A.09_W91YTZ19Q0420_CPPR.docx

This is a solicitation for commercial items prepared in accordance with the format in Subpart 12.6, and 13.5 as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued and is expected to result in the award of a firm-fixed price supply type contract. The resulting award will be made on SF 1449, for commercial supplies and services. Solicitation number W91YTZ-19-Q-0420 issued as request for quote (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-101, DPN 2018103 and Class Deviation 2019-O0003 current as of 17 December 2018.

The NAICS code is 325413 and size standard is 1250. The Government anticipates awarding a single award issued as Firm Fixed Price, UNRESTRICTED. The requirement of this solicitation is for glucose test strips and reagents.

Item No. 0001: CHEMISTRY ANALYZERS Informational CLIN only: Three (3) Chemistry Analyzers Period of Performance: 1 October 2019 through 30 September 2020. Billing shall occur monthly.

Analyzer Locations:

1. Combined Troop Medical Clinic: 2515 Sightseeing Rd, Building 2515, Fort Benning, GA 31905.

2. Winder Troop Medical Clinic: 41st Infantry Regiment ST Building 3306, Fort Benning, GA 31905

3. Harmony Church Troop Medical Clinic: 6796 Old Cusseta HWY, Building 4202, Fort Benning, GA 31905

0001AA: Cost Per Reportable Result (CPRR) 1 Job Period of Performance: 1 October 2019 through 30 September 2020.Billing shall occur monthly.

Annual Usage: reference Table Base Period: 1 OCT 19-30 SEP 20

All Reagents Delivered FOB: Combined Troop Medical Clinic, 2515 Sightseeing Rd, Building 2515, Fort Benning, GA 31905

Base Period:1 OCT 19-30 SEP 20

Albumin

ALKP

ALT

AST

BUN

Calcium

Chloride

Creatinine

Enzymatic CO2

Glucose

Potassium

Sodium

Total Bilirubin

Total Protein

BUBC

CK

Annual Total

$0.00

Total Base Period: $_________________________ Option 1

Item No. 1001: CHEMISTRY ANALYZERS Informational CLIN only: Three (3) Chemistry Analyzers Period of Performance: 1 October 2020 through 30 September 2021. Billing shall occur monthly.

Analyzer Locations:

1. Combined Troop Medical Clinic: 2515 Sightseeing Rd, Building 2515, Fort Benning, GA 31905.

2. Winder Troop Medical Clinic: 41st Infantry Regiment ST Building 3306, Fort Benning, GA 31905

3. Harmony Church Troop Medical Clinic: 6796 Old Cusseta HWY, Building 4202, Fort Benning, GA 31905

1001AA: Cost Per Reportable Result (CPRR) 1 Job Period of Performance: 1 October 2020 through 30 September 2021.Billing shall occur monthly.

Annual Usage: reference Table Option 1: 1 OCT 20-30 SEP 21

All Reagents Delivered FOB: Combined Troop Medical Clinic, 2515 Sightseeing Rd, Building 2515, Fort Benning, GA 31905.

Option 1: 1 OCT 20-30 SEP 21

Albumin

ALKP

ALT

AST

BUN

Calcium

Chloride

Creatinine

Enzymatic CO2

Glucose

Potassium

Sodium

Total Bilirubin

Total Protein

BUBC

CK

Annual Total

$0.00

Total Option Period 1: $___________________

Grand Total Base Period plus 1 Option Period: $_____________________________

The following FAR Clauses and Provisions in their latest editions apply to this solicitation.

52.212-1, Instructions to Offers—Commercial Items (DEVIATION 2018-O0018) (OCT 2018);

Addendum 52.212-1: (b) Submission of offers

All offerors must be registered in the System for Award Management (SAM) prior to award, and lack of registration shall make an offer ineligible for award. Offerors may obtain information on registration Internet at https://www.sam.gov. Or the SAM Help desk at https://www.fsd.gov.

THE SOLICITATION MUST BE QUOTED ALL OR NONE.

To be delivered FOB Destination

The estimated date of award is September 30, 2019. Proposals will only be accepted via email. All questions shall be forwarded to the email below by September 19, 2019 12:00 PM EST. Responses shall be posted on the Federal Business Opportunities Website. All responsible sources should submit proposals to Kiah M. Washington via e-mail: Kiah.M.Washington.civ@mail.mil by September 24, 2019 12:00 P.M. EST. (n) the non-Far Part 12 discretionary FAR, DFARS, AFARS and MEDCOM provisions included herein are incorporated into this solicitation either by reference or in full text. If incorporated by reference, see provision 52.252-1 for locations where full text can be obtained.

Cover email shall include: Data Universal Numbering System (DUNS) / CAGE Code, Point of contact for individual authorized to enter in to discussions to include phone and email.

All offers must request verification by email to Kiah M. Washington Email: Kiah.M.Washington.Civ@mail.mil to confirm receipt of their proposal was received by the time specified in the solicitation. The Government will not be responsible for any failure of transmission or receipt of the offer, or any failure of the offeror to verify receipt of the emailed offer.

Instructions for the Preparation of Quotes

The technical information required for evaluation purposes shall not exceed 20 pages. Each page shall be numbered.

The proposal shall be prepared in two (2) separate volumes as indicated below.

Volume I-Technical

Sub factor 1 Installation Plan Sub factor 2 Equipment Reference Salient Characteristics

Volume II-Pricing

VOLUME I – TECHNICAL

The technical proposal, Volume I, shall be addressed in sufficient written detail for the Government to determine if the offeror understands this aspect of the Government’s requirement. The offeror shall address each factor separately, and shall provide sufficient narrative and supporting data for each factor. Lack of any of these significant capabilities shall be considered sufficient cause for the proposal to be determined unacceptable. The Technical Proposal shall provide sufficient detail for the Government to determine whether the proposal acceptably meets the requirements of the solicitation. Statements that the offeror understands, can or will comply with all specifications, or statements paraphrasing the specifications of parts thereof, or phrases such as “standard procedures will be used” or “well-known techniques will be used” will be considered unacceptable. The technical proposal shall provide a narrative and supporting data with the following sections organized separately so that the evaluation factors listed below are included.

The following information must be submitted, in writing, as part of the technical proposal.

1. Installation Plan

2. Technical Specifications for analyzer and CPPR must meet salient characteristics-must address the following

VOLUME II – PRICING

Assessment of price reasonableness based on comparison to market prices.

1. The offeror shall submit proposed pricing for all subcontract Line Item Numbers (subCLINs) identified in the Request for Proposal, unless otherwise noted. The offeror shall limit their unit and extended prices to two (2) decimal places (example: $158.03).

1. The offeror shall submit pricing totals for the base period and option years individually, as well as a grand total.

Incorporated by Reference

52.204-7--SYSEM FOR AWARD MANAGEMENT (OCT 2018)

52.204-16--COMMERCIAL AND GOVERNMENT ENTITY CODE (JUL 2016)

52.223-1--BIO BASED PRODUCT CERTIFICATION (MAY 2012)

52.225-25—PROHIBITION ON ENGAGING IN SANCTIONED ACTIVITIES RELATING TO IRAN-CERTIFICATION (OCT 2015)

Incorporated by Full Text

52.209-2—PROHIBITION ON CONTRACTING WITH INVERTED DOMESTIC CORPORATIONS-REPRESENTATIONS (NOV 2015)

52.209-11—REPRESENTATION BY CORPORATIONS REGARDING DELINQUENT TAX LIABILITY OR A FELONY CONVICTION UNDER ANY FEDERAL LAW (FEB 2016)

52.222-22—PREVIOUS CONTRACTS AND COMPLIANCE REPORTS (FEB 1999)

52.222-25—AFFIRMATIVE ACTION COMPLIANCE (APR 1984)

52.252-1 (FEB 1998), Solicitation Provisions Incorporated by Reference: The full text of a solicitation provision may be accessed electronically at this/these address (es): www.farsite.hill.af.mil or www.arnet.gov/far.

52.252-5, Authorized Deviations in Provisions (APR 1984): (b) the use in this solicitation or contract of any DoD FAR Supplement (48 CFR Chapter 2) provision with an authorized deviation is indicated by the addition of “(DEVIATION)" after the name of the regulation.

252.203-7005—REPRESENTATION RELATING TO COMPENSATION OF FORMER DOD OFFICIALS (NOV 2011)

252.204-7004—ALTERNATE A, SYSTME FOR AWARD MANAGEMENT (FEB 2014)

252.204-7008—COMPLIANCE WITH SAFEGUARDING COVERED DEFENSE COVERED INFORMATION CONTROLS (OCT 2016)

252.204-7011—ALTERNATE LINE-ITEM STRUCTURE (SEP 2011)

(END OF ADDENDUM 52.212-1)

52.212-2—EVALUATION—COMMERCIAL ITEMS (OCT 2014)

Addendum 52.212-2 (LPTA):

Paragraph (a) replaced with the following:

Award will be made using the lowest price technically acceptable (LPTA) source selection process. Award will be made to the responsible offeror on the basis of the lowest evaluated price of proposals meeting or exceeding the acceptability standards for non-cost factors. Award may be made without discussions with offerors (except communications conducted for the purpose of minor clarification). Therefore, each initial offer should contain the offeror's best terms from a technical and price standpoint. However, the Government reserves the right to conduct discussions if it is later determined by the contracting officer to be necessary.

The Government will award a Firm Fixed Price contract resulting from this solicitation to the responsible Offer whose offer conforming to the solicitation will be the most advantageous for the Government, price and other factors considered. In order to be considered for award, an Offeror must receive an Acceptable rating in all factors. The following factors shall be used to evaluate:

Technical and Price

Award will be made based on lowest price, technically acceptable proposal.

(a) Options. The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced. Evaluation of options shall not obligate the Government to exercise the option(s).

(b) A written notice of award or acceptance of an offer, mailed or otherwise furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contractor without further action by either party. Before the offer’s specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

FACTOR: 1 TECHNICAL

Sub factor 1 –Installation Plan-Provide in writing, documentation of your company plans to meet the installation requirement.

Sub factor 2 – Equipment-Provide in writing, documentation of how your company equipment meets the salient characteristics

SALIENT CHARACTERISTICS-Analyzers

Provide analyzers that are FDA approved, 100-240V, and use FDA approved software for FDA approved testing reagents.

Provide low to medium capacity analyzer that can result at least 185 load 150-200 samples at a time.

Analyzer must have random access, continuous operation, remote access and STAT test capability.

Analyzer must have barcode Reader and disk drive with read and write and USB port for loading and downloading data and on board operator's/ troubleshooting manuals.

No direct plumb, modification of facility for water source or waste drain for operation.

Universal sample capabilities for all sample tube sizes.

Auto dilution, operator dilution and manual dilution protocols and calculations.

Space limitations; equipment cannot exceed: Height-64.5 inches, Width-83.5 inches, and Depth-33.5 inches.

Environmental limitations: Relative humidity cannot exceed 15%-75% and must be non-condensing and operating temperature 15-30 degrees Celsius.

Analyzer must interface with the DoD Electronic Health Record system.

Analyzer must interface with Laboratory Information System (LIS) CHCS (Composite Health Care System for 2-way communication with broadcast download and host.

Analyzer Operating system must be compatible with Windows 7 or higher.

Analyzer must provide capability for data and information storage and data management Ready to use reagents that do not have to be prepared.

End of Salient Characteristics

Attachment 1 Statement of Objectives Martin Army Community Hospital Fort Benning, Georgia

1 PHYSICAL SECURITY.

1.1. Contractor personnel or any representative of the contractor entering Fort Benning shall abide by all security regulations and shall be subject to security checks. Contractor employees shall comply with applicable installation/ facility access and local security policies and procedures (provided by Government representative as needed).

1.1.2 Contractor shall ensure personnel report to the Equipment Management Suite located in room GC-122 on the ground floor to sign in and obtain a temporary vendor security badge PRIOR to commencing all on-site visits.

1.2. HOURS OF OPERATION.

1.2.1 Normal Hours. Normal hours of operation are 8:00am to 3:00pm EST, Monday through Friday.

1.2.2. Recognized Holidays. Facility observes all federal holidays. Federal Holidays are as follows:

NOTE : When any of the above holidays fall on a Saturday it will be observed on the preceding Friday; holidays that fall on a Sunday will be observed on the following Monday. Any holidays declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above.

2. Equipment

2.1 Contractor will provide new or updated user manuals when changes are made at no additional cost.

2.2 Contractor will deliver three automated low volume chemistry analyzers including the following Components per System:

Command Center Sample Management Center Reagent Management Center

2.3 The contractor will ensure proper packaging of reagents, supplies, and equipment and that they are shipped at proper refrigerated or frozen temperatures according to manufacturer specifications.

2.4 Provide FDA approved reagents for use in clinical testing with expiration dates no less than 6 months of delivery date that function properly and pass lot to lot testing.

2.5 Provide ready to use reagents that do not have to be prepared.

2.6 Ensure all shipments arrive Monday through Friday between the hours of 8:00am and 3:00pm EST; excluding holidays and weekends.

2.7 Notify the laboratory if there is a recall on any reagents or equipment within 24 hours.

2.8 Provide customer notification of updates on any reagents in writing within 5 business days and ensure continuity of services and availability of reagents during reagent revision when required.

3. Installation Plan will be added at the time of award

4. RESERVED

5. Specific Task

5.2. The contractor shall respond to phone calls regarding shipment discrepancies the same day of notification and discrepancy will be corrected within 24 hours.

5.3. Contractor will provide customer notification of updates on any reagents in writing within 5 business days and ensure continuity of services and availability of reagents during reagent revision when required.

5.4. Reagents must meet quality control guidelines set forth by manufacturer.

5.6. The contractor will notify the laboratory if there is a recall on any reagents or equipment within 24 hours.

6. INFORMATION TECHNOLOGY (IT) CONNECTIVITY.

6.1. TELECOMMUNICATION.

6.1.1. All contractor systems that will communicate with DoD systems will interconnect through the established MHS B2B gateway. For all Web applications, contractors will connect to a DISA-established Web DMZ.

6.1.2. In accordance with contract requirements, MCS contractors will connect to the B2B gateway via a contractor procured Internet Service Provider (ISP) connection. Contractors will assume all responsibility for establishing and maintaining their connectivity to the B2B gateway. This will include acquiring and maintaining the circuit to the B2B gateway and acquiring a Virtual Private Network (VPN) device compatible with the MHS VPN device.

6.1.3. Contractors will comply with DoD guidance regarding allowable ports, protocols and risk mitigation strategies.

6.1.4. All costs for VPN hardware and software will be incurred by the contractor.

6.2. U.S. Army Cybersecurity/Risk Management Framework (RMF) Requirements.

6.2.1. System Security Requirements.

6.2.1.1. The vendor shall submit to the Government, included in the quote, the blue section of the Medical Device Cybersecurity Assessment (Questionnaire) provided by government and Nessus Scans. Nessus scanner is to be procured by the vendor, at their own cost, in order to comply with RMF requirements.

6.2.1.2. Vendor agrees to comply with security regulations and guidance listed in attached Appendix A and all Risk Management Framework (RMF) requirements.

6.2.1.3. Failure to meet the requirements may result may result in termination of the delivery order for cause, in accordance with FAR 52.212-4(m).

6.2.1.4. The vendor device or system shall pass pre-validation screening (Vulnerability scans utilizing Nessus and SCAP scans), administered within six (6) months of contract award that will be conducted by Government, and must meet criteria listed below:

a. No unmitigated Very High or High Severity/ Category I (CAT I), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx

b. No unmitigated Moderate Severity/Category II (CAT II), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx

c. No unmitigated Very High or High Severity/ Category I (CAT I) vulnerabilities from Nessus vulnerability scans.

d. No unmitigated Moderate Severity/ Category II (CAT II) vulnerabilities from Nessus vulnerability scans.

6.2.1.5 The vendor shall mitigate all Very High, High, and Moderate Severity/CAT I and CAT II vulnerabilities discovered during the Assessment and Authorization (A&A) process according to a schedule published by Government.

6.2.1.6. The vendor shall appoint a vendor point of contact responsible for the cybersecurity of the vendor device or system throughout the lifecycle of the system. The vendor shall provide Subject Matter Experts (SMEs) to support all assessments of contracted products and materials, and meet required deliverable timelines.

6.2.1.7. The vendor shall obtain a recommendation of Authority to Operate (ATO) as determined by a Government appointed third party validator within twelve (12) months of contract award.

6.2.1.8. The vendor shall not make any delivery and shall not receive payment for the system until the ATO is granted. Receiving the ATO document from the U.S. Army shall constitute permission to perform on the order and to proceed with delivery. All delivery dates shall be reset in accordance to contract and in days after the date the ATO is communicated in writing to the vendor. Delivery may take place prior to ATO only if written permission is provided by the DLA Contracting Officer.

6.2.1.9. Pursuant to subsequent warranty period and Service Maintenance Agreements (SMA), the vendor shall, after the award of an ATO, ensure that the vendor’s device or system maintains its ATO for as long as the equipment is operated by Government.

6.2.1.10. The vendor shall establish appropriate administrative and technical safeguards to ensure the confidentiality, integrity, and availability of Government data under their control.

6.2.1.11. The vendor shall notify the Information Owner and Contracting Officer POCs in writing with any inabilities to comply with DoD security requirements. Vendor will provide anticipated costs and timelines required to address vulnerabilities in question.

6.2.1.12. The vendor shall contact the IA/RMF Office Representative, no later than 5 days after delivery order selection or contract award, to start the process. Failure to do so would be considered a vendor caused delay.

6.2.2. RMF Timeframes.

The following table provides an overview of the entire Process to obtain approval under Army Cybersecurity requirements. Vendor actions must start as cited in the number of days after date of order column noted below and be completed in the number of days listed below in the Duration column.

GOVERNMENT

GOVERNMENT

6.2.3. Assessment and Authorization (A&A).

6.2.3.1 The vendor shall submit all RMF required documentation, as specified by Government Reps for review and approval, no later than four (4) months after request by the Government.

6.2.3.2 The vendor shall obtain approval from the Government, any vendor developed policies, plans, and procedures prior to implementation.

6.2.3.3 The vendor shall provide any additional documentation required by the Government for completion of the A&A process within thirty (30) business days of request by the Government.

6.2.3.4 The vendor shall provide technical scans within one (1) month of the A&A kickoff meeting.

6.2.3.5 The vendor shall provide updated technical scans on a monthly basis, on the 10th day of each month until an ATO is granted.

6.2.3.6 The vendor shall ensure that the vendor device or system is capable of supporting the use of DISA approved intrusion detection and prevention, antivirus, and antimalware applications. The vendor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support either the full security suite or the individual components (e.g. DLP, IPS, Antivirus, etc.) without performance degradation of the medical system/device. In cases where the operation of security applications are not technically achievable, the vendor shall provide detailed justification and a Plan of Actions and Milestones (POA&M) describing steps towards compliance with this requirement.

6.2.3.7 The vendor shall ensure that the vendor device or system is configured in such a way that allows the updating of malware definition signatures on a scheduled basis. Scanning shall encompass the entire system (file system, operating system, real-time processes) by default. In cases where scanning of the entire system may negatively affect its operation, the vendor shall provide a detailed list of exclusions with justifications.

6.2.4 Privileged User Training and Certification Requirements.

If a vendor requires a B2B, access, etc. to government networks to maintain, analyze, etc, their products, they must adhere to the following requirements:

6.2.4.1 Information Assurance Contractor Training and Certification. Contractors requiring a privileged-level account for administrative/maintenance support of systems/applications on the Army network will meet Army requirements for a privileged-level account before being granted a network account. Requirements include:

6.2.4.2 Cyber (Information assurance (IA)/information technology (IT)) certification. Per DoD 8570.01-M , DFARS 252.239.7001 and AR 25-2, the contractor employees supporting Cyber (IA/IT) functions shall be appropriately certified upon contract award. Contractors will be defined at Information Assurance Technical level I (IAT – II) and be required to meet minimum Professional Baseline certifications at the time of contract award. Contractors will be given six (6) months to meet Computer Environment (CE) and Cyber Security Fundamental training requirements. Not meeting the requirements in accordance with DoD 8570.01-M will result in the contractor account and access being ‘Disabled’ or ‘Deleted’ until such time as the conditions of this contract are met.

6.2.4.3 Background Investigation. NACI or above is required. Vendors should email: usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain guidance on the process.

6.2.4.4. Professional Baseline Certification. The minimum Professional Baseline certification for IAT-II is CompTIA Security+. Higher certifications (GSCL, CISM, CISSP, etc.) will satisfy this requirement.

6.2.4.5. Computer Environment (CE) Certification. Computer Environment (CE) certifications are determined by the role of the contractor and must be met within six months of delivery order issuance. Contractors working on servers are encouraged to have a Microsoft 2008 Server or 2012 Server certification. Contractors working on End-User devices are encouraged to have a professional certification that coincides with the technology inherent in the system (i.e. MCSE, CCNA, RHCSE, etc.). The CompTIA A+ certification will also satisfy the CE certification requirement.

6.2.4. 6. IA Training Requirements. Contractors will meet minimum training requirements within six months of contract award. Contractors will be required to complete Cyber Security Fundamentals located at URL: https://ia.signal.army.mil/IAF/

6.2.4.7. Training. DoD Cyber Awareness Challenge Training must be completed by all contractor employees and associated sub-contractor employees prior to issuance of network access and annually thereafter. DoD Cyber Awareness Challenge Training is available at the following website: https://ia.signal.army.mil/DoDIAA/

6.2.4.8. Two-Factor Authentication. Contractors will authenticate using two-factor authentication. The preferred method for authenticating is the Common Access Card (CAC).

6.2.4.9. Army Training Certification Tracking System (ATCTS). Contractors with a need for elevated privileged-level access will be defined to ATCTS. https://atc.us.army.mil/iastar/regulations.php

6.2.4.10. Network Account Request Package (Authorized & Privileged). The contractor will submit a request package through either the ITC One-Stop Shop for contractors requiring on-site access or through the Information Assurance/Cyber Security Branch for contractors requiring remote access to an Army network. Remote access must be through a Defense Health Agency (DHA) Business-To-Business (B2B) solution. Vendors should email: usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain remote access through DHA, for Army requirements.

6.2.4.11. Acceptable Use Policy (AUP). All vendors/contractors will sign/acknowledge the Army Standard Acceptable Use Policy (AUP) prior to being granted an Army network account. The Army Standard AUP is available at the following website: https://atc.us.army.mil/iastar/docs/aup.pdf

6.2.5. Warranty and Post-Warranty Service Maintenance Agreement Cybersecurity Requirements.

6.2.5.1 Continuous Risk Management

a. The vendor shall maintain a duplicate of the fielded device, system, or group of configurations falling under one authorization; for testing in a vendor supplied lab environment at vendor location for as long as the system is operated by the Government.

b. The vendor shall maintain the duplicate system or device in operational condition with the latest security patches installed.

6.2.5.2. The vendor shall update all ATO required supporting documentation in the event of a system policy, procedural, logical or technical changes to the system.

6.2.5.3. The vendor shall maintain the authorized security configuration and notify the government within forty eight (48) hours of any major changes for review. A major upgrade such as major software or hardware revision must be reassessed for ATO. Vendor shall support reauthorizations due to major upgrades.

6.2.5.4. The vendor shall ensure the vendor’s device or system is in compliance with the Department of Defense (DoD) Information Assurance Vulnerability Management (IAVM) program upon each deployment.

6.2.5.5. The vendor shall ensure any new deployment (including rebuilds) deploy with a fully patched, accredited version maintained in a lab environment.

6.2.5.6. The vendor shall make the duplicate device or system available for periodic security reviews, within forty five (45) business days of notification by Government. The vendor shall perform monthly vulnerability scans using the most recent and updated version of approved DoD scan tools.

6.2.5.7. Vendor shall maintain system and update to comply with updated STIGS as made available by the Government within three (3) months of notification by the Government.

6.2.5.8. The vendor shall provide vulnerability scan and SCAP scan results to Government on a monthly basis. Vendor shall provide raw scan results and administrative reports no later than the 10th calendar day of each month.

6.2.5.9. The vendor shall close all discovered vulnerabilities within three (3) months of discovery.

6.2.5.10. The vendor shall submit to Government detailed explanations for the inability to close discovered vulnerabilities.

6.2.5.11. The vendor shall submit to Government for approval of any mitigation that addresses any open vulnerabilities.

6.2.5.12. The vendor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to Government for approval.

6.2.5.13. The vendor shall use the Government approved method for remote access administration (DISA B2B) of system or device.

6.2.6. Appendix A: Cybersecurity Regulations and Guidance.

6.2.6.1 Cybersecurity Regulations and Guidance.

The vendor shall use and comply with the most recent published versions as of the date of contractual agreement of the following references as well as all regulations or guidance referenced within those publications:

a. United States Law

i. The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

ii. The Federal Information Security Management Act (FISMA)

iii. The E-Government Act of 2002

b. Office of Management and Budget (OMB)

i. The following publications are located at https://www.whitehouse.gov/omb/agency/default

ii. Circular A-130

iii. Guidance M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12-Policy for a Common Identification Standard for Federal Employees and Vendors

c. National Institute of Standards and Technology (NIST)

i. The following publications are located at http://www.nist.gov/publication-portal.cfm

ii. NIST Special Publication (SP) 800-37 – Guide for Applying the Risk Management Framework (RMF) to Federal Information Systems

iii. NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations

d. Federal Information Processing Standards (FIPS)

i. The following publications are located at http://www.nist.gov/itl/fipscurrent.cfm

ii. FIPS Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules

iii. FIPS PUB 199 – Standards for Security Categorization of Federal Information and Information Systems

iv. FIPS PUB 201-2, Personal Identity Verification of Federal Employees and Vendors

e. Department of Defense (DoD)

i. The following publications are located at http://www.dtic.mil/whs/directives/

ii. DoD Instruction 5200.2, DoD Personnel Security Program (PSP)

iii. DoD Instruction 8500.1, Cybersecurity

iv. DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling

v. DoD Instruction 8510.01, Risk Management Framework Process (RMF)

vi. DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM)

vii. DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs

viii. DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in DoD Health Care Programs

ix. DoD Directive 5400.11, DoD Privacy Program

x. DoD Manual 5400.11-R, Department of Defense Privacy Program

6.3. SECURITY CLEARANCES.

6.3.1. Personnel to be assigned to an ADP/IT position must undergo a successful security screening before being provided access to DoD information technology resources. Prior to an employee being granted interim access to DoD sensitive information, Martin Army Community Hospital must receive notification that the Office of Personnel Management (OPM) has scheduled the employee's investigation. This requirement must be met by contractors, subcontractors and other who have access to information systems containing information protected by the Privacy Act of 1974 and protected health information under HIPAA. Background checks are required for all ADP/IT personnel who receive, store, display, or transit sensitive information. Employees must have at a minimum an ADP Sensitivity Designation of Level II to access the DoD Network.

6.3.2. All contractors that use the DoD gateways to access government systems must submit a DISA Form 41 or equivalent in accordance with Contracting Officer guidance. In addition, Form 41s are required for each system administrator responsible for each host-to-host interface. Contractors shall complete and submit to TMA one Form 41 for their organization, attached to which shall be a listing of those individuals for whom background checks have been completed, submitted to the Office of Personnel Management (OPM), and acknowledgements have been received from OPM that the applications are complete and are pending action by OPM. The request must clearly delineate the ports and protocols used for each IP address. The contractor shall complete the form and submit to the government for final processing.

6.3.3. All costs for the background investigations are the responsibility of the contractor.

6.4. BUSINESS to BUSINESS (B2B) REQUIREMENTS for CONTRACTOR.

6.4.1. General Security Requirements.

6.4.1.1. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow.

6.4.2. Personnel Security.

6.4.2.1. The contractor shall comply with DoD Directive 8500.1, “Information Assurance (IA),” DoD Instruction 8500.2, “Information Assurance (IA) Implementation,” DoD Directive 5400.11, “DoD Privacy Program,” DoD 6025.18-R, “DoD Health Information Privacy Regulation,” DoD 5200.2-R, “Personnel Security Program Requirements.” AR25-1, “Army Knowledge Management and Information Technology”, AR 25-2 “Information Assurance.” And local regulations as deemed appropriate by the activity Information Assurance personnel.

6.4.2.2. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements: a. Follow the Army guidelines for submittal of Automated Data Processor/Information Technology (ADP/IT) background investigations and ensure all contractor personnel are designated as ADP/IT-I, ADP/IT-II, or ADP/IT-III where their duties meet the criteria of the position sensitivity designations outlined in AR25-2.

b. Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Information Systems within the logical boundaries of the facility LAN.

c. Immediately report to the Martin Army Community Hospital Personnel Security Manager Travis Butler at 762-408-0308 and deny access to any automated information system (AIS), network, or information if a contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate government representative for any reason.

d. Ensure that all contractor personnel receive information assurance (IA) training before being granted access to DoD AISs/networks and information.

6.4.3. Electronic Security.

6.4.3.1. Contractor Information Systems (IS)/networks that are involved in the operation of systems in support of BMACH shall operate in accordance with controlling laws, regulations, DoD, Army, and local policy.

6.4.3.2. Certification & Accreditation (C&A) requirements apply to all DoD and contractor’s IS/networks that receive process, display, and store or transmit DoD information. The contractor shall comply with the C&A process for safeguarding IS. Certification is the determination of the appropriate level of protection required for IS/networks. Certification also includes a comprehensive evaluation of the technical and non-technical security features and countermeasures required for each system/network.

6.4.3.3. Accreditation is the formal approval by the government to operate the contractor’s IS/networks in a particular security mode using a prescribed set of safeguards at an acceptable level of risk. In addition, accreditation allows IS/networks to operate within the given operational environment with stated interconnections; and with appropriate level of protection for the specified period.

6.4.3.4. The contractor shall comply with C&A requirements, as specified by the government that meet appropriate DoD Information Assurance requirements. The C&A requirements shall be met before the contractor’s system is authorized to access DoD data or interconnect with any DoD IS/network that receives, processes, stores, displays or transmits DoD data. The contractor shall ensure the proper contractor support staff is available to participate in all phases of the C&A process. They include, but are not limited to:

a. Attending and supporting C&A meetings with the government.

b. Supporting/conducting the vulnerability mitigation process.

c. Supporting the C&A Team during system security testing.

6.4.3.5. Contractors must confirm that there is/networks are locked down prior to initiating testing.

a. Conformation of system lock down shall be agreed upon during the definition of the C&A boundary and be signed and documented as part of the System Security Authorization Agreement (SSAA).

b. Locking down the system means that there shall be no changes made to the configuration of the system (within the C&A boundary) during the C&A process.

6.4.3.6. Any re-configuration or change in the system during the C&A testing process will require a re-baselining of the system and documentation of system changes.

6.4.3.7. A mitigation strategies include security updates, service packs, and changes to operating procedures as physical and cyber vulnerabilities are detected. Operating system, routers, servers, development platforms and the application being delivered to the government shall be in compliance with all known applicable Department of Defense Computer Emergency Response Team (DoD-CERT) Alert, Bulletin, and Technical Advisory Notices published during the past 36 months.

6.4.3.8. Disposing of Electronic Media. Vendors shall follow the DoD standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with DoD Memorandum "Disposition of Unclassified Computer Hard Drives," June 4, 2001. Vendors are required to also follow DoD guidance on sanitization of other internal and external media components in DODI 8500.2 "Information Assurance (IA) Implementation," 6 Feb 2003 (see PECS-1 in enclosure 4 Attachment 5) and DoD 5220.22-M "Industrial Security Program Operating Manual (NISPOM)," (Chapter 8).

6.4.3.9. Information Assurance Vulnerability Management (IAVM) The contractor shall implement an information assurance vulnerability management program for all AIS and corresponding subnets that are connected to or intermittently connect to Army networks. The program shall meet the scope and intent of AR25-2 and Martin Army Community Hospital IA policies to provide protection against known threats and vulnerabilities. Compliance with Army IAVM alerts and bulleting is required for these systems, and shall be completed within the specified timeframe.

6.4.4. Information Systems (IS)/Networks Physical Security.

6.4.4.1. The contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the contractor will support a Physical Security Audit performed by the Government of the contractor's internal information management infrastructure. The MHS Physical Security Audit Matrix is available at: http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version.xls. The contractor shall correct any deficiencies identified by the Government of the contractor's physical security posture.

6.4.5. Special Requirements for Protected Health Information. Whenever a contract is awarded that requires the vendor to collect, use, copy, access or store Protected Health Information (PHI) in commercial office space, the contractors must:

6.4.5.1. Notify the Martin Army Community Hospital HIPAA Security Manager, Ms. Beverly Simmons at 762-408-0032.

6.4.5.2. Follow all DUA and DoD requirements for secure disposal, destruction, and/or sanitization of all equipment that contained PHI.

6.4.6. Information Assurance Contractor Training and Certification. Contractors requiring a privileged-level account for administrative/maintenance support of systems/applications on the Army/BMACH network will meet Army requirements for a privileged-level account before being granted a BMACH network account.

6.4.6.1. Cyber (Information assurance (IA)/information technology (IT)) certification. Per DoD 8570.01-M , DFARS 252.239.7001 and AR 25-2, the contractor employees supporting Cyber (IA/IT) functions shall be appropriately certified upon contract award. Contractors will be defined at Information Assurance Technical level I (IAT – II) and be required to meet minimum Professional Baseline certifications at the time of contract award. Contractors will be given six (6) months to meet Computer Environment (CE) and Cyber Security Fundamental training requirements. Not meeting the requirements in accordance with DoD 8570.01-M will result in the contractor account and access being ‘Disabled’ or ‘Deleted’ until such time as the conditions of this contract are met.

6.4.6.2. Background Investigation. NACI or above is required. See paragraph 2a.

6.5. Information Assurance

6.5.1. Professional Baseline Certification. The minimum Professional Baseline certification for IAT-II is CompTIA Security+. Higher certifications (GSCL, CISM, CISSP, etc. will satisfy this requirement.

6.5.2. Computer Environment (CE) Certification. Computer Environment (CE) certifications are determined by the role of the contractor and must be met within six months of contract award. Contractors working on servers are encouraged to have a Microsoft 2008 Server or 2012 Server certification. Contractors working on End-User devices are encouraged to have a Microsoft Windows 7 or Microsoft Windows 10 certification. The CompTIA A+ certification will also satisfy the CE certification requirement.

6.5.3. IA Training Requirements. Contractors will meet minimum training requirements within six months of contract award. Contractors will be required to complete Cyber Security Fundamentals located at URL: https://ia.signal.army.mil/IAF/

6.5.4. Two-Factor Authentication. Contractors will authenticate using two-factor authentication. The preferred method for authenticating is the Common Access Card (CAC).

6.5.5. Army Training Certification Tracking System (ATCTS). Contractors with a need for elevated privileged-level access will be defined to ATCTS. https://atc.us.army.mil/iastar/regulations.php

6.5.6. BMACH Network Account Request Package (Authorized & Privileged). The contractor will submit a request package through either the ITC One-Stop Shop for contractors requiring on-site access or through the Information Assurance/Cyber Security Branch for contractors requiring remote access to the BMACH network. Remote access must be through a Defense Health Agency (DHA) Business-To-Business (B2B) solution. The package includes:

DD Form 2875 – System Authorization Access Request (SAAR). All contractors requiring a BMACH network account will complete the DD Form 2875 to include validation of a Security Background Investigation (9.9.1.1). Information Assurance Branch will be the sponsor for all contractors requiring elevated privileged-level access. The department chief will sign the DD2875 as the contractor supervisor. Note: contractors requiring a ‘Privileged’ account will check ‘Box 14.’ on the form. The DD2875 SAAR Form is available at the following website: https://atc.us.army.mil/iastar/docs/DD_Form_2875_System_Access_Agreement_Request.pdf

6.5.7. IA Training. DoD Cyber Awareness Challenge Training must be completed by all contractor employees and associated sub-contractor employees prior to issuance of network access and annually thereafter. DoD Cyber Awareness Challenge Training is available at the following website: https://ia.signal.army.mil/DoDIAA/

6.5.8. Acceptable Use Policy (AUP). All vendors/contractors will sign/acknowledge the Army Standard Acceptable Use Policy (AUP) prior to being granted a BMACH network account. The Army Standard AUP is available at the following website: https://atc.us.army.mil/iastar/docs/aup.pdf

6.6. Anti-Terrorism and OPSEC

6.6.1. AT Level I training. This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area. All contractor employees, to include subcontractor employees, requiring access Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable and annually thereafter. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 05 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website: http://jko.jten.mil

6.6.2. Access and general protection/security policy and procedures. This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area. Contractor and all associated sub-contractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DOD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

Incorporated in Full Text

52.212-3—OFFEROR REPRESENTATIONS AND CERTIFICATIONS—COMMERCIAL ITEMS (NOV 2017) ALTERNATE I (OCT 2014).

52.212-4 -- CONTRACT TERMS AND CONDITIONS -- COMMERCIAL ITEMS (OCT 2018)

Addendum to 52.212-4: (w) the non-FAR Part 12 discretionary FAR, DFARS, AFARS, and Local clauses herein are incorporated into this contract either by reference or in full text. If incorporated by reference, see clause 52.252-2 for locations where full text can be found.

52.203-12—LIMITATION ON PAYMENTS TO INFLUENCE CERTAIN FEDERAL TRANSACTIONS (OCT 2010) 52.204-10—REPORTING EXECUTIVE COMPENSATION AND…