A.09.03_Combined_Syn_Sol_Mammography_Equip_Maint.pdf

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in FAR Subpart 12.06. This announcement constitutes the only solicitation: quotes are being requested and a written solicitation will not be issued. Solicitation number W91YTZ-18-Q-0165 is issued as a Request for Quotation (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-98 and DFARS Publication (DPN) 20171228.

This acquisition is issued on an UNRESTRICTED, FULL AND OPEN basis under NAICS code 811219 and size standard is $20.5 M. The Government anticipates awarding a single award issued as Firm Fixed Price.

This requirement is for a onetime Mammography Unit Repair. The requirement of this solicitation is to provide equipment maintenance of a Government owned Mammography Unit at Winn Army Community Hospital, Ft Stewart, GA. The Government owned mammography equipment is used to complete routine and emergency examinations and diagnosis. All responsible sources may submit a quotation which shall be considered by the agency.

Quotes are due by 13 August 2018 at 12:00 pm EST. Questions must be submitted via email no later than 6 August 2018. Quotes and questions shall be submitted via email to valerie.j.deveaux.civ@mail.mil.

SALIENT FUNCTIONAL CHARACTERISTICS:

Must be Factory Trained certified technician for the system listed in CLIN.

Proof of certification must be presented with bid.

ITEM NO. 0001 The requirements of this solicitation are for all supplies, labor, travel and materials necessary to perform ONETIME maintenance and repair on the Government owned Mammography Equipment at Winn Army Community Hospital, Ft Stewart, GA. Period of performance: 13 August 2018 through 30 September 2018.

QTY: 1 UNIT: EACH UNIT PRICE: $________ TOTAL: $_________

TOTAL $___________

Place of Performance Winn Army Community Hospital 1061 Harmon Ave Ft Stewart, GA 31314

The following FAR Clauses and Provisions in their latest editions apply to this solicitation.

52.212-1 Instructions to Offers –Commercial Items JAN 2017

Addendum to FAR 52.212-1 Instructions to Offerors—Commercial Items

FAR 52.212-1 is hereby amended to reflect the changes shown below:

Para (b) Submission of offers

All offerors must be registered in the System for Award Management (SAM) prior to award, and lack of registration shall make an offer ineligible for award. Offerors may obtain information on registration Internet at https://www.sam.gov. Or the SAM Help desk at https://www.fsd.gov.

mailto:valerie.j.deveaux.civ@mail.mil https://www.sam.gov/ https://www.fsd.gov/

All questions shall be submitted via email no later than 1:30PM EST August 6, 2018 to valerie.j.deveaux.civ@mail.mil. Responses will be posted to the Federal Business Opportunities website.

Proposals are being accepted via email only. All responsible sources should submit proposals to Valerie DeVeaux via e-mail: valerie.j.deveaux.civ@mail.mil by August 13, 2018 12:00 PM EST. (n) the non-Far Part 12 discretionary FAR, DFARS, AFARS and MEDCOM provisions included herein are incorporated into this solicitation either by reference or in full text. If incorporated by reference, see provision 52.252-1 for locations where full text can be obtained.

Cover email shall include: Data Universal Numbering System (DUNS) / CAGE Code, Point of contact for individual authorized to enter in to discussions to include phone and email.

All offers must request verification by email to Valerie DeVeaux Email: valerie.j.deveaux.civ@mail.mil to confirm receipt of their proposal was received by the time specified in the solicitation. The Government will not be responsible for any failure of transmission or receipt of the offer, or any failure of the offeror to verify receipt of the emailed offer.

Instructions for the Preparation of Proposals

The technical information required for evaluation purposes shall not exceed 10 pages. Each page shall be numbered.

The proposal shall be prepared in two (2) separate volumes as indicated below.

• Volume I-Technical

• Volume II-Pricing

VOLUME I – TECHNICAL

The technical proposal, Volume I, shall be addressed in sufficient written detail for the Government to determine if the offeror understands this aspect of the Government’s requirement. The offeror shall address each factor separately, and shall provide sufficient narrative and supporting data for each factor. Lack of any of these significant capabilities shall be considered sufficient cause for the proposal to be determined unacceptable. The Technical Proposal shall provide sufficient detail for the Government to determine whether the proposal acceptably meets the requirements of the solicitation. Statements that the offeror understands, can or will comply with all specifications, or statements paraphrasing the specifications of parts thereof, or phrases such as “standard procedures will be used” or “well-known techniques will be used” will be considered unacceptable. The technical proposal shall provide a narrative and supporting data with the following sections organized separately so that the evaluation factors listed below are included.

VOLUME II – PRICING

Assessment of price reasonableness based on comparison to market prices.

a. The offeror shall submit proposed pricing for all subcontract Line Item Numbers (subCLINs) identified in the Request for Proposal, unless otherwise noted. The offeror shall limit their unit and extended prices to two (2) decimal places (example: $158.03).

b. The offeror shall submit pricing totals for the base period and option years individually, as well as a grand total.

CLAUSES INCORPORATED BY REFERENCE

52.203-11 Certification and Disclosure Regarding Payment

To Influence Certain Federal Transactions

SEP 2007

52.204-16 Commercial and Government Entity Code Reporting

JUL 2016

mailto:valerie.j.deveaux.civ@mail.mil

52.222-22 52.222-46

Previous Contracts And Compliance Reports Evaluation of Compensation for Professional Employees

FEB 1999

FEB 1993

52.223-1 52.225-25

Bio Based Product Certification Prohibition on Contracting with Entities Engaging In Certain Activities or Transactions Relating to Iran-Representation and Certification

MAY 2012

OCT 2015

Incorporated by Full Text

52.209-2

52.209-7

Prohibition on Contracting with Inverted Domestic Corporations-Representations Information Regarding Responsibility Matters

NOV 2015

JUL 2013

52.216-1 Type of Contract: Firm Fixed Price APR 1984 52.222-25 52.233-2

Affirmative Action Compliance Service of Protest

APR 1984

SEP 2006

52.252-1 (FEB 1998), Solicitation Provisions Incorporated by Reference: The full text of a solicitation provision may be accessed electronically at this/these address (es): www.farsite.hill.af.mil or www.arnet.gov/far.

52.252-5, Authorized Deviations in Provisions (APR 1984): (b) the use in this solicitation or contract of any DoD FAR Supplement (48 CFR Chapter 2) provision with an authorized deviation is indicated by the addition of “(DEVIATION)" after the name of the regulation.

252.203-7005 Representation Relating to Compensation of Former DOD

Officials

NOV 2011

252.204-7008

252.204-7011 252.213-7000

252.215-7007 252.215-7008 252.222-7007 252.225-7020 252.225-7035

Compliance With Safeguarding Covered Defense Information Controls Alternate Line-Item Structure Notice to Prospective Supplies on Use of Past Performance Information Retrieval System-Statistical Reporting in Past Performance Evaluations Notice of Intent to Resolicit Only One Offer Representation Regarding Combating Trafficking in Persons Trade Agreements Certificate Buy American Free Trade Agreements-Balance of Payments Program Certificate-Basic

OCT 2016

SEP 2011

JUN 2015

JUN 2012

OCT 2013

JAN 2015

NOV 2014

NOV 2014

52.212-2

Evaluation –Commercial Items

OCT 2014

Addendum 52.212-2 (LPTA):

Paragraph (a) replaced with the following:

Award will be made using the lowest price technically acceptable (LPTA) source selection process. Award will be made to the responsible offeror on the basis of the lowest evaluated price of proposals meeting or exceeding the acceptability standards for non-cost factors. Award may be made without discussions with offerors (except communications conducted for the purpose of minor clarification). Therefore, each initial offer should contain the offeror's best terms from a technical and price standpoint. However, the http://www.farsite.hill.af.mil/ http://www.arnet.gov/far

Government reserves the right to conduct discussions if it is later determined by the contracting officer to be necessary.

The Government will award a Firm Fixed Price contract resulting from this solicitation to the responsible Offer whose offer conforming to the solicitation will be the most advantageous for the Government, price and other factors considered. In order to be considered for award, an Offeror must receive an Acceptable rating in all factors. The following factors shall be used to evaluate:

Technical and Price

Award will be made based on lowest price, technically acceptable proposal.

(a) A written notice of award or acceptance of an offer, mailed or otherwise furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contractor without further action by either party. Before the offer’s specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

FACTOR: 1 TECHNICAL

Training Certification - Provide in writing, documentation of your company certification to provide maintenance of Government owned equipment listed in CLIN.

Technical will be evaluated as either Acceptable or Unacceptable. Best value is expected to result from selection of the technically acceptable proposal with the lowest evaluated price. Definitions are as follows:

ACCEPTABLE: To be rated acceptable, the offeror's technical proposal must demonstrate it can meet all specifications and testing requirements.

UNACCEPTABLE: A technical proposal that fails to demonstrate it can meet one or more requirements will be determined unacceptable.

FACTOR II: PRICE

Price will be evaluated separately from Technical and will be evaluated for fairness and reasonability. The offeror shall complete the CLIN structure with a total cost covering a base period and three option years.

This information will be used to assist in the price analysis as required by FAR 15.404-1(b).

52.212-3 Offeror Representations and Certifications--Commercial Items (JAN 2017) Alternate I OCT 2014

52.212-4 Contract Terms and Conditions--Commercial Items JAN 2017

52.212-4 ADDENDUM

(w) the non-FAR Part 12 discretionary FAR, DFARS, AFARS, and Local clauses herein are incorporated into this contract either by reference or in full text. If incorporated by reference, see clause 52.252-2 for locations where full text can be found.

52.204-4 Printed or Copied on Double-sided Post Consumer

Fiber Content Paper

MAY 2011

52.204-10 Reporting Executive Compensation and First-Tier Subcontract Awards

OCT 2016

52.204-18 Commercial and Government Entity Code Maintenance

JUL 2016

52.209-6

52.209-9

52.219-9

Protecting the Government's Interest When Subcontracting With Contractors Debarred, Suspended, or Proposed for Debarment Updates of Publically Availability Information Regarding Responsibility Matters Small Business Subcontracting Plan

JUL 2013

JAN 1999

52.222-3 52.222-19

Convict Labor Child Labor-Cooperation With Authorities and Remedies

JUN 2003

JAN 2014

52.222-21 Prohibition Of Segregated Facilities APR 2015 52.222-26 Equal Opportunity SEP 2016 52.222-35 Equal Opportunity For Veterans OCT 2015 52.222-36 Equal Opportunity for Workers with Disabilities JUL 2014 52.222-37 Employment Reports on Veterans OCT 2015 52.222-50 Combating Trafficking in Persons MAR 2015 52.222-54 Employment Verification OCT 2015 52.223-2 Affirmative Procurement of Bio based Products

Under Service and Construction Contracts

SEP 2013

52.223-3 Hazardous Material Identification and Material Safety Data

JAN 1997

52.223-5 Pollution Prevention and Right-to-Know Information

MAY 2011

52.223-18 Encouraging Contractor Policies To Ban Text Messaging While Driving

AUG 2011

52.224-1 Privacy Act Notification APR 1984 52.224-2 Privacy Act APR 1984 52.225-13 Restrictions on Certain Foreign Purchases JUN 2008 52.228-5 Insurance—Work on A Government Installation JAN 1997 52.232-33 Payment by Electronic Funds Transfer--System for

Award Management

JUL 2013

52.232-39 Unenforceability of Unauthorized Obligations JUN 2013 52.232-40 Providing Accelerated Payments to Small Business

Subcontractors

DEC 2013

52.233-3 Protest After Award AUG 1996 52.233-4 Applicable Law for Breach of Contract Claim OCT 2004 52.237-2 Protection Of Government Buildings, Equipment, And Vegetation

APR 1984

52.242-5 52.242-13

Payment to Small Business Subcontractors Bankruptcy

JAN 2017

JUL 1995

252.203-7000 Requirements Relating to Compensation of Former

DoD Officials

SEP 2011

252.203-7002 Requirement to Inform Employees of Whistleblower Rights

SEP 2013

252.204-7003

252.209-7004

252.219-7003

Control Of Government Personnel Work Product

Subcontracting With Firms That Are Owned Or Controlled By the Government of A Country That is A State Sponsor of Terrorism Small Business Subcontracting Plan (DOD Contracts)

APR 1992

MAR 2016

252-225-7002 252.225-7012 252.225-7021

Qualifying Country Sources as Subcontractors Preference for Certain Domestic Commodities Trade Agreements

AUG 2016

FEB 2013

SEP 2016

252.225-7048 252.226-7001

Export-Controlled Items Utilization of Indian Organizations, Indian-Owned Economic Enterprises, And Native Hawaiian Small Business Concerns

JUN 2013

SEP 2004

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports

JUN 2012

252.232-7006 Wide Area Workflow Payment Instructions MAY 2013 252.232-7010 Levies on Contract Payments DEC 2006 252.243-7001 Pricing of Contract Modifications DEC 1991 252.243-7002 Requests for Equitable Adjustments DEC 2012

Incorporated in Full Text

52.209-10 Prohibition On Contracting With Inverted Domestic

Corporations

NOV 2015

(End of clause)

52.219-28 Post Award Small Business Program Rerepresentation JUL 2013 52.222-40

Notification of Employee Rights Under the National Labor Relations Act

DEC 2010

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address (es):

www.farsite.hill.af.mil.

(End of clause)

52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES (APR 1984)

(a) The use in this solicitation or contract of any Federal Acquisition Regulation (48 CFR Chapter 1) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the clause.

(b) The use in this solicitation or contract of any DoD FAR Supplement (48 CFR Chapter 2) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the name of the regulation.

(End of clause) http://www.farsite.hill.af.mil/

252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting

OCT 2016

252.204-7015 Disclosure of Information to Litigation Support Contractors

MAY 2016

252.244-7000 Subcontracts for Commercial Items and Commercial Components

JUN 2013

252.247-7023 252.247-7024

Transportation of Supplies by Sea-Basic Notification of Transportation of Supplies By Sea

APR 2014

MAR 2000

End of Additional FAR and DFARS clauses

Incorporated in Full Text

52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders—Commercial Items (Deviation 2013-O0019)

JAN 2017

Winn Army Community Hospital Fort Stewart, GA

PERFORMANCE WORK STATEMENT (PWS)

1. One time On-site Service Repair for the below listed items:

Radiographic Unit, Mammography

Location: Winn Army Community Hospital 1061 Harmon Avenue Ft.Stewart, GA 31314

2. GENERAL SCOPE OF WORK

2.1. The contractor shall provide all repair parts, labor, test equipment, travel, and materials not government furnished, necessary to repair a Radiographic Unit,Mammography. Make the unit operational to manufacturer’s specifications.

Services under this Contract shall be performed by individuals who have been Factory Trained and show documentation of the training on the described system and competence in the servicing and maintaining the system under this Contract. The contractor shall be responsible for ensuring that the quality of service and materials provided under this contract meet or exceed the Performance Work Statement.

Medical Device Risk Assessment Questionnaire v1.1

To ascertain security compliance that is in agreement with Federal, DoD, and DHA directives and policies, Defense Logistics Agency Troop Support (DLA-TS) requires the vendor complete the following Medical Device Risk Assessment Questionnaire.

All Medical Systems/Devices are required to meet DoD Cybersecurity and NIST Standards. The information provided below will be used to support all stakeholders working to achieve an Authorization Certificate.

Failure to meet Cybersecurity requirements, disclose that a system cannot meet Cybersecurity requirements, or failure to meet certification timeframes shall result in Denial of an Authority to Operate

(DATO).

The information provided below (which include but not limited to data processing capabilities, current security posture, and level of compliance with the Cybersecurity principles of Confidentiality, Integrity, Availability, and Non-Repudiation will be used to identify the technical characteristics of the System/Device and determine the level of effort, applicable checklist, and potential actions required prior to and during an Assessment & Authorization process, from an Cybersecurity standpoint.

BLUE SECTION – ALL FIELDS MUST BE ADDRESSED; THEREFORE NO RESPONSES, N/A, OR REFERENCES TO EXTERNAL

DOCUMENTS ARE NOT ACCEPTABLE.

PREPARER IDENTIFICATION INFORMATION

Date:

Name:

Job Title:

Company:

Business Address:

E-Mail Address:

Phone Number:

Web page Address:

SYSTEM IDENTIFICATION

1.1 Medical Device Name/Title:

Provide the naming convention for the system.

1.1a Medical Device Acronym: Provide the acronym associated with the medical device, if applicable.

1.1b Food and Drug Administration (FDA 510K) or Premarket Authorization letter number, if applicable:

Provide the number associated with the medical device, if applicable.

1.1c Medical Device Functionality Description:

System Functional Description – Provide a brief description of the system functions. For example: The ACME Computer Tomography scanner is a radiographic system used in hospitals, clinics, and medical practices. It enables radiographic and tomographic exposures of the whole body including: skull, chest, abdomen, and extremities. The ACME Tomography system converts x-rays to electronic signals.

1.2 Mode of operation:

Select the intended mode of operation of the medical device.

Standalone – Operates in complete isolation and thus does not require the use of networking protocols.

Peer to Peer – Operates in complete isolation but requires the use of networking protocols.

Client/Server – Operates as a distributed application that partitions task or workloads between the service requester (client) and the service provider (server) through the use of networking protocols.

Web-based – Operates as a distributed application that requires the use of a browser to access the primary application. There is no client software installed on the client workstation.

Host-based – Operates as a passive subsystem which requires connection a host computer to produce information. It may require the use of networking protocols.

None of the above – Does not receive, process, store, display information

1.7 Operating System (OS) - Continued:

Operating System (OS) – Select each and all instances of operating systems used throughout the proposed medical device. Make sure to identify all instances regardless of platform (i.e. server, client, peer, standalone, portable, peripheral end point device), and mode of operation (physical, virtual).

(SELECT ALL THAT APPLY)

LINUX/UNIX

Red Hat

Fedora

SUSE Linux Enterprise openSUSE Linux

Debian

Ubuntu

BSD

Knoppix

Mandriva

Oracle Solaris

CentOS

Google Chromium

Android OS

QNX

Apple OS

Apple IOS

Cisco IOS

Cisco NX

Juniper JUNOS

VMware ESX/ESXi, vSphere

Wind River - VxWorks RTOS

1.8 Relational Database Management System (RDMS), if

applicable:

Specify title, version, and service pack/release number of each database engine used by the proposed medical device.

1.9 Ports & Protocols:

Note: You may provide the resulting output from a NETSTAT –A command if applicable.

(Ports, Protocols and Services (PPS) – List all Ports, Protocols, and Services used by the proposed medical device. Include for each Port Number: Data Service, Protocol, Purpose, Source and Destination). For example, Hypertext Transport Protocol over Secure Socket Layer (HTTPS/SSL) TCP port 443.

Manufacturer Proprietary Operating Systems

Other Operating Systems Not Listed

RDBMS Title Version

1.10 Antimalware:

Antimalware – Indicate whether the proposed medical device supports the use of Antimalware applications. If so, indicate which products, including title, version and build number, that have been validated for use with the medical device. For example, Symantec Endpoint Protection version 1.0

1.11 Public Internet:

Public Internet – Does the proposed medical device require connectivity (permanent, temporary) to the public Internet in order to operate?

1.12 Operating System (OS) Lifecycle Support:

Describe the licensing method of the operating system, including its anticipated End of Life (EOL) date and provisions for Extended support once the operating system is no longer supported by the manufacturer.

1.13 IPv6 Capability:

Is the proposed medical device IPv6 Capable? IPv6 ‘capable’ is defined as a system or product capable of receiving, processing, and forwarding IPv6 packets and/or interfacing with other systems and protocols in a manner similar to IPv4.

1.14 Automatic Logoff

Does the medical device provide any of the following capabilities to ensure system security if the clinical user walks away without logging out?

(If the Operational Use Case makes this a prohibitive process, please provide justification)

(SELECT ALL THAT APPLY)

Ability to configure the forced reauthorization of logged-in user(s) after a predetermined length of inactivity (e.g. auto-logoff, screen lock, password protected screensaver?)

Ability to configure the length of inactivity time before auto-logoff/screen lock (indicate time

[fixed or configurable range] Ability to manually invoke auto-logoff/screen lock (e.g. via a shortcut key or proximity sensor)

1.15 DoD Warning Banner

Does the medical device provide the capability to implement a customizable warning banner during user login that would enable for display of the DoD Warning Banner?

Yes No

SYSTEM IDENTIFICATION

1.16a Medical Device Architecture Diagram (simple topology)

Provide a block diagram depicting all subsystems and components of the proposed medical device as configured in your proposal. Include connection specifications such as: Ethernet Connection, Wireless Connection or Bluetooth Connection The sample diagram shown below may be used as a template for simple topology architectures. You may include an embedded Microsoft Visio diagram with your submission.

SYSTEM IDENTIFICATION

1.16b Medical Device Architecture Diagram (complex topology)

Provide a block diagram depicting all subsystems and components of the proposed medical device as configured in your proposal. The sample diagram shown below may be used as a template for complex topology architectures. You may include an embedded Microsoft Visio diagram with your submission.

GOLD SECTION – THE SECTION THAT FOLLOWS CONTAINS A SERIES OF QUESTIONS REQUIRING A HIGH DEGREE OF FAMILIARITY WITH CONCEPTS AND TERMINOLOGY USED IN INFORMATION TECHNOLOGY. THEREFORE, COMPLETION OF THIS SECTION OF THE MEDICAL DEVICE RISK ASSESSMENT QUESTIONNAIRE BY TECHNICAL PERSONNEL IS REQUIRED. YOU MAY PROVIDE ADDITIONAL PAGES CONTAINING NON-APPLICABLE RESPONSE JUSTIFICATIONS.

GOLD SECTION PREPARER IDENTIFICATION INFORMATION

Date:

Name:

Title:

Company Name and Address:

Phone Number:

E-Mail Address:

SYSTEM IDENTIFICATION QUESTIONS

2.1 How does the proposed medical system/device ensure Confidentiality?

(Describe how the system/device prevents the disclosure of information to unauthorized individuals and/or systems.)

2.2 How does the proposed medical system/device ensure Integrity?

(Describe how the system/device prevents the modification of data by unauthorized individuals and/or systems.)

2.3 How does the proposed medical system/device ensure Availability?

(Describe how the system/device ensures that the information is available to authorized individuals and/or systems.)

2.4 How does the proposed medical system/device ensure Non-Repudiation?

(Describe how the system/device ensures transactions are properly recorded and contain traceable information for auditing purposes.)

2.5 How does the proposed medical system/device protect Data at Rest (DAR)?

(Describe how the system/device protects data at rest, for example encryption.)

2.6 How does the proposed medical system/device protect Data in Transit (DIT)?

(Describe how the system/device protects data in transit, for example encryption.)

2.7 Does the proposed medical system/device include a test environment instance (physical/virtual)?, if so describe (The purpose of a test environment instance is to allow for the validation and testing of new system components prior to deployment on a production host. These may include software security updates and patches affecting the operating system, primary application, third-party software, database engine, and configuration files). A test environment instance can be physically implemented by using a dedicated (non-production) host, or virtually using a hypervisor.

2.9 PRIMARY APPLICATION

2.9a Primary Software Application:

Primary Software Application – Provide the title, version, build number and service pack/release number of the primary software application. List all add-ons required by the application, if applicable, such as Virtual Machines, and application software frameworks. For example, ACME Inc. Medical Instrumentation Management System (MIMS) version 3.10 Service Release 2 utilizing Microsoft .NET 3.5 framework.

2.9b Virtualization:

State whether the proposed medical system/device utilizes virtualization technologies. These may include the following:

• Operating System virtualization

• Application/Workspace

• Virtual Desktop Interfaces (VDI)

• Storage virtualization

• OSI Layer 2/3 switching/routing appliances

2.9c Web Server:

Web Server – if the proposed medical device/system includes one or more web server components, indicate the title and version of the web server engine, for example Microsoft IIS 7.1 or Apache 2.4.10.

2.9d Browsers:

Browsers – If the proposed system requires the use of a browser as the primary application user interface, indicate which versions are supported, for example; Microsoft Internet Explorer 11.

2.9e Backward Compatibility:

Backward compatibility– Describe in detail to what level, does the proposed medical device/system support the operation, interfacing, and exchange of information with regards to previous versions/releases of the same system.

2.9f Distribution and Installation of Security Updates:

Describe the method used to distribute and install security updates, to include both vendor and user responsibilities.

If the distribution of Updates/Fixes requires access to a web portal, please provide its URL.

2.9g Primary Application Licensing method:

Describe the licensing method of the primary application, including its anticipated End of Life (EOL) date and provisions for Extended support once the primary application is no longer supported by the manufacturer.

You may include the anticipated release dates of future versions of the same application if known.

2.9h Network Addressing/Data Communication Protocols:

Network Addressing/Data communication protocol customization: Describe components of the system, if any which rely on the use of TCP/IP addresses and Ports that are hardcoded and cannot be modified without a complete rewrite of the application software.

2.9i Network Time Protocol (NTP):

requires the use of a built-in Network Time Protocol source. If so, indicate if this setting can be permanently disabled so as to receive NTP information from the Local Authoritative NTP host provided by the hosting enclave over TCP/UDP port 123.

2.9j Database Engine:

Databases (DB) – List all instances of Database engines including Relational Database Management Systems (RDBMS), and/or flat file based. Include Database title, version, Service Pack/Release. For example, Microsoft SQL Server 2005 Service Pack 2. Describe database authentication method, for example; SQL authentication/Active Directory Integrated authentication, or Mixed Mode authentication.

2.9k DNS Realm/Domain Integration:

If the proposed medical system/device, per design specifications, requires the exchange of data using the TCP/IP protocol, can the system integrate with a DNS Realm/Domain using the LDAP protocol? State whether all or some instances of IP addressable hosts can support this integration. For example; Application Server integrates with Microsoft Active Directory.

2.9l Automation support:

Does the medical system/device support the creation/customization of scripts designed to automate frequent tasks?

2.9m Compilers on production systems:

includes source code compilers/interpreters on production systems and whether they can be removed without affecting the operation of the system. Examples of compilers are:

Msc.exe, msvc.exe, Python.exe, javac.exe, Lcc-win32.exe, Microsoft SQL Studio, Microsoft Visual Studio, etc.

2.9y Instant Messaging:

Does the proposed medical system/device support any type of Instant Messaging (IM), if so describe.

2.9z Network Resources & Shares (SMB/CIFS, NFS, and

AFP):

Upon connecting to the Local Area Network, does the medical system/device make its file system available to other systems? If so, please indicate their purpose, default ACL/permissions, and access method (for example, UNC)

2.9aa SHA-256 Cryptographic & Hash Algorithm support:

If applicable, state whether the proposed medical system/device supports the use of SHA-256 Cryptographic and Hash algorithms in support of functions such as - Crypto Logon, reading digitally signed e-mail messages, digitally signing/encrypting data, and client-side PKI based authentication to web-based hosts.

Yes No

2.9ab Other Cryptographic & Hash Algorithm Support:

Please annotate the non SHA-256 Cryptographic and Hash Algorithms that the medical device uses.

2.9ac Security Capability Reconfiguration Describe how the device owner/operator reconfigures product security capabilities (e.g. implement system configuration changes and software patches). If the device owner/operator cannot reconfigure product security capabilities, provide statement explaining the mitigation. (e.g., The device owner or operator does not receive administration permissions that enable for system security changes).

2.10 APPLICATION DEVELOPMENT ENVIRONMENT (non-web based applications)

Programming Language(s) Target Applications

2.11 APPLICATION DEVELOPMENT ENVIRONMENT – (web browser based applications)

Programming Language(s) Target Applications

2.14 PHYSICAL/LOGICAL TOPOLOGY DIAGRAM WITH EXTERNAL INTERFACES AND DATA FLOW

Provide a block diagram depicting all interfaces used by the proposed medical system/device. Ensure that for each interface the direction of data flow is clearly shown. Diagram must also clearly show Ports, Protocols, and Services (PPS) for each connection. You may include an embedded Microsoft Visio diagram with your submission.

Data acquisition device Control

Module Data Processing subsystem

Workstations

Hardcopy device

Archive

2.18 FILE SYSTEM

List all external interfaces that support file systems (USB, IEEE1394, SD, SIM). Do not include software license/activation tokens.

System Purpose Required?

2.19 FILE SYSTEM

Does the system allow the implementation of file-level access controls? (e.g. NTFS, ext3, ext4, XFS)

2.20 GROUP POLICY OBJECTS (GPO) MICROSOFT WINDOWS OPERATING SYSTEMS ONLY:

Group Policy Objects – applies to Microsoft Operating Systems only.

Describe whether the proposed Microsoft Windows based medical system/device can accept Domain level issued Group Policy Objects without negatively impacting the confidentiality, integrity and availability of the system upon joining the production Domain.

Group Policy Object (GPO) Rule: Supported?

Minimum password length of 15 characters Yes No

Password must meet DoD complexity requirements (case sensitive, 15-characters, lower, upper, numeric, alphabetic, and special characters) Yes

No

Store passwords using reversible encryption Yes No

Audit account management – Success, Failure Yes No

Audit directory service access – Success, Failure Yes No

Audit object access – Success, Failure Yes No

Audit policy change – Success, Failure Yes No

Allow users to select new root certification authorities (CAs) to trust Yes No

Client computers can trust the following certificate stores – Third Party Root CAs and Enterprise Root CAs Yes No

Perform certificate-based authentication of users and computers, CAs must meet the following criteria – Registered in AD only Yes No

Enforce password history – 24 passwords remembered Yes No

Maximum password age – 60 days Yes No

Minimum password age – 1 day Yes No

Account lockout duration – 0 minutes Yes No

Account lockout threshold – 3 invalid logon attempts Yes No

Reset account lockout counter after – 60 minutes Yes No

Enforce user logon restrictions – Enabled Yes No

Maximum lifetime for service ticket – 600 minutes Yes No

Maximum lifetime for user ticket – 10 hours Yes No

Maximum lifetime for user ticket renewal – 7 days Yes No

Maximum tolerance for computer clock synchronization – 5 minutes Yes No

Enable computer and user accounts to be trusted for delegation – BUILTIN\Administrators Yes No

Network security: Do not store LAN Manager hash value on next password change – Enabled Yes

Network security: Configure encryption types allowed for Kerberos - Enabled Yes No

Automatic certificate management – Disabled Yes No

Allow users to select new root certification authorities (CAs) to trust – Enabled Yes No

Client computers can trust the following certificate stores – Third-Party Root and Enterprise Root Certification Authorities Yes No

To perform certificate-based authentication of users and computers, CAs must meet the following criteria – Registered in Active Directory Yes

2.21 IS THE SYSTEM EQUIPED WITH INTELLIGENT PLATFORM MANAGEMENT INTERFACES (IPMI)?

IPMI technology allows out of band management of computer systems bypassing the Operating System.

If so describe its intended purpose and list specific services required to support the system. Indicate whether IPMI traffic supports encryption of Data in Transit, to and from the Baseboard Management Controller (BMC), and whether “cipher 0” can be disabled.

2.22 AUTHENTICATION

Does the proposed medical system/device support any of the following?

Yes No

DoD Password complexity rules (case sensitive, 15-characters, lower, upper, numeric, alphabetic, and special characters)

Password History/Aging (90 days)

Operating System services that utilize anonymous access (e.g. Service account not able to be traced to an individual)

Biometrics

Public Key Infrastructure (PKI) using X.509 certificates

Remote Access authentication

Certificates/Tokens

Configuration of user lock-out after a certain number of unsuccessful logon attempts

2.23 AUDITING

Does the proposed medical system/device support any of the following?

Yes No

Audit logs

Customizable audit levels

Retention settings for system logs

Audit logs protection from deletion

Audit reduction capability that supports on-demand audit review and analysis?

Audit reduction capability that supports on-demand reporting requirements?

Audit reduction capability that supports after-the-fact investigations of security incidents?

Audit reduction capability that does not alter original content or time ordering of audit records?

Are audit trail events date/time stamped?

Are audit trail events date/time stamped that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT)?

Can audit trail events include source/destination IP information?

Can audit trail events include protocols?

Can audit trail events include User ID information?

Can audit trail events include changes to Administrator account information?

2.23 AUDITING

Does the proposed medical system/device support any of the following?

Yes No

Can audit trail events include login/logout information?

Can audit trail events include the display/presentation of data?

Can audit trail events include the creation, modification and deletion of data?

Can audit trail events include the import and export of data to and from removable media?

Can audit trail events include the receipt and transmission of data with external (e.g. network) connections?

Can audit trail events include Remote Service activity?

Can audit trail events include the logging of the execution of privileged functions?

2.24 BIOS FIRMWARE (FW)

Yes No

Is the BIOS Firmware configuration password-protected?

Is there a BIOS Firmware master override provided by the vendor?

Can the device be restricted from booting from uncontrolled or removable media through the BIOS?

2.25 REMOTE ACCESS

The software that provides the remote access capability must be included in the Software Inventory, 2.13. Example of a remote desktop software is PC Anywhere

Yes No

Does the device how the ability to be serviced remotely if appropriate B2B agreements are established?

Can the device be configured to require the local use to accept or initiate remote access?

Does the device provide an explicit indication of use to users physically present at collaborative computing devices?

2.26 VULNERABILITY MANAGEMENT

Provide a summary describing the plan for providing validated software updates and patches throughout the life cycle of the medical device. The summary should describe how the security patch is validated and then installed (e.g. remote installation by the vendor or distribution by the vendor for biomedical personnel at the healthcare organization to install. The vendor should also specify the frequency of product updates. Note: A vendor may answer this question by providing the product’s or organization’s vulnerability management plan submitted to the FDA as part of the Premarket Submission Content, if the plan addresses validation, distribution, and installation of security updates.

2.27 ANTIVIRUS/ANTIMALWARE

Antivirus/Antimalware recommended best practices (if available) *List items which should be excluded from scanning.

Antivirus/Antimalware Heuristics scanning supported?

Does the system provide notification of malware detection in the device user interface or through other mechanism (describe)?

Does the system automatically update malicious code protection mechanisms?

Can only manufacturer-authorized persons repair systems when malware has been detected?

2.28 DATA AT REST (DAR)

Yes No

Is the encryption algorithm NIST FIPS 140.2 compliant?

DAR Encryption products and versions validated by the manufacturer DAR Encryption recommended best practices *Provide technical recommendations that address the protection mechanisms of data at rest.

DAR Removable Media *Does the system/device provide encryption of portable media.

Backup Encryption supported algorithms (3DES/AES/RC4/Other)

2.29 DATA IN TRANSIT (DIT)

Yes No

Is the encryption algorithm NIST FIPS 140.2 compliant?

DIT Encryption technologies and versions validated by the manufacturer DIT Encryption recommended best practices

* Provide technical recommendations that address the protection mechanisms of data in transit.

2.30 AVAILABILITY

Availability Position Paper on file system redundancy (if available)

Availability products and versions validated

Availability recommended best practices (if available) *Provide technical recommendations that address data availability.

2.31 IPv6

IPv6 capability – Indicate whether the following software components of the proposed medical system/device are capable of sending/receiving TCP/IP version 6 datagrams: Yes No

Is the Operating System capable of transmitting/receiving TCP/IP version 6 Datagrams?

Is the Primary Application capable of transmitting/receiving TCP/IP version 6 Datagrams?

Is the Database Engine capable of transmitting/receiving TCP/IP version 6 Datagrams? (if applicable)

2.32 IPv6 – COMPLIANCE DOCUMENTATION

• If the system/device is natively capable of exchanging data in the three areas listed above, provide letter of compliance.

• If the system supports TCP/IP version 6 through the use of hardware/software based TCP/IPv6 transformers, please describe the technical characteristics and methodology employed to achieve IPv4/IPv6 interoperability, along with technical considerations regarding latency, overhead and redundancy. This is particularly important when describing systems that are considered Real Time, and/or High Availability (HA).

• If the proposed medical system/device does not currently support IPv6 data communications, please provide a letter of commitment to upgrade to IPv6, including milestones (in company letterhead from the company’s vice president or equivalent).

2.33 HOST-BASED INTRUSION PREVENTION SYSTEM (HIPS)

Does the proposed medical system/device support the use of a host based Intrusion Prevention System (IPS)?

2.34 HOST BASED SECURITY SYSTEM (McAfee HBSS)

Host Based Security System – Describe whether the proposed system supports the installation and operation of a Host Based Security System. A Host Based Security System is a commercial software based application specifically designed to protect and maintain the security baseline of a system. It actively monitors, detects and counters against known cyber threats. Host Based Security Systems are managed by local administrators and are configured to address known exploit traffic using an Intrusion Prevention System (IPS) and host firewall. If the proposed medical system/device has been evaluated against a Host Based Security Systems, provide application title, version, and modules used to conduct its evaluation. If false positives were recorded during evaluation use the following section to list all known instances including the process identifiers and their primary purpose. Example: McAfee EndPoint Security, version 1.0.0.

2.35 INTRUSION DETECTION/PREVENTION SYSTEM – FALSE POSITIVES

Describe processes likely to create false-positive alerts Intrusion Detection/Intrusion Prevention Systems – List all processes known to generate false IPS/IDS false positives. For example: spoolsv.exe incorrectly detected as Backdoor. Ciadoor.B, Hacktool.Privshell or VBS.Massscal.Worm malware.

2.36 MEDICAL SYSTEM/DEVICE RECOVERY/LOSS

Applies to laptops, tablets, and portables only.

Accidental loss – Describe whether the proposed medical system/device portable components support remote wipe and/or geo tracking services in the event of accidental loss, theft, misplacement.

2.37 SYSTEM BACK-UP

Provide a description of the back-up procedures. If the back-up procedures are annotated in a manual that the vendor is providing in response to the solicitation, the vendor may reference the manual. If the system provides the capability to send back-ups to a remote system, please describe the type of encryption used to encrypt a back-up and type of encryption utilized if the back-up is sent to a remote system.

2.38 SYSTEM RECOVERY

Provide detailed information on how the product can be restored back to operation in the event of a system failure and the expected timelines.

2.39 SECURE SHUTDOWN

Describe how The system maintains a secure state during shutdown and restart processes; meaning:

• No object reuse occurs that could accidentally compromise the confidentiality of the system data

• Access to the system cannot be gained by unauthorized personnel

• Unauthorized access to system resources cannot be gained by authorized system users

• Shutdown and restart of the system will not cause harm to the patient, if it occurs during a procedure.

• Data files are not corrupted in the event of an unscheduled shut down.

2.40 MEDICAL SYSTEM/DEVICE STANDARDS CONFORMANCE STATEMENTS

For example IHE, DICOM

Conformance Statements - List all conformance statements associated with the system/device. Please provide proof of certification. For example, DICOM, IHE, MDS2.

2.41 SYSTEM USER DESCRIPTIONS

Enter ‘Individual Account’ into Account Name for user accounts that are tied to specific end users.

Example Roles: Role Medical technologist, field service engineer, physician, System Administrator Role Account Name Minimum Access Level (non-privileged, privileged, administrator/root)

2.42 WIRELESS (IEEE 802.11)

State whether the medical system/device employs any form of wireless communication, either standards-based and/or proprietary to facilitate the transmission/reception of data between system components and/or other systems? Yes No

Does the system employ wireless communication?

Wireless Mode of Operation ad hoc?

Wireless Mode of Operation infrastructure?

2.43 WIRELESS – IEEE 802.15 BLUETOOTH

(Wireless Personal Area Network – WPAN)

Frequency (GHz) Modulation Throughput (Mbps) Range (ft.) (indoor/outdoor)

2.44 WIRELESS – IEEE 802.15 ZigBee

2.45 WIRELESS – IEEE 802.11 (a/b/g/n)

Frequency (GHz) Modulation (FHSS/OFDM/DSSS/CCK) Throughput (Mbps) Range (ft.) (indoor/outdoor)

2.46 WIRELESS – OTHER – ULTRA WIDE BAND (UWB), IEEE 802.16

WiMAX, IR/MICROWAVE, ULTRASOUND, RADIO (VHF/UHF)

2.47 OTHER

Power Requirements (Voltage/Amps):

Weight (lbs.)

Physical Dimensions (H/W/D):

Environmental specifications:

2.48 PHYSICAL SAFEGUARDS

Does the system include a physical locking anti-tampering sensor mechanism?

Does the system expose data interfaces, such as USB/IEEE 1394 which could be used to bypass the Operating System?

2.49 SYSTEM AND APPLICATION HARDENING

Yes No

Does the system include a physical locking anti-tampering sensor mechanism?

Does the system expose data interfaces, such as USB/IEEE 1394 which could be used to bypass the Operating System?

2.50 COMMERCIAL POINT OF CONTACT (POC) INFORMATION – PRODUCT MANAGER (PM)

Name Phone E-Mail

2.51 COMMERCIAL POINT OF CONTACT (POC) INFORMATION – APPLICATION/NETWORK ENGINEER

2.52 COMMERCIAL POINT OF CONTACT (POC) INFORMATION – SECURITY MANAGER

2.53 COMMERCIAL POINT OF CONTACT (POC) INFORMATION – INCIDENT REPORTING

APPENDIX A

To obtain a detailed list of various components of operating systems, including firmware information, follow the procedure outlined below. Instructions are provided for Microsoft Windows, Linux (including the most common distributions), and VMware. Please ensure that the output produced by the various utilities and commands is captured using plain text formatted (.txt) files. For consistency, you may name these files using the hostname of the device and the data they contain; for example:

“meddev1-os-info.txt” And

“meddev1-sw-info.txt”

Operating System Inventory

Microsoft Windows operating systems (all currently supported versions)

1. Using local administrative rights, access the Microsoft Windows desktop interface

2. From the command prompt, launch the MSINFO32.EXE utility

3. Select File + Export from the main menu

4. Save the file in text format

LINUX based medical systems

1. Access the root prompt

2. Enter the uname –a > filename or uname –mrs > hostname-os-info.txt commands, where filename denotes the output file

3. You may also obtain similar information by using dmesg > hostname-os-info.txt where filename denotes the output file

VMWare based medical systems

1. Access the VMWare service console

2. At the root prompt, enter vmware –vl

3. You may redirect the output of the above command as follows: vmware –vl > hostname-os-info.txt

Software Inventory

Microsoft Windows based medical devices (all currently supported versions)

1. Access the Microsoft Windows desktop interface

2. Run the PowerShell command interface (Start + Accessories + System Tools + PowerShell)

3. At the PowerShell prompt, type wmic

4. At the WMIC prompt, enter /output:c:\hostname-sw-info.txt product get name,version and notice that the spacing and punctuation has to be exactly as shown above, for instance no spaces between "name,version"

LINUX based medical devices

1. CentOS – At the root prompt, type the following command: rpm –qa | less > hostname-sw-info.txt

2. Debian - At the root prompt, type the following command: dkpg –get-selections > hostname-sw-info.txt

3. Ubuntu - At the root prompt, type the following command: sudo dpkg—get-selections > hostname-sw-info.txt

4. Free BSD - At the root prompt, type the following command: pkg_version | less > hostname-sw-info.txt

5. OpenBSD - At the root prompt, type the following command: pkg_version | less > hostname-sw-info.txt

Services running on LINUX based medical devices

At the root prompt, enter service –list –all > hostname-proc-info.txt

Active ports and protocols running on a LINUX/Microsoft Windows based medical device

At the root/command prompt, enter netstat –a > hostname-ports-info.txt

Active processes running on a LINUX based medical device

At the root prompt, enter ps –a > hostname-procs-info.txt

DO NOT COMPLETE ANYTHING BEYOND THIS POINT

IDENTIFICATION INFORMATION

ACN:

TDP:

MDRAQ Serial Number:

CE POC:

Contracting POC:

Blue Section Reviewed By:

Gold Section Reviewed By:

Final Disposition:

Overall Risk Level:

PMO Authorization Path Recommendation:

TECHNICAL RECOMMENDATION

Invoicing, Receipt, Acceptance and Property Transfer (iRAPT) – formerly known as WAWF iRAPT is the authorized method to electronically process vendor request for payment. This application allows DOD vendors to submit and track Invoices and Receipt/Acceptance documents electronically. Contractor shall (i) register to use iRAPT at https://wawf.eb.mil and

(ii) ensure an electronic business point of contract (POC) is designated in the System for Award Management at https://www.sam.gov within ten (10) calendar days after…