, 29 March 2016

Add paragraph 52.212-4 (y) Informed Consent Software:

1. Introduction. Regional Health Command Europe (RHCE) requires a software product that will allow Military Treatment Facilities (MTF) to meet requirements for informed consent which insures that patients have received and signed an informed consent form for procedures, anesthesia, and treatments.

2. Scope of Work. The Contractor shall address the need to enable the patient and the provider to digitally sign an informed consent, in Spanish and English. Informed consent documents shall be stored electronically and meet legal and Joint Commission requirements for informed consent of the patient. Software will require connectivity and integration with existing RHCE systems.

3. Deliverables. The Contractor shall provide the following:

3.1. Deliver a solution capable of providing procedure specific informed consent documents, patient education documents (both standard and easy reading format), pre and post procedure patient instructions, anatomical and procedure specific images, and patient information sheets for prescription and over the counter medication.

3.3 Provide the required specifications for patient demographics and provider information that will be used by the informed consent software.

3.4. Issue recommendations for server setup and system installation on Government furnished server.

3.5. Reserved.

3.6. Enable redundancy to ensure availability.

3.7. Provide software application manuals and training. Training shall include four train-the-trainer application training sessions. In addition, provide over the shoulder support to end users as the application goes live in each clinical area. Trainer for over the shoulder training shall be on call and available 24 hours per day for three days during each clinic deployment.

3.8. Provide interface and interface support for current enterprise clinical systems (e.g. Essentris, CHCS or AHLTA) and future systems (MHS Genesis) during and through transition.

3.9. Provide software updates, patches, and new releases at no additional charge. Interfaces with current Government systems (e.g. Essentris, CHCS or AHLTA) shall be considered a software update.

3.10. Provide application technical support via remote access 24 hours per day, 7 days per week.

4. Information Assurance Requirements.

4.1. Contractor shall agree with the Defense Health Agency (DHA) Business to Business (B2B) approved method for remote access.

4.2. Assist the RHCE Information Management team with completion of a cybersecurity review for the Authority to Operate (ATO)

4.3. General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Army data, to enable the confidentiality, integrity, and availability of Army data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow:

4.3.1. Health Insurance Portability and Accountability Act (HIPAA). The contractor shall:

4.3.1.1. Implement administrative, physical, and technical safeguards that will protect the confidentiality, integrity, and availability of the PHI.

4.3.1.2. Ensure all agents or subcontractors to whom the business associate provides PHI will also implement reasonable and appropriate safeguards to protect the information.

4.3.1.3. Report all security incidents.

4.3.1.4. The Government shall terminate the contract if the Contractor violates the terms of the contract.

4.4. Personnel Security.

4.4.1. The contractor shall comply with Army Regulation 25–2, "Information Assurance” (IA), Army Regulation 25–1, “Army Knowledge Management and Information Technology,” and " DoD Health Information Privacy Regulation."

4.4.2. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

4.4.2.1. Follow the Army guidelines for submittal of Information Technology (IT) security background checks and ensure all contractor personnel are designated as IT-I, IT-II, or IT-III where their duties meet the criteria of the position sensitivity designations. Contact the RHCE Information Assurance Manager (IAM) for guidance on the appropriate IT levels for personnel on the contract.

4.4.2.2. Initiate, maintain, and document personnel security investigations appropriate to the individual's responsibilities and required access to MEDCOM Sensitive Information (SI).

4.4.2.3. Immediately report to the RHCE IAM and deny access to any automated information system (AIS), network, or MEDCOM SI information if a contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate Army representative for security reasons.

4.4.2.4. Ensure that all contractor personnel receive information assurance (IA) training before being granted access to Army AISs/networks, and/or MEDCOM SI information.

4.5. Electronic Security.

4.5.1. Reserved.

4.5.2. Assessment & Authorization (A&A) requirements apply to all Army and contractor's IS/networks that receive, process, display, store or transmit Army information. The contractor shall comply with the A&A process for safeguarding SI. Certification is the determination of the appropriate level of protection required for IS/networks.

Certification also includes a comprehensive evaluation of the technical and non-technical security features and countermeasures required for each system/network.

4.5.3. Accreditation is the formal approval by the DHA to operate the contractor's IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In addition, accreditation allows IS/networks to operate within the given operational environment with stated interconnections; and with appropriate level of protection for the specified period.

4.5.4. The contractor shall comply with A&A requirements, as specified by the DHA that meet appropriate Information Assurance requirements. The A&A requirements shall be met before the contractor's system is authorized to access Army data or interconnect with any Army. IS/network that receives, processes, stores, displays or transmits Army data. The contractor shall initiate the A&A process by providing the Contracting Officer, within 60 days following contract award, the required documentation necessary to receive an ATO. The contractor shall make their IS/networks available for testing, and initiate the A&A testing four months (120 days) in advance of accessing Army data or interconnecting with Army IS/networks. The contractor shall ensure the proper contractor support staff is available to participate in all phases of the A&A process. They include, but are not limited to:

4.5.4.1. Attending and supporting A&A meetings with the DHA

4.5.4.2. Supporting/conducting the vulnerability mitigation process

4.5.4.3. Supporting the A&A Team during system security testing

4.5.5. Contractors must confirm that the IS/networks are locked down prior to initiating testing.

4.5.6. Conformation of system lock down shall be agreed upon during the definition of the A&A boundary and be signed and documented as part of the Risk Management Framework (RMF).

4.5.7. Locking down the system means that there shall be no changes made to the configuration of the system (within the A&A boundary) during the A&A process.

4.5.8. Any re-configuration or change in the system during the A&A testing process will require a re-baselining of the system and documentation of system changes.

4.5.9. Vulnerabilities that have been identified by the DHA as "must-fix" issues during A&A process must be mitigated according to the timeline identified by the Army Representative. A&A Checklists are provided for complying A&A requirements. Reference material and A&A tools may be obtained at the DHA Cybersecurity Document Library (Portal): https://info.health.mil/hit/infosec/SitePages/Home.aspx

4.5.10. A request for a waiver to the A&A requirements may be submitted for temporary testing and other usual circumstances. A waiver request must be submitted, in writing, to the Designated Approving Authority (DAA). The request must include mitigation strategies that ensure adequate protection measures and security controls are in place (for example: air gapping a testing network).

4.5.11. Information Assurance Vulnerability Management (IAVM). The contractor shall implement an information assurance vulnerability management program. The Army IAVM program provides electronic security protections against known threats and vulnerabilities. The IAVM program requires the registration of AIS system assets, which then allows for the timely dissemination of critical vulnerability information. It also assists in the documentation and tracking of compliance, providing increased electronic security to systems.

4.5.12. The contractor shall maintain any development environments in accordance with DHA Cybersecurity best practices and operational requirements. During product development for the Army, the contractor shall ensure that all mitigation strategies have been applied to the development environment prior to any Army data being loaded onto any assets or software for testing or delivery.

4.5.13. Mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating system, routers, servers, development platforms and the application being delivered to the Army shall be in compliance with all known applicable Army Computer Emergency Response Team (ACERT) Alert, Bulletin, and Technical Advisory Notices published during the past 36 months.

4.5.14. Disposing of Electronic Media. If vendor owned and managed hardware is required to meet the requirements of the contract, the vendor shall follow the Army standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with Army Regulation 25–2, "Information Assurance” and Army Best Business Practices (BBP), “Reuse of Computer Hard Drives.”

4.5.15. Ports Protocols and Services. Vendors shall follow all current DHA standards and requirements for acceptable Ports, Protocols, and Services. Any requests for exception to using the current Army Ports, Protocols, and Services standards requires an request for exception sent through the Program Manager to the DAA.

4.5.16. Public Key Infrastructure and Encryption. Vendors shall follow the Army standards, policies, and procedures related to the use of Public Key Infrastructure (PKI) certificates and biometrics for positive authentication. Where interoperable PKI is required for the exchange of unclassified information between the Army and its vendors and contractors, industry partners shall obtain all necessary certificates. Vendors must turn over to the Army all encryption keys for deployed systems, backdoor algorithms, and procedures for their use in remote support. The Vendor must provide a written report detailing all of the above, prior to purchase order expiration, regardless of modifications or extensions.

4.6. Information Systems (IS)/Networks Physical Security.

4.6.1. The contractor shall employ logical security controls for IS/Networks involved in processing or storage of Army Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with Army regulations.

4.6.2. The contractor shall correct any deficiencies identified by the DHA of the contractor's physical security posture. The contractor shall be required to follow all requirements in the Army’s Information Assurance Policy.

New Army policies will be posted to the following website: http://www.apd.army.mil/.

4.6.3. The contractor shall ensure that data which contains PHI is continuously protected from unauthorized access, use, modification, or disclosure. The contractor shall comply with all previously stated requirements for HIPAA, Personnel Security, Electronic Security, and Physical Security.

(End of Summary of Changes)