A.09.03_W91YTZ-18-R-0096_CPT.docx

W91YTZ-18-R-0096

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued and is expected to result in the award of a firm-fixed price requirement type contract. The resulting award will be made on SF 1449, for commercial supplies and services. Solicitation number W91YTZ-18-R-0096 is issued as request for quote (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-98 current as of 28 December 2017 and DFARS DPN 20171228.

This acquisition is UNRESTRICTED, under size standard 1000 and NAICS code 339112. The Government anticipates awarding a single award for this requirement to provide a DNA Analyzer, reagents and supplies as detailed the Contract Line Item Numbers below for Martin Army Community Hospital (MACH) at Fort Benning, Georgia. This requirement is for a 12 month base period and one option period all responsible Small Businesses offers may submit a quotation which will be considered by the agency.

Item No. 0001: DNA Analyzer Informational CLIN only: Analyzer, reagents, supplies and maintenance. Period of Performance: 1 October 2018 through 30 September 2019. Billing shall occur monthly.

Item No. 0001AA: Reagents 96 EA Unit Price Total Reagent: Neisseria gonorrhoeae

Item No. 0001AB: Reagents 96 EA Unit Price Total Reagent: Chlamydia trachomatis

Item No. 0001AC: Reagents 20 EA Unit Price Total Reagent: Trichomonas vaginalis.

Total Base period: ______________________

Option Year 1 Item No. 1001: DNA Analyzer Informational CLIN only: Analyzer, reagents, supplies and maintenance. Period of Performance: 1 October 2019 through 30 September 2020. Billing shall occur monthly.

Item No. 1001AA: Reagents 96 EA Unit Price Total Reagent: Neisseria gonorrhoeae

Item No. 1001AB: Reagents 96 EA Unit Price Total Reagent: Chlamydia trachomatis

Item No. 1001AC: Reagents 20 EA Unit Price Total Reagent: Trichomonas vaginalis.

Total Option Year 1: ______________________

Total Base Period Plus one (1) Option Period:

The following FAR Clauses and Provisions in their latest editions apply to this solicitation.

Addendum to FAR 52.212-1 Instructions to Offerors—Commercial Items

FAR 52.212-1 is hereby amended to reflect the changes shown below:

Para (b) Submission of offers

All offerors must be registered in the System for Award Management (SAM) prior to award, and lack of registration shall make an offer ineligible for award. Offerors may obtain information on registration Internet at https://www.sam.gov. Or the SAM Help desk at https://www.fsd.gov.

THE SOLICITATION MUST BE QUOTED ALL OR NONE.

To be delivered FOB Destination to: Martin Army Community Hospital 6600 Van Aalst Boulevard, Fort Benning, GA 31905.

The estimated date of award is September 28, 2018. All questions shall be submitted to Kiah M. Washington and Frederick M. Kmiecik emails: Kiah.M.Washington.Civ@mail.mil and Frederick.M.Kmiecik.Civ@mail.mil by September 12, 2018 1200 PM EST. Responses will be posted to the Federal Business Opportunities website. Proposals are being accepted via email only. All responsible sources should submit proposals to Kiah M. Washington via e-mail: Kiah.M.Washington.civ@mail.mil by September 21, 2018 1200 PM EST. (n) the non-Far Part 12 discretionary FAR, DFARS, AFARS and MEDCOM provisions included herein are incorporated into this solicitation either by reference or in full text. If incorporated by reference, see provision 52.252-1 for locations where full text can be obtained.

Cover email shall include: Data Universal Numbering System (DUNS) / CAGE Code, Point of contact for individual authorized to enter in to discussions to include phone and email.

All offers must request verification by email to Kiah M. Washington Email: Kiah.M.Washington.Civ@mail.mil to confirm receipt of their proposal was received by the time specified in the solicitation. The Government will not be responsible for any failure of transmission or receipt of the offer, or any failure of the offeror to verify receipt of the emailed offer.

Instructions for the Preparation of Quotes

The technical information required for evaluation purposes shall not exceed 10 pages. Each page shall be numbered.

The Quote shall be prepared in two (2) separate volumes as indicated below.

· Volume I-Technical Subfactor 1 Equipment, reference salient characteristics

· Volume II-Pricing

VOLUME I – TECHNICAL

The technical Quote, Volume I, shall be addressed in sufficient written detail for the Government to determine if the offeror understands this aspect of the Government’s requirement. The offeror shall address each factor separately, and shall provide sufficient narrative and supporting data for each factor. Lack of any of these significant capabilities shall be considered sufficient cause for the Quote to be determined unacceptable. The Technical Quote shall provide sufficient detail for the Government to determine whether the Quote acceptably meets the requirements of the solicitation. Statements that the offeror understands, can or will comply with all specifications, or statements paraphrasing the specifications of parts thereof, or phrases such as “standard procedures will be used” or “well-known techniques will be used” will be considered unacceptable. The technical Quote shall provide a narrative and supporting data with the following sections organized separately so that the evaluation factors listed below are included.

The following information must be submitted, in writing, as part of the technical proposal.

1. Technical Specifications for analyzer must meet salient characteristics & delivery of required components

VOLUME II – PRICING

Assessment of price reasonableness based on comparison to market prices.

1. The offeror shall submit proposed pricing for all subcontract Line Item Numbers (subCLINs) identified in the Request for Quote, unless otherwise noted. The offeror shall limit their unit and extended prices to two (2) decimal places (example: $158.03).

1. The offeror shall submit pricing totals for the base period as well as a grand total.

CLAUSES INCORPORATED BY REFERENCE

Certain Activities or Transactions Relating to Iran— Representation and Certifications. OCT 2015

INCORPORATED BY FULL TEXT

Tax Liability or a Felony Conviction under Any

52.252-1 (FEB 1998), Solicitation Provisions Incorporated by Reference: The full text of a solicitation provision may be accessed electronically at this/these address (es): www.farsite.hill.af.mil or www.arnet.gov/far.

52.252-5, Authorized Deviations in Provisions (APR 1984): (b) the use in this solicitation or contract of any DoD FAR Supplement (48 CFR Chapter 2) provision with an authorized deviation is indicated by the addition of “(DEVIATION)" after the name of the regulation.

252.203-7005 Representation Relating to Compensation of Former NOV 2011 DOD Officials

Performance Information Retrieval System-Statistical

252.222-7007 Representation Regarding Combating Trafficking in

252.225-7035 Buy American-Free Trade Agreements-Balance of

252.247-7022 Representation of Extent of Transportation by Sea AUG 1992

52.212-2 Evaluation –Commercial Items OCT 2014

Addendum 52.212-2 (LPTA):

Paragraph (a) replaced with the following:

Award will be made using the lowest price technically acceptable (LPTA) source selection process. Award will be made to the responsible offeror on the basis of the lowest evaluated price of proposals meeting or exceeding the acceptability standards for non-cost factors. Award may be made without discussions with offerors (except communications conducted for the purpose of minor clarification). Therefore, each initial offer should contain the offeror's best terms from a technical and price standpoint. However, the Government reserves the right to conduct discussions if it is later determined by the contracting officer to be necessary.

The Government will award a Firm Fixed Price contract resulting from this solicitation to the responsible Offer whose offer conforming to the solicitation will be the most advantageous for the Government, price and other factors considered. In order to be considered for award, an Offeror must receive an Acceptable rating in all factors. The following factors shall be used to evaluate:

Technical and Price

Award will be made based on lowest price, technically acceptable proposal.

(a) Options. The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced. Evaluation of options shall not obligate the Government to exercise the option(s).

(b) A written notice of award or acceptance of an offer, mailed or otherwise furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contractor without further action by either party. Before the offer’s specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

FACTOR: 1 TECHNICAL

Subfactor 1 – Equipment-Provide in writing, documentation of how your company equipment meets the salient characteristics

SALIENT CHARACTERISTICS

· Not require a water purification/ filtration system or modification of the facility’s plumbing for a water supply.

· Perform transcription-mediated DNA/RNA amplification for Neisseria gonorrhoeae, transcription-mediated DNA/RNA amplification for Chlamydia trachomatis, and transcription-mediated DNA/RNA amplification for Trichomonas vaginalis.

· Provide analyzers that are FDA approved, 100-240V, and use FDA approved software for FDA approved testing reagents.

· Analyzer must have random access, continuous operation capability.

· Analyzer must have barcode Reader and disk drive with read and write and USB port for loading and downloading data and on board operator's/ troubleshooting manuals.

· No direct plumbing or modification of facility for a water source for operation or for waste drain

· Use urine, vaginal swabs, endo-cervical swabs, urethral swabs, and liquid based cytology samples.

· Relative Humidity cannot exceed-15%-75% and must be non-condensing Operating temperature-15-30 degrees Celsius.

· Analyzer must interface with the DoD Electronic Health Record system.

· Analyzer must interface with Laboratory Information System (LIS) CHCS (Composite Health Care System for 2-way communication with broadcast download and host.

· Analyzer Operating system must be compatible with Windows 10 or higher.

· Analyzer must provide capability for data and information storage and data management.

Required Components Command Center Sample Management Center Barcode Sample Identification Unit Reagent Management Unit

Technical will be evaluated as either Acceptable or Unacceptable. Best value is expected to result from selection of the technically acceptable proposal with the lowest evaluated price. Definitions are as follows:

ACCEPTABLE: To be rated acceptable, the offeror's technical proposal must demonstrate it can meet all specifications and testing requirements.

UNACCEPTABLE: A technical proposal that fails to demonstrate it can meet one or more requirements will be determined unacceptable.

FACTOR II: PRICE

Price will be evaluated separately from Technical and will be evaluated for fairness and reasonability. The offeror shall complete the CLIN structure with a total cost covering the base period developed based upon the annual testing requirement and includes the lease of analyzer, installation, training, reagents and consumables. This information will be used to assist in the price analysis as required by FAR 15.404-1(b).

STATEMENT OF OBJECTIVES

Martin Army community Hospital, Fort Benning, GA

Statement of Objectives

1. General Description.

1.1. Provide Martin Army Community Hospital (BMACH), USAMEDDAC Fort Benning, Georgia laboratory with a supply an automated DNA Testing system to include analyzer, reagents and supplies. This analyzer is located in the microbiology section of the Department of Pathology.

2. Physical Security

2.1. Ensure that any requirement to remove, exchange, or add contractor’s equipment during the performance of this contract is coordinated through the Contract Officer’s Representative (COR) and must also include the site OIC/NCOIC, Chief EMB and the Property Book Officer.

3. Hours of Operation.

3.1. Normal Hours. Normal hours of operation are 8:00am to 3:00pm EST, Monday through Friday.

3.2. Recognized Holidays. Facility observes all federal holidays. Federal Holidays are as follows:

NOTE : When any of the above holidays fall on a Saturday it will be observed on the preceding Friday; holidays that fall on a Sunday will be observed on the following Monday. Any holidays declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above.

4. Deliverables

4.1. Ensure proper packaging of reagents, supplies, and equipment and that they are shipped at proper refrigerated or frozen temperatures according to manufacturer specifications.

4.2. Ensure all shipments arrive Monday through Friday between the hours of 8:00am and 3:00pm EST; excluding holidays and weekends according to paragraph 1.6.2 above.

4.3. Respond to phone calls regarding shipment discrepancies the same day of notification and discrepancy will be corrected within 24 hours.

4.4. Provide customer notification of updates on any reagents in writing within 5 business days and ensure continuity of services and availability of reagents during reagent revision when required.

4.5. Ensure reagents meet quality control guidelines set forth by manufacturer.

4.6. Provide all software upgrades.

4.7. Notify the laboratory if there is a recall on any reagents or equipment within 24 hours.

4.8. Provide 24 hour telephonic troubleshooting.

4.9. Ensure the system can perform transcription-mediated DNA/RNA amplification for Neisseria gonorrhoeae, transcription-mediated DNA/RNA amplification for Chlamydia trachomatis, and transcription-mediated DNA/RNA amplification for Trichomonas vaginalis.

5.0. Reserved

6.0. Reserved

7. U.S. Army Cybersecurity and Risk Management Framework (RMF) Requirements.

7.1. System Security Requirements.

7.1.1. The vendor shall submit to the Government, included in the quote, the blue section of the Medical Device Cybersecurity Assessment (Questionnaire) provided by government and Nessus Scans. Nessus scanner is to be procured by the vendor, at their own cost, in order to comply with RMF requirements.

7.1.2. Vendor agrees to comply with security regulations and guidance listed in attached Appendix A and all Risk Management Framework (RMF) requirements.

7.1.3. Failure to meet the requirements may result may result in termination of the delivery order for cause, in accordance with FAR 52.212-4(m).

7.1.4. The vendor device or system shall pass pre-validation screening (Vulnerability scans utilizing Nessus and SCAP scans), administered within six (6) months of contract award that will be conducted by Government, and must meet criteria listed below:

(a). No unmitigated Very High or High Severity/ Category I (CAT I), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx (b). No unmitigated Moderate Severity/Category II (CAT II), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx (c). No unmitigated Very High or High Severity/ Category I (CAT I) vulnerabilities from Nessus vulnerability scans.

(d) No unmitigated Moderate Severity/ Category II (CAT II) vulnerabilities from Nessus vulnerability scans.

7.1.5. The vendor shall mitigate all Very High, High, and Moderate Severity/CAT I and CAT II vulnerabilities discovered during the Assessment and Authorization (A&A) process according to a schedule published by Government.

7.1.6. The vendor shall appoint a vendor point of contact responsible for the cybersecurity of the vendor device or system throughout the lifecycle of the system. The vendor shall provide Subject Matter Experts (SMEs) to support all assessments of contracted products and materials, and meet required deliverable timelines.

7.1.7. The vendor shall obtain a recommendation of Authority to Operate (ATO) as determined by a Government appointed third party validator within twelve (12) months of contract award.

7.1.8. The vendor shall not make any delivery and shall not receive payment for the system until the ATO is granted. Receiving the ATO document from the U.S. Army shall constitute permission to perform on the order and to proceed with delivery. All delivery dates shall be reset in accordance to contract and in days after the date the ATO is communicated in writing to the vendor. Delivery may take place prior to ATO only if written permission is provided by the DLA Contracting Officer.

7.1.9. Pursuant to subsequent warranty period and Service Maintenance Agreements (SMA), the vendor shall, after the award of an ATO, ensure that the vendor’s device or system maintains its ATO for as long as the equipment is operated by Government.

7.1.10. The vendor shall establish appropriate administrative and technical safeguards to ensure the confidentiality, integrity, and availability of Government data under their control.

7.1.11. The vendor shall notify the Information Owner and Contracting Officer POCs in writing with any inabilities to comply with DoD security requirements. Vendor will provide anticipated costs and timelines required to address vulnerabilities in question.

7.1.12. The vendor shall contact the IA/RMF Office Representative, no later than 5 days after delivery order selection or contract award, to start the process. Failure to do so would be considered a vendor caused delay.

7.2. RMF Timeframes.

The following table provides an overview of the entire Process to obtain approval under Army Cybersecurity requirements. Vendor actions must start as cited in the number of days after date of order column noted below and be completed in the number of days listed below in the Duration column.

GOVERNMENT

GOVERNMENT

7.3. Assessment and Authorization (A&A).

7.3.1. The vendor shall submit all RMF required documentation, as specified by Government Reps for review and approval, no later than four (4) months after request by the Government.

7.3.2. The vendor shall obtain approval from the Government, any vendor developed policies, plans, and procedures prior to implementation.

7.3.3. The vendor shall provide any additional documentation required by the Government for completion of the A&A process within thirty (30) business days of request by the Government.

7.3.4. The vendor shall provide technical scans within one (1) month of the A&A kickoff meeting.

7.3.5. The vendor shall provide updated technical scans on a monthly basis, on the 10th day of each month until an ATO is granted.

7.3.6. The vendor shall ensure that the vendor device or system is capable of supporting the use of DISA approved intrusion detection and prevention, antivirus, and antimalware applications. The vendor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support either the full security suite or the individual components (e.g. DLP, IPS, Antivirus, etc.) without performance degradation of the medical system/device. In cases where the operation of security applications are not technically achievable, the vendor shall provide detailed justification and a Plan of Actions and Milestones (POA&M) describing steps towards compliance with this requirement.

7.3.7. The vendor shall ensure that the vendor device or system is configured in such a way that allows the updating of malware definition signatures on a scheduled basis. Scanning shall encompass the entire system (file system, operating system, real-time processes) by default. In cases where scanning of the entire system may negatively affect its operation, the vendor shall provide a detailed list of exclusions with justifications.

7.4. Privileged User Training and Certification Requirements. If a vendor requires a B2B, access, etc. to government networks to maintain, analyze, etc., their products, they must adhere to the following requirements:

7.4.1. Information Assurance Contractor Training and Certification. Contractors requiring a privileged-level account for administrative/maintenance support of systems/applications on the Army network will meet Army requirements for a privileged-level account before being granted a network account. Requirements include:

7.4.2. Cyber (Information assurance (IA)/information technology (IT)) certification. Per DoD 8570.01-M , DFARS 252.239.7001 and AR 25-2, the contractor employees supporting Cyber (IA/IT) functions shall be appropriately certified upon contract award. Contractors will be defined at Information Assurance Technical level I (IAT – II) and be required to meet minimum Professional Baseline certifications at the time of contract award. Contractors will be given six (6) months to meet Computer Environment (CE) and Cyber Security Fundamental training requirements. Not meeting the requirements in accordance with DoD 8570.01-M will result in the contractor account and access being ‘Disabled’ or ‘Deleted’ until such time as the conditions of this contract are met.

7.4.3. Background Investigation. NACI or above is required. Vendors should email: usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain guidance on the process.

7.4.4. Professional Baseline Certification. The minimum Professional Baseline certification for IAT-II is CompTIA Security+. Higher certifications (GSCL, CISM, CISSP, etc.) will satisfy this requirement.

7.4.5. Computer Environment (CE) Certification. Computer Environment (CE) certifications are determined by the role of the contractor and must be met within six months of delivery order issuance. Contractors working on servers are encouraged to have a Microsoft 2008 Server or 2012 Server certification. Contractors working on End-User devices are encouraged to have a professional certification that coincides with the technology inherent in the system (i.e. MCSE, CCNA, RHCSE, Microsoft Windows 7 and Windows 10 etc.). The CompTIA A+ certification will also satisfy the CE certification requirement.

7.4.6. IA Training. DoD Cyber Awareness Challenge Training must be completed by all contractor employees and associated sub-contractor employees prior to issuance of network access and annually thereafter. DoD Cyber Awareness Challenge Training is available at the following website: https://ia.signal.army.mil/DoDIAA/ Contractors will meet minimum training requirements within six months of contract award.

7.4.7. Two-Factor Authentication. Contractors will authenticate using two-factor authentication. The preferred method for authenticating is the Common Access Card (CAC).

7.4.8. Army Training Certification Tracking System (ATCTS). Contractors with a need for elevated privileged-level access will be defined to ATCTS. https://atc.us.army.mil/iastar/regulations.php.

7.4.9. BMACH Network Account Request Package (Authorized & Privileged). The contractor will submit a request package through either the ITC One-Stop Shop for contractors requiring on-site access or through the Information Assurance/Cyber Security Branch for contractors requiring remote access to BMACH network. Remote access must be through a Defense Health Agency (DHA) Business-To-Business (B2B) solution. Vendors should email: usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain remote access through DHA, for Army requirements. The package includes DD Form 2875 – System Authorization Access Request (SAAR). All contractors requiring a BMACH network account will complete the DD Form 2875 to include validation of a Security Background Investigation. Information Assurance Branch will be the sponsor for all contractors requiring elevated privileged-level access. The department chief will sign the DD2875 as the contractor supervisor. Note: contractors requiring a ‘Privileged’ account will check ‘Box 14.’ on the form. The DD2875 SAAR Form is available at the following website: https://atc.us.army.mil/iastar/docs/DD_Form_2875_System_Access_Agreement_Request.pdf.

7.4.10. Acceptable Use Policy (AUP). All vendors/contractors will sign/acknowledge the Army Standard Acceptable Use Policy (AUP) prior to being granted an Army network account. The Army Standard AUP is available at the following website: https://atc.us.army.mil/iastar/docs/aup.pdf

7.5. Warranty and Post-Warranty Service Maintenance Agreement Cybersecurity Requirements.

7.5.1. Continuous Risk Management

(a). The vendor shall maintain a duplicate of the fielded device, system, or group of configurations falling under one authorization; for testing in a vendor supplied lab environment at vendor location for as long as the system is operated by the Government.

(b). The vendor shall maintain the duplicate system or device in operational condition with the latest security patches installed.

7.5.2. The vendor shall update all ATO required supporting documentation in the event of a system policy, procedural, logical or technical changes to the system.

7.5.3. The vendor shall maintain the authorized security configuration and notify the government within forty eight (48) hours of any major changes for review. A major upgrade such as major software or hardware revision must be reassessed for ATO. Vendor shall support reauthorizations due to major upgrades.

7.5.4. The vendor shall ensure the vendor’s device or system is in compliance with the Department of Defense (DoD) Information Assurance Vulnerability Management (IAVM) program upon each deployment.

7.5.5. The vendor shall ensure any new deployment (including rebuilds) deploy with a fully patched, accredited version maintained in a lab environment.

7.5.6. The vendor shall make the duplicate device or system available for periodic security reviews, within forty five (45) business days of notification by Government. The vendor shall perform monthly vulnerability scans using the most recent and updated version of approved DoD scan tools.

7.5.7. Vendor shall maintain system and update to comply with updated STIGS as made available by the Government within three (3) months of notification by the Government.

7.5.8. The vendor shall provide vulnerability scan and SCAP scan results to Government on a monthly basis. Vendor shall provide raw scan results and administrative reports no later than the 10th calendar day of each month.

7.5.9. The vendor shall close all discovered vulnerabilities within three (3) months of discovery.

7.5.10. The vendor shall submit to Government detailed explanations for the inability to close discovered vulnerabilities.

7.5.11. The vendor shall submit to Government for approval of any mitigation that addresses any open vulnerabilities.

7.5.12. The vendor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to Government for approval.

7.5.13. The vendor shall use the Government approved method for remote access administration (DISA B2B) of system or device.

7.6. Cybersecurity Regulations and Guidance. The vendor shall use and comply with the most recent published versions as of the date of contractual agreement of the following references as well as all regulations or guidance referenced within those publications:

7.6.1. United States Law

i. The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

ii. The Federal Information Security Management Act (FISMA)

iii. The E-Government Act of 2002

7.6.2. Office of Management and Budget (OMB)

i. The following publications are located at https://www.whitehouse.gov/omb/agency/default

ii. Circular A-130

iii. Guidance M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12-Policy for a Common Identification Standard for Federal Employees and Vendors

7.6.3. National Institute of Standards and Technology (NIST)

i. The following publications are located at http://www.nist.gov/publication-portal.cfm

ii. NIST Special Publication (SP) 800-37 – Guide for Applying the Risk Management Framework (RMF) to Federal Information Systems

iii. NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations

7.6.4. Federal Information Processing Standards (FIPS)

i. The following publications are located at http://www.nist.gov/itl/fipscurrent.cfm

ii. FIPS Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules

iii. FIPS PUB 199 – Standards for Security Categorization of Federal Information and Information Systems

iv. FIPS PUB 201-2, Personal Identity Verification of Federal Employees and Vendors

7.6.5. Department of Defense (DoD)

i. The following publications are located at http://www.dtic.mil/whs/directives/

ii. DoD Instruction 5200.2, DoD Personnel Security Program (PSP)

iii. DoD Instruction 8500.1, Cybersecurity

iv. DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling

v. DoD Instruction 8510.01, Risk Management Framework Process (RMF)

vi. DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM)

vii. DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs

viii. DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in DoD Health Care Programs

ix. DoD Directive 5400.11, DoD Privacy Program

x. DoD Manual 5400.11-R, Department of Defense Privacy Program

7.7. SECURITY CLEARANCES.

7.7.1. Personnel to be assigned to an ADP/IT position must undergo a successful security screening before being provided access to DoD information technology resources. Prior to an employee being granted interim access to DoD sensitive information, Martin Army Community Hospital must receive notification that the Office of Personnel Management (OPM) has scheduled the employee's investigation. This requirement must be met by contractors, subcontractors and other who have access to information systems containing information protected by the Privacy Act of 1974 and protected health information under HIPAA. Background checks are required for all ADP/IT personnel who receive, store, display, or transit sensitive information. Employees must have at a minimum an ADP Sensitivity Designation of Level II to access the DoD Network.

7.7.2. All contractors that use the DoD gateways to access government systems must submit a DISA Form 41 or equivalent in accordance with Contracting Officer guidance. In addition, Form 41s are required for each system administrator responsible for each host-to-host interface. Contractors shall complete and submit to TMA one Form 41 for their organization, attached to which shall be a listing of those individuals for whom background checks have been completed, submitted to the Office of Personnel Management (OPM), and acknowledgements have been received from OPM that the applications are complete and are pending action by OPM. The request must clearly delineate the ports and protocols used for each IP address. The contractor shall complete the form and submit to the government for final processing. All costs for the background investigations are the responsibility of the contractor.

8. BUSINESS to BUSINESS (B2B) REQUIREMENTS for CONTRACTOR.

8.1. General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow.

8.2. Personnel Security.

8.2.1. The contractor shall comply with DoD Directive 8500.1, “Information Assurance (IA),” DoD Instruction 8500.2, “Information Assurance (IA) Implementation,” DoD Directive 5400.11, “DoD Privacy Program,” DoD 6025.18-R, “DoD Health Information Privacy Regulation,” DoD 5200.2-R, “Personnel Security Program Requirements.” AR25-1, “Army Knowledge Management and Information Technology”, AR 25-2 “Information Assurance.” And local regulations as deemed appropriate by the activity Information Assurance personnel.

8.2.2. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

(a). Follow the Army guidelines for submittal of Automated Data Processor/Information Technology (ADP/IT) background investigations and ensure all contractor personnel are designated as ADP/IT-I, ADP/IT-II, or ADP/IT-III where their duties meet the criteria of the position sensitivity designations outlined in AR25-2.

(b). Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Information Systems within the logical boundaries of the facility LAN.

(c). Immediately report to the Martin Army Community Hospital Personnel Security Manager at 762-408-0308 and deny access to any automated information system (AIS), network, or information if a contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate government representative for any reason.

8.3. Electronic Security.

8.3.1. Disposing of Electronic Media. Vendors shall follow the DoD standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with DoD Memorandum "Disposition of Unclassified Computer Hard Drives," June 4, 2001. Vendors are required to also follow DoD guidance on sanitization of other internal and external media components in DODI 8500.2 "Information Assurance (IA) Implementation," 6 Feb 2003 (see PECS-1 in enclosure 4 Attachment 5) and DoD 5220.22-M "Industrial Security Program Operating Manual (NISPOM)," (Chapter 8).

8.3.2. Information Assurance Vulnerability Management (IAVM) The contractor shall implement an information assurance vulnerability management program for all AIS and corresponding subnets that are connected to or intermittently connect to Army networks. The program shall meet the scope and intent of AR25-2 and Martin Army Community Hospital IA policies to provide protection against known threats and vulnerabilities. Compliance with Army IAVM alerts and bulleting is required for these systems, and shall be completed within the specified timeframe.

8.4. Information Systems (IS)/Networks Physical Security.

8.4.1. The contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the contractor will support a Physical Security Audit performed by the Government of the contractor's internal information management infrastructure. The MHS Physical Security Audit Matrix is available at: http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version.xls. The contractor shall correct any deficiencies identified by the Government of the contractor's physical security posture.

8.4.2. Special Requirements for Protected Health Information. Whenever a contract is awarded that requires the vendor to collect, use, copy, access or store Protected Health Information (PHI) in commercial office space, the contractors must notify the Martin Army Community Hospital HIPAA Security Manager, Ms. Beverly Simmons at 762-408-0032.

8.4.3. Follow all DUA and DoD requirements for secure disposal, destruction, and/or sanitization of all equipment that contained PHI.

9. Anti-Terrorism and Operations Security Contract Requirements.

9.2. Access and general protection/security policy and procedures. This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area. Contractor and all associated sub-contractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

9.4. For contractors that do not require CAC, but require access to a DoD facility or installation. Contractor and all associated sub-contractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB) (Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

IRAPT- Invoice, Receiving, Acceptance and property Transfer-formerly known as WAWF HIPPA-Health Insurance Portability and Accountability Act (7 July 2014) TFMC-Tobacco Free Medical Campus LEIE (October 2015)

52.212-4 Contract Terms and Conditions—Commercial Items JAN 2017

52.212-4 ADDENDUM

(w) the non-FAR Part 12 discretionary FAR, DFARS, AFARS, and Local clauses herein are incorporated into this contract either by reference or in full text. If incorporated by reference, see clause 52.252-2 for locations where full text can be found.

CLAUSES INCORPORATED BY REFERENCE

With Contractors Debarred, Suspended, or Proposed

252.232-7003 Electronic Submission of Payment Request and

Incorporated in Full Text

52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

This contract incorporates one or more clauses by reference, with the same force and effect as if they were given in full text. Upon request, the Contracting Officer will make their full text available. Also, the full text of a clause may be accessed electronically at this/these address (es):

(End of clause)

52.252-6 AUTHORIZED DEVIATIONS IN CLAUSES (APR 1984)

(a) The use in this solicitation or contract of any Federal Acquisition Regulation (48 CFR Chapter 1) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the date of the clause.

(b) The use in this solicitation or contract of any DoD FAR Supplement (48 CFR Chapter 2) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the name of the regulation.

(End of clause)

252.247-7023 252.247-7024 Transportation of Supplies by Sea-Basic Notification of Transportation of Supplies By Sea

APR 2014

MAR 2000

End of Additional FAR and DFARS clauses Incorporated by Full Text 52.212-5 Contract Terms and Conditions Required to Implement Statutes or Executive Orders—Commercial Items (Deviation

2013-O0019) JAN 2017