A.09.03_W91YTZ-18-R-0078_Getinge.pdf

W91YTZ-18-R-0078

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued and is expected to result in the award of a firm-fixed price requirement type contract. The resulting award will be made on SF 1449, for commercial supplies and services. Solicitation number W91YTZ-18-R-0078 is issued as request for quote (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-97 and DPN 20171228 current as of 28 December 2017.

This acquisition is UNRESTRICTED, under size standard $20.5M and NAICS code 811219.

The Government anticipates awarding a single award for Annual Support and Maintenance for Government owned Getinge Steam Sterilizer. This requirement also includes all repairs, replacement of defective parts, and software necessary for systems as defined in the Performance Work Statement. Location of this requirement is Martin Army Community Hospital, Bldg 9222 Bass Road, Fort Benning, GA 31905.

This requirement is for a base period and 4 option year periods. All responsible Small Businesses offers may submit a quotation which will be considered by the agency.

SALIENT CHARACTERISTICS:

Provide written evidence that service personnel have either been trained by the Original Equipment Manufacturer (OEM) on the equipment in the CLINs, experience within the past three years.

Certified Biomedical Equipment Technician by the Association for the Advancement of Medical Instruments (AAMI) and have a minimum experience within the past three years or have an Associate Degree in Biomedical Technology or Electronics with a minimum of 3 years’ experience servicing the specific equipment.

Proof of certification must be presented with bid.

Item No. 0001: ANNUAL SUPPORT and MAINTENANCE 4 QUARTERS The contractor shall provide Martin Army Community Hospital (BMACH) with annual support maintenance of Government owned Getinge Steam Sterilizer; Cleaner Ultrasonic; Washer Decontamination Unit; Washer Equipment Cart; Reverse Osmosis Water System; Detergent Management System; Rinser/Dryer and Boilers. The services to be provided are described in accordance with the Performance Work Statement.

Billing shall occur quarterly. Ordering Period: 1 October 2018 – 30 September 2019.

Unit Price: _______________________ Total: ______________________

Item No. 0002: CONTRACT MANPOWER REPORTING (CMR)

Reporting period will be the period of performance not to exceed 12 months ending September 30 of each Government fiscal year and must be reported by 31 October of each calendar year. The Contractor shall notify the Contracting Officer #s Representative (COR) by the 5th working day of November whether or not they have completed this report. If the COR is unavailable, the Contractor will notify the Contracting Office.

QTY: 1 UNIT: EA UNIT PRICE: ___________ TOTAL: ____________

Total Base period: ______________________

Option Year 1

Item No. 1001: ANNUAL SUPPORT and MAINTENANCE 4 QUARTERS The contractor shall provide Martin Army Community Hospital (BMACH) with annual support maintenance of Government owned Getinge Steam Sterilizer; Cleaner Ultrasonic; Washer Decontamination Unit; Washer Equipment Cart; Reverse Osmosis Water System; Detergent Management System; Rinser/Dryer and Boilers. The services to be provided are described in

Billing shall occur quarterly. Ordering Period: 1 October 2019 – 30 September 2020.

Item No. 1002: CONTRACT MANPOWER REPORTING (CMR) each Government fiscal year and must be reported by 31 October of each calendar year. The Contractor shall notify the Contracting Officer #s Representative (COR) by the 5th working day of November whether or not they have completed this report. If the COR is unavailable, the Contractor will notify the Contracting

Total Option Year 1:______________________

Option Year 2

Item No. 2001: ANNUAL SUPPORT and MAINTENANCE 4 QUARTERS The contractor shall provide Martin Army Community Hospital (BMACH) with annual support maintenance of Government owned Getinge Steam Sterilizer; Cleaner Ultrasonic; Washer Decontamination Unit; Washer Equipment Cart; Reverse Osmosis Water System; Detergent Management System; Rinser/Dryer and Boilers. The services to be provided are described in

Billing shall occur quarterly. Ordering Period: 1 October 2020 – 30 September 2021.

Item No. 2002: CONTRACT MANPOWER REPORTING (CMR) each Government fiscal year and must be reported by 31 October of each calendar year. The Contractor shall notify the Contracting Officer #s Representative (COR) by the 5th working day of November whether or not they have completed this report. If the COR is unavailable, the Contractor will notify the Contracting

Total Option 2:______________________

Option Year 3

Item No. 3001: ANNUAL SUPPORT and MAINTENANCE 4 QUARTERS The contractor shall provide Martin Army Community Hospital (BMACH) with annual support maintenance of Government owned Getinge Steam Sterilizer; Cleaner Ultrasonic; Washer Decontamination Unit; Washer Equipment Cart; Reverse Osmosis Water System; Detergent Management System; Rinser/Dryer and Boilers. The services to be provided are described in

Billing shall occur quarterly. Ordering Period: 1 October 2021 – 30 September 2022.

Item No. 3002: CONTRACT MANPOWER REPORTING (CMR) each Government fiscal year and must be reported by 31 October of each calendar year. The Contractor shall notify the Contracting Officer #s Representative (COR) by the 5th working day of November whether or not they have completed this report. If the COR is unavailable, the Contractor will notify the Contracting

Total Option 3:______________________

Option Year 4

Item No. 4001: ANNUAL SUPPORT and MAINTENANCE 4 QUARTERS The contractor shall provide Martin Army Community Hospital (BMACH) with annual support maintenance of Government owned Getinge Steam Sterilizer; Cleaner Ultrasonic; Washer Decontamination Unit; Washer Equipment Cart; Reverse Osmosis Water System; Detergent Management System; Rinser/Dryer and Boilers. The services to be provided are described in

Billing shall occur quarterly. Ordering Period: 1 October 2022 – 30 September 2023.

Item No. 4002: CONTRACT MANPOWER REPORTING (CMR) each Government fiscal year and must be reported by 31 October of each calendar year. The Contractor shall notify the Contracting Officer #s Representative (COR) by the 5th working day of November whether or not they have completed this report. If the COR is unavailable, the Contractor will notify the Contracting

Total Option 4:______________________

Total Base Period Plus four (4) Option Periods:

The following FAR Clauses and Provisions in their latest editions apply to this solicitation.

52.212-1 Instructions to Offers –Commercial Items JAN 2017

Addendum to FAR 52.212-1 Instructions to Offerors—Commercial Items

FAR 52.212-1 is hereby amended to reflect the changes shown below:

Para (b) Submission of offers

All offerors must be registered in the System for Award Management (SAM) prior to award, and lack of registration shall make an offer ineligible for award. Offerors may obtain information on registration Internet at https://www.sam.gov. Or the SAM Help desk at https://www.fsd.gov.

All questions shall be submitted via email no later than 1:30PM EST August 17, 2018 to valerie.j.deveaux.civ@mail.mil and Frederick.M.Kmiecik.Civ@mail.mil. Responses will be posted to the Federal Business Opportunities website. Proposals are being accepted via email only. All responsible sources should submit proposals to Valerie DeVeaux via e-mail:

valerie.j.deveaux.civ@mail.mil by August 27, 2018 12:00 PM EST. (n) the non-Far Part 12 discretionary FAR, DFARS, AFARS and MEDCOM provisions included herein are incorporated into this solicitation either by reference or in full text. If incorporated by reference, see provision 52.252-1 for locations where full text can be obtained.

Cover email shall include: Data Universal Numbering System (DUNS) / CAGE Code, Point of contact for individual authorized to enter in to discussions to include phone and email.

All offers must request verification by email to Valerie DeVeaux Email:

valerie.j.deveaux.civ@mail.mil to confirm receipt of their proposal was received by the time https://www.sam.gov/ https://www.fsd.gov/ mailto:valerie.j.deveaux.civ@mail.mil mailto:Frederick.M.Kmiecik.Civ@mail.mil mailto:valerie.j.deveaux.civ@mail.mil mailto:valerie.j.deveaux.civ@mail.mil specified in the solicitation. The Government will not be responsible for any failure of transmission or receipt of the offer, or any failure of the offeror to verify receipt of the emailed offer.

Instructions for the Preparation of Proposals

The technical information required for evaluation purposes shall not exceed 20 pages. Each page shall be numbered.

The proposal shall be prepared in two (2) separate volumes as indicated below.

• Volume I-Technical

• Volume II-Pricing

VOLUME I – TECHNICAL

The technical proposal, Volume I, shall be addressed in sufficient written detail for the Government to determine if the offeror understands this aspect of the Government’s requirement. The offeror shall address each factor separately, and shall provide sufficient narrative and supporting data for each factor. Lack of any of these significant capabilities shall be considered sufficient cause for the proposal to be determined unacceptable. The Technical Proposal shall provide sufficient detail for the Government to determine whether the proposal acceptably meets the requirements of the solicitation. Statements that the offeror understands, can or will comply with all specifications, or statements paraphrasing the specifications of parts thereof, or phrases such as “standard procedures will be used” or “well-known techniques will be used” will be considered unacceptable. The technical proposal shall provide a narrative and supporting data with the following sections organized separately so that the evaluation factors listed below are included.

VOLUME II – PRICING

Assessment of price reasonableness based on comparison to market prices.

a. The offeror shall submit proposed pricing for all subcontract Line Item Numbers (subCLINs) identified in the Request for Proposal, unless otherwise noted. The offeror shall limit their unit and extended prices to two (2) decimal places (example: $158.03).

b. The offeror shall submit pricing totals for the base period and option years individually, as well as a grand total.

CLAUSES INCORPORATED BY REFERENCE

52.203-2 Certificate of Independent Price Determination APR 1985 52.203-11 Certification and Disclosure Regarding Payment

To Influence Certain Federal Transactions

SEP 2007

52.204-16 Commercial and Government Entity Code Reporting

JUL 2016

52.222-22 52.222-46

Previous Contracts And Compliance Reports Evaluation of Compensation for Professional Employees

FEB 1999

FEB 1993

52.223-1 52.225-25

Bio Based Product Certification Prohibition on Contracting with Entities Engaging In Certain Activities or Transactions Relating to Iran-Representation and Certification

MAY 2012

OCT 2015

Incorporated by Full Text

52.209-2

52.209-7

Prohibition on Contracting with Inverted Domestic Corporations-Representations Information Regarding Responsibility Matters

NOV 2015

JUL 2013

52.209-11

52.215-20

Representation by Corporations Regarding Delinquent Tax Liability or A Felony Conviction Under Any Federal Law Requirements For Certified Cost or Pricing Data and Data Other Than Certified Cost or Pricing Date (OCT 2010) Alternative IV (OCT 2010)

FEB 2016

52.216-1 Type of Contract: Firm Fixed Price APR 1984 52.222-25 52.233-2

Affirmative Action Compliance Service of Protest

APR 1984

SEP 2006

52.252-1 (FEB 1998), Solicitation Provisions Incorporated by Reference: The full text of a solicitation provision may be accessed electronically at this/these address (es):

www.farsite.hill.af.mil or www.arnet.gov/far.

52.252-5, Authorized Deviations in Provisions (APR 1984): (b) the use in this solicitation or contract of any DoD FAR Supplement (48 CFR Chapter 2) provision with an authorized deviation is indicated by the addition of “(DEVIATION)" after the name of the regulation.

252.203-7005 Representation Relating to Compensation of Former DOD

Officials

NOV 2011

252.204-7008

252.204-7011 252.213-7000

252.215-7007 252.215-7008 252.222-7007 252.225-7020 252.225-7035

Compliance With Safeguarding Covered Defense Information Controls Alternate Line-Item Structure Notice to Prospective Supplies on Use of Past Performance Information Retrieval System-Statistical Reporting in Past Performance Evaluations Notice of Intent to Resolicit Only One Offer Representation Regarding Combating Trafficking in Persons Trade Agreements Certificate Buy American Free Trade Agreements-Balance of Payments Program Certificate-Basic

OCT 2016

SEP 2011

JUN 2015

JUN 2012

OCT 2013

JAN 2015

NOV 2014

NOV 2014

52.212-2

Evaluation –Commercial Items

OCT 2014

http://www.farsite.hill.af.mil/ http://www.arnet.gov/far

Addendum 52.212-2 (LPTA):

Paragraph (a) replaced with the following:

Award will be made using the lowest price technically acceptable (LPTA) source selection process. Award will be made to the responsible offeror on the basis of the lowest evaluated price of proposals meeting or exceeding the acceptability standards for non-cost factors. Award may be made without discussions with offerors (except communications conducted for the purpose of minor clarification). Therefore, each initial offer should contain the offeror's best terms from a technical and price standpoint. However, the Government reserves the right to conduct discussions if it is later determined by the contracting officer to be necessary.

The Government will award a Firm Fixed Price contract resulting from this solicitation to the responsible Offer whose offer conforming to the solicitation will be the most advantageous for the Government, price and other factors considered. In order to be considered for award, an Offeror must receive an Acceptable rating in all factors. The following factors shall be used to evaluate:

Technical and Price

Award will be made based on lowest price, technically acceptable proposal.

(a) Options. The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced.

Evaluation of options shall not obligate the Government to exercise the option(s).

(b) A written notice of award or acceptance of an offer, mailed or otherwise furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contractor without further action by either party. Before the offer’s specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

FACTOR: 1 TECHNICAL

Subfactor 1. Training/Certification - Provide written evidence that your company meets the training and or certification requirement in the salient characteristics.

Technical will be evaluated as either Acceptable or Unacceptable. Best value is expected to result from selection of the technically acceptable proposal with the lowest evaluated price.

Definitions are as follows:

ACCEPTABLE: To be rated acceptable, the offeror's technical proposal must demonstrate it can meet all specifications and testing requirements.

UNACCEPTABLE: A technical proposal that fails to demonstrate it can meet one or more requirements will be determined unacceptable.

FACTOR II: PRICE

Price will be evaluated separately from Technical and will be evaluated for fairness and reasonability. The offeror shall complete the CLIN structure with a total cost covering a base period and four option years developed based upon annual support, maintenance all repairs, replacement of defective parts, and software necessary for Government owned Getinge Steam Sterilizer system. This information will be used to assist in the price analysis as required by FAR 15.404-1(b).

52.212-3 Offeror Representations and Certifications--Commercial Items (JAN 2017) Alternate I OCT 2014

52.212-4 Contract Terms and Conditions--Commercial Items JAN 2017

52.212-4 ADDENDUM

(w) the non-FAR Part 12 discretionary FAR, DFARS, AFARS, and Local clauses herein are incorporated into this contract either by reference or in full text. If incorporated by reference, see clause 52.252-2 for locations where full text can be found.

52.203-3 Gratuities APR 1984 52.203-6 Restrictions on Subcontractor Sales to the

Government-Alternate I

SEP 2006

52.203-12 Limitation on Payments to Influence Certain Federal Transactions

OCT 2010

52.203-17 Contractor Employee Whistleblower Rights and Requirement to Inform Employees of Whistleblower Rights

APR 2014

52.204-4 Printed or Copied on Double-sided Post Consumer Fiber Content Paper

MAY 2011

52.204-10 Reporting Executive Compensation and First-Tier Subcontract Awards

OCT 2016

52.204-18 Commercial and Government Entity Code Maintenance

JUL 2016

52.209-6

52.209-9

52.219-9

Protecting the Government's Interest When Subcontracting With Contractors Debarred, Suspended, or Proposed for Debarment Updates of Publically Availability Information Regarding Responsibility Matters Small Business Subcontracting Plan

JUL 2013

JAN 1999

52.222-3 52.222-19

Convict Labor Child Labor-Cooperation With Authorities and Remedies

JUN 2003

JAN 2014

52.222-21 Prohibition Of Segregated Facilities APR 2015 52.222-26 Equal Opportunity SEP 2016

52.222-35 Equal Opportunity For Veterans OCT 2015 52.222-36 Equal Opportunity for Workers with Disabilities JUL 2014 52.222-37 Employment Reports on Veterans OCT 2015 52.222-50 Combating Trafficking in Persons MAR 2015 52.222-54 Employment Verification OCT 2015 52.223-2 Affirmative Procurement of Bio based Products

Under Service and Construction Contracts

SEP 2013

52.223-3 Hazardous Material Identification and Material Safety Data

JAN 1997

52.223-5 Pollution Prevention and Right-to-Know Information

MAY 2011

52.223-18 Encouraging Contractor Policies To Ban Text Messaging While Driving

AUG 2011

52.224-1 Privacy Act Notification APR 1984 52.224-2 Privacy Act APR 1984 52.225-13 Restrictions on Certain Foreign Purchases JUN 2008 52.228-5 Insurance—Work on A Government Installation JAN 1997 52.232-33 Payment by Electronic Funds Transfer--System for

Award Management

JUL 2013

52.232-39 Unenforceability of Unauthorized Obligations JUN 2013 52.232-40 Providing Accelerated Payments to Small Business

Subcontractors

DEC 2013

52.233-3 Protest After Award AUG 1996 52.233-4 Applicable Law for Breach of Contract Claim OCT 2004 52.237-2 Protection Of Government Buildings, Equipment, And Vegetation

APR 1984

52.242-5 52.242-13

Payment to Small Business Subcontractors Bankruptcy

JAN 2017

JUL 1995

252.203-7000 Requirements Relating to Compensation of Former

DoD Officials

SEP 2011

252.203-7002 Requirement to Inform Employees of Whistleblower Rights

SEP 2013

252.204-7003

252.209-7004

252.219-7003

Control Of Government Personnel Work Product

Subcontracting With Firms That Are Owned Or Controlled By the Government of A Country That is A State Sponsor of Terrorism Small Business Subcontracting Plan (DOD Contracts)

APR 1992

MAR 2016

252-225-7002 252.225-7012 252.225-7021

Qualifying Country Sources as Subcontractors Preference for Certain Domestic Commodities Trade Agreements

AUG 2016

FEB 2013

SEP 2016

252.225-7048 252.226-7001

Export-Controlled Items Utilization of Indian Organizations, Indian-Owned Economic Enterprises, And Native Hawaiian Small Business Concerns

JUN 2013

SEP 2004

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports

JUN 2012

252.232-7006 Wide Area Workflow Payment Instructions MAY 2013 252.232-7010 Levies on Contract Payments DEC 2006

252.243-7001 Pricing of Contract Modifications DEC 1991 252.243-7002 Requests for Equitable Adjustments DEC 2012

Incorporated in Full Text

52.209-10 Prohibition On Contracting With Inverted Domestic

Corporations

NOV 2015

(End of clause)

52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000)

(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days (insert the period of time within which the Contracting Officer may exercise the option); provided that the Government gives the Contractor a preliminary written notice of its intent to extend at least 60 days before the contract expires. The preliminary notice does not commit the Government to an extension.

(b) If the Government exercises this option, the extended contract shall be considered to include this option clause.

(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 60 months

52.219-28 Post Award Small Business Program Rerepresentation JUL 2013 52.222-40

Notification of Employee Rights Under the National Labor Relations Act

DEC 2010

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address (es):

www.farsite.hill.af.mil.

(End of clause)

52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES (APR 1984)

(a) The use in this solicitation or contract of any Federal Acquisition Regulation (48 CFR Chapter 1) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the clause.

http://www.farsite.hill.af.mil/

(b) The use in this solicitation or contract of any DoD FAR Supplement (48 CFR Chapter 2) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the name of the regulation.

252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting

OCT 2016

252.204-7015 Disclosure of Information to Litigation Support Contractors

MAY 2016

252.244-7000 Subcontracts for Commercial Items and Commercial Components

JUN 2013

252.247-7023 252.247-7024

Transportation of Supplies by Sea-Basic Notification of Transportation of Supplies By Sea

APR 2014

MAR 2000

End of Additional FAR and DFARS clauses

Incorporated in Full Text

52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders—Commercial Items (Deviation 2013-O0019)

JAN 2017

IRAPT- Invoice, Receiving, Acceptance and property Transfer-formerly known as WAWF

HIPPA-Health Insurance Portability and Accountability Act (7 July 2014)

TFMC-Tobacco Free Medical Campus

LEIE (October 2015)

PERFORMANCE BASE WORK STATEMENT

Annual Maintenance for Getinge Steam Sterilizer Martin Army Community Hospital (BMACH)

Fort Benning, Georgia

1 GENERAL:

1.1. The contractor shall provide Annual Support and Maintenance for the Getinge Steam Sterilizer; Cleaner Ultrasonic; Washer Decontamination Unit; Washer Equipment Cart;

Detergent Management System; Rinser/Dryer and Boilers. The services to be provided are described in the Performance Work Statement. This contract is a non-personal services contract under which the personnel rendering the services are not subject, either by the contract’s terms or by the manner of its administration, to the supervision and control prevailing in relationships between the Government and its employees.

1.2. Description of Services: The contractor shall provide all labor, material, supplies, tools, diagnostic software, and test equipment, except for those identified in Section 3, Government- Furnished Items and Services, necessary to perform MD/MDS maintenance and repair services at multiple Martin Army locations as identified in Exhibit C.

1.3. The contractor shall comply with the requirements of this PWS to include the requirements of all appendixes and enclosures.

1.4 QUALIFICATIONS: Upon request, the contractor shall provide written evidence that service personnel to be utilized on this contract shall have either been trained by the Original Equipment Manufacturer (OEM) on the specific equipment they service and experience within the past three years or have been certified as a Certified Biomedical Equipment Technician by the Association for the Advancement of Medical Instruments (AAMI) and have a minimum experience within the past three years or have an Associate Degree in Biomedical Technology or Electronics with a minimum of 3 years’ experience servicing the specific equipment.

1.4.1 Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190- 13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

1.4.2 All contractor employees with access to a government information systems must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DOD Information Assurance Awareness prior to access to the IS and then annually thereafter.

1.4.3 All contractor employees and associated sub-contractor employees must complete the DOD Cyber awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions must comply with DOD and Army training requirements in DOD 8570.01, DOD 8570.01-M and AR 25-2 within six months of appointment to IA/IT functions. DoD Cyber Awareness Challenge Training is available at the following website: https://ia.signal.army.mil/DoDIAA/

1.4.4 Per DoD 8570.01-M , DFARS 252.239.7001 and AR 25-2, the contractor employees supporting Cyber (IA/IT) functions shall be appropriately certified upon contract award.

1.5 QUALITY CONTROL: The contractor shall submit a quality control inspection system to the Contracting Officer (KO) and the Contracting Officer’s Representative (COR). This should include descriptions of persons and positions charged with the responsibility of making inspections, methods of identifying deficiencies in services, and in quality control functions.

Final copy of the Contractor’s Quality Control Plan shall be required and submitted to the Contracting Officer for approval not later than ten (10) days after award.

1.6. HOURS OF OPERATION.

https://ia.signal.army.mil/DoDIAA/

1.6.1. Monday – Friday 8:00am to 5:00 pm, Saturday 8:00am – 5:00pm EST

1.6.2. Recognized Holidays. Facility observes all federal holidays as follows:

1 Jan New Year’s Day 3rd Monday in Jan Martin Luther King, Jr. Birthday 3rd Monday in Feb President’s Day Last Monday in May Memorial Day 4th July Independence Day 1st Monday in Sep Labor Day 2nd Monday in Oct Columbus Day 11 Nov Veteran’s Day 4th Thursday in Nov Thanksgiving Day 25 Dec Christmas Day

1.6.3. When any of the above holidays fall on a Saturday it will be observed on the preceding Friday; holidays that fall on a Sunday will be observed on the following Monday. Any holidays declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above.

1.6.4 SAFETY REQUIREMENTS: The Government and the contractor’s service representative will exchange hazard communication information before the commencement of any repair.

1.6.4.1 When required, the contractor’s service representative will comply with The Office of Safety and Health Administration (OSHA) lockout/tag-out standards while performing maintenance on medical devices and or medical device systems (MD/MDS).

1.6.5 SECURITY REQUIREMENTS: The contractor shall be responsible for the security of all beneficiaries’ information.

1.6.5.1 Neither the contractor nor any of its contract service providers shall disclose or cause to disseminate any information concerning operations of military activities. Such action(s) could result in violation of the contract and possible legal actions.

1.6.5.2 All inquiries, comments or complaints arising from any matter observed, experienced, or learned of as a result of or in connection with the performance of this contract, the resolution of which may require the dissemination of official information, shall be directed to the Contracting Officer.

1.6.5.3 The contractor shall only conduct business with designated government personnel listed as points of contact (POCs). Names of authorized personnel shall be provided to the contractor by the Government, in writing, and updated as necessary throughout the contract period.

1.6.5.4 U.S. Government records, copies of original results and reports, verified original data, corrected data, and corrected supporting final reports are maintained by the contractor, but remain the property of the U.S. Government. These files/results must be surrendered to the

COR.

1.6.6 The contractor shall comply with agency personal identity verification procedures in all subcontracts when the subcontractor is required to have physical access to a federally-controlled facility or access to a federal information system.

1.6.6.1 Contractor and all associated sub-contractors employees shall comply with applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative). The contractor shall also provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

1.6.6.2 The contract’s employee shall not be permitted on the installation when their presence is considered detrimental to the security of the installation. The Government reserves the right to remove from the job site any contract’s employee whose continued employment is not consistent with the interest of military security or who is found to be otherwise impaired.

1.6.6.3 Contractor service representative shall report in person or telephonically notify the maintenance manager, building 9250, room GC 122, telephone number 762-408-1605, and prior to commencing services during normal duty operating hours 8:00am to 5:00pm to sign in and obtain a badge. Contract personnel are required to wear Hospital visitor badges while onsite. During other than normal operating hours, the contractor’s representative shall report to the Security Office, building 9250, to sign in and obtain a badge. Contract personnel are required to wear hospital visitor badges while onsite. Personnel must return badges to Security, building 9250 and sign out upon leaving the premises.

1.6.6.4 A government representative must be physically present and capable of observing contractor personnel during any service activity that requires a key, ID, or password, or in any situation in which contractor personnel have access to the Government’s inventory.

1.6.6.5 Contract personnel shall be escorted by Clinical Engineer personnel at all times while conducting work on the premises.

1.7 General Government Oversight Instructions for All Government Data Including Protected Health Information

1.7.1 General Government Oversight Instructions. Program/Project Managers will follow the policies and procedures identified in the contract language. Specifically, Program/Project Managers will ensure compliance by auditing invoice for compliance upon receipt and periodically. Examples of audits for this purpose include:

a. Auditing invoices submitted by contractors to verify that only those personnel listed are being billed against the contract (Personnel Security) and have been processed for an appropriate background check. Acceptor of invoice must verify dates of background check.

b. Performing periodic audits of Contractor sites to ensure Contractor compliance to the requirements of the Physical Security Audit Matrix. Army personnel will monitor and re-inspect to check for resolution of identified deficiencies (Physical Security).

c. Ensuring contractors acquire, develop, and maintain the Certification & Accreditation (C&A) documentation to ensure both initial and continued compliance with C&A requirements as specified by Army Information Assurance requirements for all contractor systems/networks that receive, process, store, display, or transmit Army data, or has a physical or logical connections to an Army certified network (Electronic Security). All contractor systems/networks that receive process, maintain, store, or transmit Protected Health Information (PHI) will also have to comply with all C&A requirements (Electronic Security).

d. Auditing all new systems at delivery to ensure all applicable electronic patches are installed on the system before the Army accepts the product (Electronic Security)

e. Random security auditing of any Contractor sites where PHI files are collected, used, or stored. Prior to accessing PHI all Contractors must have an approved Business Associates Agreement (BAA). The audit will ensure the contractor has complied with all terms stated in the BAA regarding physical, personnel and electronic security measures as reflected in the Privacy Act (5 U.S.C. 55a et seq), HIPAA Privacy Rule (PL 104-191), and DoD Health Information Regulation Privacy Regulation (6025.18-R) (Protected Health Information Security). The DHA BAA will be included verbatim. A copy of the DHA BAA can be found at:

http://www.tricare.mil/tma/privacy/hipaa-baa.aspx

1.7.2 Information Assurance Standard IA Contract Language. Standard IA contract language will be used for B2B requests. Standard IA contract language can be found at:

http://www.health.mil/MHSCIO/programs_products/jmis/JMIS_Contract_Language/JMIS_IA_Co ntract_Language/JMIS_IA_Standard_Language.aspx

1.7.3 The contractor shall correct any deficiencies identified by the Army of the contractor's physical security posture through contract modification.

1.8 General Government Oversight Instructions

a. Program/Project Managers will follow the policies and procedures identified in the contract language. Specifically, Program/Project Managers will ensure that Standard Contract Language and Instructions for All Government Data Including Protected Health Information is included in all contracts that require a VPN connection.

b. Business Partners that require access to government systems will follow Army Regulation 25-1, “Army Knowledge Management and Information Technology, AR 25-2, “Information Assurance (IA)”, DoD Health Information Privacy Regulation.

1.8.1 Business Partner Responsibilities

a. Use the MEDCOM Business to Business Virtual Private Network Gateway or the Military Health Systems Virtual Private Network Gateway as the only approved access solutions.

http://www.tricare.mil/tma/privacy/hipaa-baa.aspx http://www.health.mil/MHSCIO/programs_products/jmis/JMIS_Contract_Language/JMIS_IA_Contract_Language/JMIS_IA_Standard_Language.aspx http://www.health.mil/MHSCIO/programs_products/jmis/JMIS_Contract_Language/JMIS_IA_Contract_Language/JMIS_IA_Standard_Language.aspx

b. Initiate, maintain, and document personnel security investigations appropriate to the Business Associate Representative’s responsibilities and required access to MEDCOM Sensitive Information (SI) as determined by the site Chief Information Officer.

c. Validate that systems authenticate users through the use of the Common Access Card (CAC) or CAC alternative as a part of a two-factor authentication mechanism on the business partner side of the VPN.

d. Provide, maintain and configure VPN concentrator that complies with DoD security standards.

e. Ensure Government Property, if utilized is maintained and returned in the same condition to Site.

1.8.2 Site Responsibilities

a. Provide Business Partner with the appropriate level of security requirements for the type of access requested and ensure that the Business Partner remains compliant.

b. Provide Business Partner with Government Property or contractor furnished equipment which meets two factor authentication requirements to access the government network, not to include the VPN concentrator.

c. Ensure return of Government Property utilized by Business Partner.

1.8.3 System Security Requirements.

1.8.3.1 The vendor shall submit to the Government, included in the quote, the blue section of the Medical Device Cybersecurity Assessment (Questionnaire) provided by government and Nessus Scans. Nessus scanner is to be procured by the vendor, at their own cost, in order to comply with RMF requirements.

1.8.3.2 Vendor agrees to comply with security regulations and guidance listed in attached Appendix A and all Risk Management Framework (RMF) requirements.

1.8.3.3 Failure to meet the requirements may result may result in termination of the delivery order for cause, in accordance with FAR 52.212-4(m).

1.8.3.4 The vendor device or system shall pass pre-validation screening (Vulnerability scans utilizing Nessus, and SCAP scans), administered within six (6) months of contract award that will be conducted by Government, and must meet criteria listed below:

1.8.3.5 No unmitigated Very High or High Severity/ Category I (CAT I), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx

1.8.3.5.1 Unmitigated Moderate Severity/Category II (CAT II), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx http://iase.disa.mil/stigs/Pages/index.aspx http://iase.disa.mil/stigs/Pages/index.aspx

1.8.3.5.2 No unmitigated Very High or High Severity/ Category I (CAT I) vulnerabilities from Nessus vulnerability scans.

1.8.3.5.3 No unmitigated Moderate Severity/ Category II (CAT II) vulnerabilities from Nessus vulnerability scans.

1.8.3.5.4 The vendor shall mitigate all Very High, High, and Moderate Severity/CAT I and CAT II vulnerabilities discovered during the Assessment and Authorization (A&A) process according to a schedule published by Government.

1.8.3.6 The vendor shall appoint a vendor point of contact responsible for the cybersecurity of the vendor device or system throughout the lifecycle of the system. The vendor shall provide Subject Matter Experts (SMEs) to support all assessments of contracted products and materials, and meet required deliverable timelines.

1.8.3.7 The vendor shall obtain a recommendation of Authority to Operate (ATO) as determined by a Government appointed third party validator within twelve (12) months of contract award.

1.8.3.7.1 The vendor shall not make any delivery and shall not receive payment for the system until the ATO is granted. Receiving the ATO document from the U.S. Army shall constitute permission to perform on the order and to proceed with delivery. All delivery dates shall be reset in accordance to contract and in days after the date the ATO is communicated in writing to the vendor. Delivery may take place prior to ATO only if written permission is provided by the DLA Contracting Officer.

1.8.3.7.2 Pursuant to subsequent warranty period and Service Maintenance Agreements (SMA), the vendor shall, after the award of an ATO, ensure that the vendor’s device or system maintains its ATO for as long as the equipment is operated by Government.

1.8.4 The vendor shall establish appropriate administrative and technical safeguards to ensure the confidentiality, integrity, and availability of Government data under their control.

1.8.5 The vendor shall notify the Information Owner and Contracting Officer POCs in writing with any inabilities to comply with DOD security requirements. Vendor shall provide anticipated costs and timelines required to address vulnerabilities in question.

1.8.6 The vendor shall contact the IA/RMF Office Representative, no later than 5 days after delivery order selection or contract award, to start the process. Failure to do so would be considered a vendor caused delay.

1.9 RMF Timeframes

The following table provides an overview of the entire Process to obtain approval under Army Cybersecurity requirements. Vendor actions must start as cited in the number of days after date of order column noted below and be completed in the number of days listed below in the Duration column.

ID Step Name (Action or Deliverable

Duration (Days)

Number of Days After Date of Order

Responsible Party

1 Categorization 22 Total Days

1.1 Vendor RMF

Kickoff Meeting (Vendor must contact the RMF Office Rep)

GOVERNMENT

1.2 EDMS

Paperwork and Account Creation

1.3 EDMS

Functionality Briefing

1.4 Documentation Templates to Vendor

1.5

Hardware/Softwar e Document Production

VENDOR

7 1.6 STIG Review 2

1.7 System

Categorization

1.8 Categorization

Memo Approval

1.9 Security

Assessment Plan Creation

1.10 SAP Sent to

1.11 Contact 3rd

Party IV&V

2.Control Selection 6 Total

2.1 System eMASS

Registration

2.2 eMASS Control Selection

2.3 Implementation

Plan Completion

3. Implementation 130 Total

3.1 Documentation

Creation and Review

3.1.1 Vendor

Control and Artifact Documentation

3.1.2 PMO

Control Documentation

3.1.3 Documentation 100% Complete (C fi IV&V)

22 3.2 Scanning 120 1

3.2.1 Vendor

Initial Scan

3.2.2 ICS

Review of scans and Vulnerability

3.2.3

26 3.3 DHA

Registration 60 77 GOVERNMENT

3.3.1 DHA

A&A Request

3.3.2 Submit

Security Plan for Approval

3.4 Submission

to IV&V Team/Submit IV&V Request through Portal

4. Assess 65 Total

4.1 Packet

Review by IV&V Team

32 4.2 Coordination

Meeting

0 165 GOVERNMENT

33 4.3 Onsite I&V 5 168 GOVERNMENT

4.4 SCA-V

Packet Review

4.5 SCA-V SAR

Issuance

5. Packet Authorization

60 Total Days

5.1 Vendor

Remediation

5.1.1 SAR

Review/Concurre nce

39 5.2 Submit to

SCAR

10 213 GOVERNMENT

40 5.3 Submit to

SCA

5 223 GOVERNMENT

41 5.4 Submit to AO 5 228 GOVERNMENT

42 5.5 AO signature 0 233 GOVERNMENT

Note: Not all above actions occur in a sequential manner as some actions may be worked concurrently.

1.10 Assessments and Authorization (A & A)

1.10.1 The vendor shall submit all RMF required documentation, as specified by Government Reps for review and approval, no later than four (4) months after request by the Government.

1.10.2 The vendor shall obtain approval from the Government, any vendor developed policies, plans, and procedures prior to implementation.

1.10.3 The vendor shall provide any additional documentation required by the Government for completion of the A&A process within thirty (30) business days of request by the Government.

1.10.3.1 The vendor shall provide technical scans within one (1) month of the A&A kickoff meeting.

1.10.3.2 The vendor shall provide updated technical scans on a monthly basis, on the 10th day of each month until an ATO is granted.

1.10.4 The vendor shall ensure that the vendor device or system is capable of supporting the use of DISA approved intrusion detection and prevention, antivirus, and antimalware applications.

The vendor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support either the full security suite or the individual components (e.g.

DLP, IPS, Antivirus, etc.) without performance degradation of the medical system/device. In cases where the operation of security applications are not technically achievable, the vendor shall provide detailed justification and a Plan of Actions and Milestones (POA&M) describing steps towards compliance with this requirement.

1.10.4.1 The vendor shall ensure that the vendor device or system is configured in such a way that allows the updating of malware definition signatures on a scheduled basis. Scanning shall encompass the entire system (file system, operating system, real-time processes) by default. In cases where scanning of the entire system may negatively affect its operation, the vendor shall provide a detailed list of exclusions with justifications.

1.11 Privileged User Training and Certification Requirements

1.11.1 If a vendor requires a B2B, access, etc. to government networks to maintain, analyze, etc., their products, they must adhere to the following requirements:

1.11.2 Information Assurance Contractor Training and Certification. Contractors requiring a privileged-level account for administrative/maintenance support of systems/applications on the Army network will meet Army requirements for a privileged-level account before being granted a network account. Requirements include:

1.11.3 Cyber (Information assurance (IA)/information technology (IT) certification (Exhibit B).

Per DoD 8570.01-M , DFARS 252.239.7001 and AR 25-2, the contractor employees supporting Cyber (IA/IT) functions shall be appropriately certified upon contract award. Contractors will be defined at Information Assurance Technical level I (IAT – II) and be required to meet minimum Professional Baseline certifications at the time of contract award. Contractors will be given six

(6) months to meet Computer Environment (CE) and Cyber Security Fundamental training requirements. Not meeting the requirements in accordance with DoD 8570.01-M will result in the contractor account and access being ‘Disabled’ or ‘Deleted’ until such time as the conditions of this contract are met.

1.11.4 Background Investigation. NACI or above is required. Vendors should email:

usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain guidance on the process

1.11.5 Professional Baseline Certification. The minimum Professional Baseline certification for IAT-II is CompTIA Security+. Higher certifications (GSCL, CISM, CISSP, etc.) will satisfy this requirement.

1.11.6 Computer Environment (CE) Certification. Computer Environment (CE) certifications are determined by the role of the contractor and must be met within six months of delivery order issuance. Contractors working on servers are encouraged to have a Microsoft 2008 Server or 2012 Server certification. Contractors working on End-User devices are encouraged to have a professional certification that coincides with the technology inherent in the system (i.e. MCSE, CCNA, RHCSE, etc.). The CompTIA A+ certification will also satisfy the CE certification requirement.

1.11.6.1 IA Training Requirements. Contractors will meet minimum training requirements within six months of contract award. Contractors will be required to complete Cyber Security Fundamentals located at URL: https://ia.signal.army.mil/IAF/

1.11.6.2 Two-Factor Authentication. Contractors will authenticate using two-factor authentication. The preferred method for authenticating is the Common Access Card (CAC).

https://ia.signal.army.mil/IAF/

1.11.6.3 Army Training Certification Tracking System (ATCTS). Contractors with a need for elevated privileged-level access will be defined to ATCTS.

https://atc.us.army.mil/iastar/regulations.php

1.11.7 Network Account Request Package (Authorized & Privileged). The contractor will submit a request package through either the ITC One-Stop Shop for contractors requiring on-site access or through the Information Assurance/Cyber Security Branch for contractors requiring remote access to an Army network. Remote access must be through a Defense Health Agency (DHA) Business-To-Business (B2B) solution. Vendors should email:

usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain remote access through DHA, for Army requirements.

1.11.8 IA Training. DoD Cyber Awareness Challenge Training must be completed by all contractor employees and associated sub-contractor employees prior to issuance of network access and annually thereafter. DoD Cyber Awareness Challenge Training is available at the following website: https://ia.signal.army.mil/DoDIAA/

1.11.9 Acceptable Use Policy (AUP). All vendors/contractors will sign/acknowledge the Army Standard Acceptable Use Policy (AUP) prior to being granted a Army network account.

The Army Standard AUP is available at the following website:

https://atc.us.army.mil/iastar/docs/aup.pdf

1.12 Warranty and Post-Warranty Service Maintenance cybersecurity Requirements

1.12.1. Continuous Risk Management

1.12.2 The vendor shall maintain a duplicate of the fielded device, system, or group of configurations falling under one authorization; for testing in a vendor supplied lab environment at vendor location for as long as the system is operated by the Government.

1.12.3 The vendor shall maintain the duplicate system or device in operational condition with the latest security patches installed.

1.12.4 The vendor shall update all ATO required supporting documentation in the event of a system policy, procedural, logical or technical changes to the system.

1.12.4.1 The vendor shall maintain the authorized security configuration and notify the government within forty eight (48) hours of any major changes for review. A major upgrade such as major software or hardware revision must be reassessed for ATO. Vendor shall support reauthorizations due to major upgrades.

1.12.5 The vendor shall ensure the vendor’s device or system is in compliance with the Department of Defense (DoD) Information Assurance Vulnerability Management (IAVM) program upon each deployment.

1.12.6 The vendor shall ensure any new deployment (including rebuilds) deploy with a fully patched, accredited version maintained in a lab environment.

1.12.7 The vendor shall make the duplicate device or system available for periodic security reviews, within forty five (45) business days of notification by Government.