W91YTZ-19-R-0036_Blood_Bank_Analyzer-Amended.docx

W91YTZ-19-R-0036

This is a solicitation for commercial items prepared in accordance with the format in Subpart 12.6, and 13.5 as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and a written solicitation will not be issued and is expected to result in the award of a firm-fixed price supply type contract. The resulting award will be made on SF 1449, for commercial supplies and services. Solicitation number W91YTZ-19-R-0036 issued as request for quote (RFQ). The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2005-96 and DPN 20171208 current as of 17 December 2018.

The NAICS code is 325413 and size standard is 1250. The Government anticipates awarding a single award issued as Firm Fixed Price, UNRESTRICTED. The requirement of this solicitation is for various reagents.

Items are to be shipped FOB: Destination Martin Army Community Hospital, 7950 Martin Loop, Fort Benning, Georgia 31905.

Item No. 0001: Blood Bank Analyzer

Informational CLIN only: One (1) Automated Blood Bank Analyzer, reagents, supplies and maintenance. Period of Performance: 1 April 2019 through 30 September 2019. Billing shall occur monthly. Reference Attachment “Statement of Objectives”.

0001AA

Blood Bank Analyzer Base Period Performance: 1 April 2019-30 September 2019 Reference Salient Characteristics included in Addendum 52.212-2 (LPTA)

NET AMOUNT

Reagents Delivery 1 April 2019-30 September 2019 Provide Unit Price and Total Amount

Reference Table 1

NET AMOUNT

Table 1-Period of Performance: 1 April 2019-30 September 2019

ITEM NO

SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

AMOUNT

Freight FOB: Destination Delivery 1 April 2019-30 September 2019

Total Base Period $___________________ Option 1 Item No. 1001: Blood Bank Analyzer

Informational CLIN only: One (1) Automated Blood Bank Analyzer, reagents, supplies and maintenance. Period of Performance: 1 October 2019 through 30 September 2020. Billing shall occur monthly. Reference Attachment “Statement of Objectives”.

1001AA

Blood Bank Analyzer Base Period Performance: 1 October 2019-30 September 2020 Reference Salient Characteristics included in Addendum 52.212-2 (LPTA)

NET AMOUNT

Reagents Delivery 1 October 2019-30 September 2020 Provide Unit Price and Total Amount

Reference Table 2

NET AMOUNT

Table 2-Period of Performance: 1 October 2019-30 September 2020

ITEM NO

SUPPLIES/SERVICES

QUANTITY

UNIT

UNIT PRICE

Freight FOB: Destination Delivery: 1 October 2019-30 September 2020

NET AMOUNT

Total Option 1: $__________

Total Base Period plus One (1) Option: $_________________________________

The following FAR Clauses and Provisions in their latest editions apply to this solicitation.

52.212-1, Instructions to Offers—Commercial Items (DEVIATION 2018-O0018) (OCT 2018);

Addendum 52.212-1: (b) Submission of offers

All offerors must be registered in the System for Award Management (SAM) prior to award, and lack of registration shall make an offer ineligible for award. Offerors may obtain information on registration Internet at https://www.sam.gov. Or the SAM Help desk at https://www.fsd.gov.

THE SOLICITATION MUST BE QUOTED ALL OR NONE.

To be delivered FOB Destination: Martin Army Community Hospital, Fort Benning, Georgia 30915.

The estimated date of award is March 1, 2019. Proposals will only be accepted via email. All questions shall be forwarded to the email below by February 12, 2019 12:00 PM EST. Responses shall be posted on the Federal Business Opportunities Website. All responsible sources should submit proposals to Kiah M. Washington via e-mail: Kiah.M.Washington.civ@mail.mil by February 22, 2019 12:00 P.M. EST. (n) the non-Far Part 12 discretionary FAR, DFARS, AFARS and MEDCOM provisions included herein are incorporated into this solicitation either by reference or in full text. If incorporated by reference, see provision 52.252-1 for locations where full text can be obtained.

Instructions for the Preparation of Proposals

Volume I-Technical Sub factor 1 Installation Plan Sub factor 2 Cyber Security & Risk Management Requirement Sub factor 3 Anti-Terrorism and Operations Security Contract Requirements.

Sub factor 4 Equipment-Reference Salient Characteristics

Volume II-Pricing

VOLUME I – TECHNICAL

The technical proposal, Volume I, shall be addressed in sufficient written detail for the Government to determine if the offeror understands this aspect of the Government’s requirement. The offeror shall address each factor separately, and shall provide sufficient narrative and supporting data for each factor. Lack of any of these significant capabilities shall be considered sufficient cause for the proposal to be determined unacceptable. The Technical Proposal shall provide sufficient detail for the Government to determine whether the proposal acceptably meets the requirements of the solicitation. Statements that the offeror understands, can or will comply with all specifications, or statements paraphrasing the specifications of parts thereof, or phrases such as “standard procedures will be used” or “well-known techniques will be used” will be considered unacceptable. The technical proposal shall provide a narrative and supporting data with the following sections organized separately so that the evaluation factors listed below are included.

The following information must be submitted, in writing, as part of the technical proposal.

1. Installation Plan- At a minimum the following shall be addressed at no additional cost to the Government.

Equipment installation Government equipment required Government location preparation Delivery and set-up accomplished by the awardee

2. Cybersecurity and Risk Management Framework (RMF) Requirements

3. Technical Specifications for analyzer must meet salient characteristics

VOLUME I – PRICING

Assessment of price reasonableness based on comparison to market prices.

a. The offeror shall submit proposed pricing for all subcontract Line Item Numbers (subCLINs) identified in the Request for Proposal, unless otherwise noted. The offeror shall limit their unit and extended prices to two (2) decimal places (example: $158.03).

b. The offeror shall submit pricing totals for the base period and option years individually, as well as a grand total.

c. Pricing document shall include individual pricing for each test in table.

FAR CLAUSES

52.204-7--SYSEM FOR AWARD MANAGEMENT (OCT 2018)

52.204-16--COMMERCIAL AND GOVERNMENT ENTITY CODE (JUL 2016)

52.223-1--BIO BASED PRODUCT CERTIFICATION (MAY 2012)

52.225-25—PROHIBITION ON ENGAGING IN SANCTIONED ACTIVITIES RELATING TO IRAN-CERTIFICATION (OCT 2015)

Incorporated by Full Text

52.209-2—PROHIBITION ON CONTRACTING WITH INVERTED DOMESTIC CORPORATIONS-REPRESENTATIONS (NOV 2015)

52.209-11—REPRESENTATION BY CORPORATIONS REGARDING DELINQUENT TAX LIABILITY OR A FELONY CONVICTION UNDER ANY FEDERAL LAW (FEB 2016)

52.222-25—AFFIRMATIVE ACTION COMPLIANCE (APR 1984)

52.252-1 (FEB 1998), Solicitation Provisions Incorporated by Reference: The full text of a solicitation provision may be accessed electronically at this/these address (es): www.farsite.hill.af.mil or www.arnet.gov/far.

52.252-5, Authorized Deviations in Provisions (APR 1984): (b) the use in this solicitation or contract of any DoD FAR Supplement (48 CFR Chapter 2) provision with an authorized deviation is indicated by the addition of “(DEVIATION)" after the name of the regulation.

252.203-7005—REPRESENTATION RELATING TO COMPENSATION OF FORMER DOD OFFICIALS (NOV 2011)

252.204-7008—COMPLIANCE WITH SAFEGUARDING COVERED DEFENSE COVERED INFORMATION CONTROLS (OCT 2016)

252.204-7011—ALTERNATE LINE-ITEM STRUCTURE (SEP 2011)

252.225-7020—TRADE AGREEMENTS CERTIFICATE (NOV 2014)

252.225-7035—BUY AMERICA-FREE TRADE AGREEMENTS-BALANCE OF PAYMENTS PROGRAM CERTIFICATE BASIC (NOV 2014)

(END OF ADDENDUM 52.212-1)

52.212-2—EVALUATION—COMMERCIAL ITEMS (OCT 2014)

Addendum 52.212-2 (LPTA):

Paragraph (a) replaced with the following:

Award will be made using the lowest price technically acceptable (LPTA) source selection process. Award will be made to the responsible offeror on the basis of the lowest evaluated price of proposals meeting or exceeding the acceptability standards for non-cost factors. Award may be made without discussions with offerors (except communications conducted for the purpose of minor clarification). Therefore, each initial offer should contain the offeror's best terms from a technical and price standpoint. However, the Government reserves the right to conduct discussions if it is later determined by the contracting officer to be necessary.

The Government will award a Firm Fixed Price contract resulting from this solicitation to the responsible Offer whose offer conforming to the solicitation will be the most advantageous for the Government, price and other factors considered. In order to be considered for award, an Offeror must receive an Acceptable rating in all factors. The following factors shall be used to evaluate:

Technical and Price

Award will be made based on lowest price, technically acceptable proposal.

(a) Options. The Government will evaluate offers for award purposes by adding the total price for all options to the total price for the basic requirement. The Government may determine that an offer is unacceptable if the option prices are significantly unbalanced. Evaluation of options shall not obligate the Government to exercise the option(s).

(b) A written notice of award or acceptance of an offer, mailed or otherwise furnished to the successful offeror within the time for acceptance specified in the offer, shall result in a binding contractor without further action by either party. Before the offer’s specified expiration time, the Government may accept an offer (or part of an offer), whether or not there are negotiations after its receipt, unless a written notice of withdrawal is received before award.

FACTOR: 1 TECHNICAL

Sub factor 1 Installation Plan Provide in writing, documentation of your company plans to meet the installation requirement.

Sub factor 2 Cyber Security & Risk Management Framework (RMF) Requirement- Provide in writing, documentation of your company plans to meet the cyber security and RMF requirement.

Sub factor 3 Anti-Terrorism and Operations Security Contract (ATOPSEC) Requirements. Provide in writing, documentation of your company plans to meet the ATOPSEC requirement.

Sub factor 4 – Equipment-Provide in writing, documentation of how your company equipment meets the salient characteristics

Salient Characteristics

-Provide analyzers that are FDA approved, 100-240V, and use FDA approved software for FDA approved testing reagents.

-High capacity analyzer that can load 150-200 samples at a time.

-Analyzer must have random access, continuous operation, remote access and STAT test capability.

-Analyzer must have barcode Reader and disk drive with read and write and USB port for loading and downloading data and on board operator's/ troubleshooting manuals.

-No direct plumb or modification of facility for water source for operation or waste drain

-Analyzer must interface with the DoD Electronic Health Record system.

-Analyzer must interface with Laboratory Information System (LIS) CHCS (Composite Health Care System for 2-way communication with broadcast download and host.

-Analyzer Operating system must be Windows 7 or higher.

-Analyzer must provide capability for data and information storage and data management.

-Provide training at their facility for two personnel and on-site training as needed.

-Ensure proper packaging of reagents, supplies, and equipment and that they are shipped at proper refrigerated or frozen temperatures according to manufacturer specifications.

-Provide FDA approved reagents for use in clinical testing with expiration dates no less than 6 months of delivery date that function properly and pass lot to lot testing.

-Reagents must be ready to use and do not have to be prepared.

-Provide analyzer that has user defined testing capability.

-Must be able to meet DOD Risk Management Framework (RMF) IT cybersecurity certification requirements for analyzer.

-Provide analyzer that can support the following test menu: ABO/Rh typing, Weak D, Rh phenotyping, Antibody Screening, Antigen phenotyping, IgG DAT, IgG Crossmatch, Donor Confirmation, Antigen Screening, Platelet Antibody Screen, Antibody Identification, cord blood testing, QC Testing, ABO Titration Dilutions, Cell panels

Salient Characteristics End-------------------------------------------------------------------------------

52.212-3—OFFEROR REPRESENTATIONS AND CERTIFICATIONS—COMMERCIAL ITEMS (NOV 2017) ALTERNATE I (OCT 2014).

52.212-4 -- CONTRACT TERMS AND CONDITIONS -- COMMERCIAL ITEMS (JAN 2017)

Addendum to 52.212-4: (w) the non-FAR Part 12 discretionary FAR, DFARS, AFARS, and Local clauses herein are incorporated into this contract either by reference or in full text. If incorporated by reference, see clause 52.252-2 for locations where full text can be found.

52.203-12—LIMITATION ON PAYMENTS TO INFLUENCE CERTAIN FEDERAL TRANSACTIONS (OCT 2010)

52.225-13 -- RESTRICTIONS ON CERTAIN FOREIGN PURCHASES (JUN 2008)

52.232-33—PAYMENT BY ELECTROINC FUNDS TRANSFER—SYSTEM FOR AWARD MANAGEMENT (OCT 2018)

52.232-39 -- UNENFORCEABILITY OF UNAUTHORIZED OBLIGATIONS (JUN 2013)

52.232-40 -- PROVIDING ACCELERATED PAYMENTS TO SMALL BUSINESS SUBCONTRACTORS (DEC 2013)

52.233-3 -- PROTEST AFTER AWARD (AUG 1996)

52.233-4 -- APPLICABLE LAW FOR BREACH OF CONTRACT CLAIM (OCT 2004)

DFARS

252.225-7002—QUALIFYING COUNTRY SOURCES AS SUBCONTRACTORS (AUG 2016)

252.225.7021—TRADE AGREEMENTS (DEC 2017)

252.225-7048 -- EXPORT CONTROLLED ITEMS (JUN 2013)

252.232-7003 - ELECTRONIC SUBMISSION OF PAYMENT REQUESTS AND RECEIVING REPORTS (JUN 2012)

252.232-7006—WIDE AREA WORKFLOW PAYMENT INSTRUCTIONS (MAY 2013)

252.232-7010 -- LEVIES ON CONTRACT PAYMENTS (DEC 2006)

252.243-7001—PRICING OF CONTRACT MODIFICATIONS (DEC 1991)

Incorporated by Full Text

52.209-10—PROHIBITION ON CONTRACTING WITH INVERTED DOMESTIC CORPORATIONS (NOV 2015)

52.219-28 -- POST-AWARD SMALL BUSINESS PROGRAM REREPRESENTATION (JUL 2013)

52.222-36—EQUAL OPPORTUNITY FOR WORKERS WITH DISABILITIES (JUL 2014)

52.252-2, Clauses Incorporated by Reference (FEB 1998): the full text of a clause may be accessed electronically at this/these address (es): www.farsite.hill.af.mil.

52.252-6, Authorized Deviations in Clauses (APR 1984): (b) the use in this solicitation or contract of any DoD FAR Supplement (48 CFR Chapter 2) clause with an authorized deviation is indicated by the addition of "(DEVIATION)" after the name of the regulation.

252.204-7012—SAFEGUARDING CONVERED DEFENSE INFORMATION AND CYBER INCIDENT REPORTING (OCT 2016) 252.204-7015—DISCLOSURE OF INFORMATION TO LITIGATION SUPPORT CONTRACTORS (MAY 2016) 252.244-7000—SUBCPONTRACTS FOR COMMERICALINTEMS ANDCOMMRECIAL COMPONENTS (DOD) CONTRACTS (JUN 2013)

252.247-7023—TRANSPORTATION OF SUPPLIES BY SEA--BASIC (APR 2014)

52.212-5(Dev) -- CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT STATUTES OR EXECUTIVE ORDERS -- COMMERCIAL ITEMS (DEVIATION 2013-O0019) (JAN 2017)

Statement of Objectives

1. General Description.

1.1. Provide Martin Army Community Hospital (BMACH), USAMEDDAC Fort Benning, Georgia laboratory with new automated blood bank analyzers on a cost per test basis to include analyzer, reagents, supplies, service, preventive maintenance, training, and analyzer removal at the end of the contract. This equipment will be located in the blood bank section of the laboratory under the management of the Department of Pathology.

2. Physical Security.

2.1. Personnel or any representative of the contractor entering Fort Benning shall abide by all security regulations and shall be subject to security checks. Contractor and all associated sub-contractors employees shall comply with applicable installation/ facility access and local security policies and procedures (provided by Government representative as needed). The contractor shall also provide all information required to meet installation access requirements if required including background checks to be accomplished by installation Provost Marshall Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification

2.2. Ensure personnel report to the Equipment Management Suite located in room GC-122 on the ground floor to sign in and obtain a temporary vendor security badge PRIOR to commencing all on-site visits, preventive maintenance service, support or repairs to equipment in the laboratory.

2.3. Ensure that any requirement to remove, exchange, or add contractor’s equipment during the performance of this contract is coordinated through the Contract Officer’s Representative (COR) and must also include the site OIC/NCOIC, Chief EMB and the Property Book Officer.

3. Hours of Operation.

3.1. Normal Hours. Normal hours of operation are 8:00am to 3:00pm EST, Monday through Friday.

3.2. Recognized Holidays. Facility observes all federal holidays. Federal Holidays are as follows:

NOTE : When any of the above holidays fall on a Saturday it will be observed on the preceding Friday; holidays that fall on a Sunday will be observed on the following Monday. Any holidays declared by Presidential Executive Order shall be observed in the same manner as the holidays listed above.

4.4. Contractor will provide new or updated user manuals when changes are made.

4.5. Furnish all applicable MSDS for reagents, equipment and supplies utilized under this contract at no additional cost.

4.6. Deliver automated blood bank analyzer including the following Components per System:

Command Center Sample Management Center Reagent Management Center Barcode Sample Identification Unit Mixing Units Reading Unit Power ware/UPS On Board Computer with Printer Software Operator‘s Manual Maintenance Manual

5. Deliverables

5.1. Provide on-site technical support for installation of analyzers, required validation material, reagents and supplies to bring analyzer to fully operational status.

5.2. Ensure proper packaging of reagents, supplies, and equipment and that they are shipped at proper refrigerated or frozen temperatures according to manufacturer specifications.

5.3. Ensure all shipments arrive Monday through Friday between the hours of 8:00am and 3:00pm EST; excluding holidays and weekends according to paragraph 1.6.2 above.

5.4. Provide customer notification of updates on any reagents in writing within 5 business days and ensure continuity of services and availability of reagents during reagent revision when required.

5.5. Ensure reagents meet quality control guidelines set forth by manufacturer.

5.6. Notify the laboratory if there is a recall on any reagents or equipment within 24 hours.

5.7. Provide both reagents and quality control material for the analyzer test menu and traditional reagents testing per technical exhibit 2 Test Menu and Reagent list.

6. Training

6.1 Provide initial key operator training for lab personnel for each system

7. U. S. Army Cybersecurity Risk Management Framework (RMF) Requirements.

7.1. System Security Requirements.

7.1.1. The vendor shall submit to the Government at the time of award, the blue section of the Medical Device Cybersecurity Assessment (Questionnaire) provided by government and Nessus Scans. Nessus scanner is to be procured by the vendor, at their own cost, in order to comply with RMF requirements.

7.1.2. Vendor agrees to comply with security regulations and guidance listed in attached Appendix A and all Risk Management Framework (RMF) requirements.

7.1.3. Failure to meet the requirements may result may result in termination of the delivery order for cause, in accordance with FAR 52.212-4(m).

7.1.4. The vendor device or system shall pass pre-validation screening (Vulnerability scans utilizing Nessus and SCAP scans), administered within six (6) months of contract award that will be conducted by Government, and must meet criteria listed below:

(a). No unmitigated Very High or High Severity/ Category I (CAT I), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx (b). No unmitigated Moderate Severity/Category II (CAT II), vulnerabilities as described in the appropriate Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs) located on http://iase.disa.mil/stigs/Pages/index.aspx (c). No unmitigated Very High or High Severity/ Category I (CAT I) vulnerabilities from Nessus vulnerability scans.

(d) No unmitigated Moderate Severity/ Category II (CAT II) vulnerabilities from Nessus vulnerability scans.

7.1.5. The vendor shall mitigate all Very High, High, and Moderate Severity/CAT I and CAT II vulnerabilities discovered during the Assessment and Authorization (A&A) process according to a schedule published by Government.

7.1.6. The vendor shall appoint a vendor point of contact responsible for the cybersecurity of the vendor device or system throughout the lifecycle of the system. The vendor shall provide Subject Matter Experts (SMEs) to support all assessments of contracted products and materials, and meet required deliverable timelines.

7.1.7. The vendor shall obtain a recommendation of Authority to Operate (ATO) as determined by a Government appointed third party validator within twelve (12) months of contract award.

7.1.8. The vendor shall not make any delivery and shall not receive payment for the system until the ATO is granted. Receiving the ATO document from the U.S. Army shall constitute permission to perform on the order and to proceed with delivery. All delivery dates shall be reset in accordance to contract and in days after the date the ATO is communicated in writing to the vendor. Delivery may take place prior to ATO only if written permission is provided by the DLA Contracting Officer.

7.1.9. Pursuant to subsequent warranty period and Service Maintenance Agreements (SMA), the vendor shall, after the award of an ATO, ensure that the vendor’s device or system maintains its ATO for as long as the equipment is operated by Government.

7.1.10. The vendor shall establish appropriate administrative and technical safeguards to ensure the confidentiality, integrity, and availability of Government data under their control.

7.1.11. The vendor shall notify the Information Owner and Contracting Officer POCs in writing with any inabilities to comply with DoD security requirements. Vendor will provide anticipated costs and timelines required to address vulnerabilities in question.

7.1.12. The vendor shall contact the IA/RMF Office Representative, no later than 5 days after delivery order selection or contract award, to start the process. Failure to do so would be considered a vendor caused delay.

7.2. RMF Timeframes.

The following table provides an overview of the entire Process to obtain approval under Army Cybersecurity requirements. Vendor actions must start as cited in the number of days after date of order column noted below and be completed in the number of days listed below in the Duration column.

GOVERNMENT

GOVERNMENT

7.3. Assessment and Authorization (A&A).

7.3.1. The vendor shall submit all RMF required documentation, as specified by Government Reps for review and approval, no later than four (4) months after request by the Government.

7.3.2. The vendor shall obtain approval from the Government, any vendor developed policies, plans, and procedures prior to implementation.

7.3.3. The vendor shall provide any additional documentation required by the Government for completion of the A&A process within thirty (30) business days of request by the Government.

7.3.4. The vendor shall provide technical scans within one (1) month of the A&A kickoff meeting.

7.3.5. The vendor shall provide updated technical scans on a monthly basis, on the 10th day of each month until an ATO is granted.

7.3.6. The vendor shall ensure that the vendor device or system is capable of supporting the use of DISA approved intrusion detection and prevention, antivirus, and antimalware applications. The vendor shall provide technical specifications that clearly demonstrate whether the proposed solution can integrate and support either the full security suite or the individual components (e.g. DLP, IPS, Antivirus, etc.) without performance degradation of the medical system/device. In cases where the operation of security applications are not technically achievable the vendor shall provide detailed justification and a Plan of Actions and Milestones (POA&M) describing steps towards compliance with this requirement.

7.3.7. The vendor shall ensure that the vendor device or system is configured in such a way that allows the updating of malware definition signatures on a scheduled basis. Scanning shall encompass the entire system (file system, operating system, real-time processes) by default. In cases where scanning of the entire system may negatively affect its operation, the vendor shall provide a detailed list of exclusions with justifications.

7.4. Privileged User Training and Certification Requirements. If a vendor requires a B2B, access, etc. to government networks to maintain, analyze, etc., their products, they must adhere to the following requirements:

7.4.1. Information Assurance Contractor Training and Certification. Contractors requiring a privileged-level account for administrative/maintenance support of systems/applications on the Army network will meet Army requirements for a privileged-level account before being granted a network account. Requirements include:

7.4.2. Cyber (Information assurance (IA)/information technology (IT)) certification. Per DoD 8570.01-M , DFARS 252.239.7001 and AR 25-2, the contractor employees supporting Cyber (IA/IT) functions shall be appropriately certified upon contract award. Contractors will be defined at Information Assurance Technical level I (IAT – II) and be required to meet minimum Professional Baseline certifications at the time of contract award. Contractors will be given six (6) months to meet Computer Environment (CE) and Cyber Security Fundamental training requirements. Not meeting the requirements in accordance with DoD 8570.01-M will result in the contractor account and access being ‘Disabled’ or ‘Deleted’ until such time as the conditions of this contract are met.

7.4.3. Background Investigation. NACI or above is required. Vendors should email: usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain guidance on the process.

7.4.4. Professional Baseline Certification. The minimum Professional Baseline certification for IAT-II is CompTIA Security+. Higher certifications (GSCL, CISM, CISSP, etc.) will satisfy this requirement.

7.4.5. Computer Environment (CE) Certification. Computer Environment (CE) certifications are determined by the role of the contractor and must be met within six months of delivery order issuance. Contractors working on servers are encouraged to have a Microsoft 2008 Server or 2012 Server certification. Contractors working on End-User devices are encouraged to have a professional certification that coincides with the technology inherent in the system (i.e. MCSE, CCNA, RHCSE, Microsoft Windows 7 and Windows 10 etc.). The CompTIA A+ certification will also satisfy the CE certification requirement.

7.4.6. IA Training. DoD Cyber Awareness Challenge Training must be completed by all contractor employees and associated sub-contractor employees prior to issuance of network access and annually thereafter. DoD Cyber Awareness Challenge Training is available at the following website: https://ia.signal.army.mil/DoDIAA/ Contractors will meet minimum training requirements within six months of contract award.

7.4.7. Two-Factor Authentication. Contractors will authenticate using two-factor authentication. The preferred method for authenticating is the Common Access Card (CAC).

7.4.8. Army Training Certification Tracking System (ATCTS). Contractors with a need for elevated privileged-level access will be defined to ATCTS. https://atc.us.army.mil/iastar/regulations.php.

7.4.9. BMACH Network Account Request Package (Authorized & Privileged). The contractor will submit a request package through either the ITC One-Stop Shop for contractors requiring on-site access or through the Information Assurance/Cyber Security Branch for contractors requiring remote access to BMACH network. Remote access must be through a Defense Health Agency (DHA) Business-To-Business (B2B) solution. Vendors should email: usarmy.jbsa.medcom.list.medcom-information-assurance@mail.mil to obtain remote access through DHA, for Army requirements. The package includes DD Form 2875 – System Authorization Access Request (SAAR). All contractors requiring a BMACH network account will complete the DD Form 2875 to include validation of a Security Background Investigation. Information Assurance Branch will be the sponsor for all contractors requiring elevated privileged-level access. The department chief will sign the DD2875 as the contractor supervisor. Note: contractors requiring a ‘Privileged’ account will check ‘Box 14.’ on the form. The DD2875 SAAR Form is available at the following website: https://atc.us.army.mil/iastar/docs/DD_Form_2875_System_Access_Agreement_Request.pdf.

7.4.10. Acceptable Use Policy (AUP). All vendors/contractors will sign/acknowledge the Army Standard Acceptable Use Policy (AUP) prior to being granted an Army network account. The Army Standard AUP is available at the following website: https://atc.us.army.mil/iastar/docs/aup.pdf

7.5. Warranty and Post-Warranty Service Maintenance Agreement Cybersecurity Requirements.

7.5.1. Continuous Risk Management

(a). The vendor shall maintain a duplicate of the fielded device, system, or group of configurations falling under one authorization; for testing in a vendor supplied lab environment at vendor location for as long as the system is operated by the Government.

(b).The vendor shall maintain the duplicate system or device in operational condition with the latest security patches installed.

7.5.2. The vendor shall update all ATO required supporting documentation in the event of a system policy, procedural, logical or technical changes to the system.

7.5.3. The vendor shall maintain the authorized security configuration and notify the government within forty eight (48) hours of any major changes for review. A major upgrade such as major software or hardware revision must be reassessed for ATO. Vendor shall support reauthorizations due to major upgrades.

7.5.4. The vendor shall ensure the vendor’s device or system is in compliance with the Department of Defense (DoD) Information Assurance Vulnerability Management (IAVM) program upon each deployment.

7.5.5. The vendor shall ensure any new deployment (including rebuilds) deploy with a fully patched, accredited version maintained in a lab environment.

7.5.6. The vendor shall make the duplicate device or system available for periodic security reviews, within forty five (45) business days of notification by Government. The vendor shall perform monthly vulnerability scans using the most recent and updated version of approved DoD scan tools.

7.5.7. Vendor shall maintain system and update to comply with updated STIGS as made available by the Government within three (3) months of notification by the Government.

7.5.8. The vendor shall provide vulnerability scan and SCAP scan results to Government on a monthly basis. Vendor shall provide raw scan results and administrative reports no later than the 10th calendar day of each month.

7.5.9. The vendor shall close all discovered vulnerabilities within three (3) months of discovery.

7.5.10. The vendor shall submit to Government detailed explanations for the inability to close discovered vulnerabilities.

7.5.11. The vendor shall submit to Government for approval of any mitigation that addresses any open vulnerabilities.

7.5.12. The vendor shall review all required policies, plans, and procedures documentation on an annual basis and submit changes to Government for approval.

7.5.13. The vendor shall use the Government approved method for remote access administration (DISA B2B) of system or device.

7.6. Cybersecurity Regulations and Guidance. The vendor shall use and comply with the most recent published versions as of the date of contractual agreement of the following references as well as all regulations or guidance referenced within those publications:

7.6.1. United States Law

i. The Health Insurance Portability and Accountability Act of 1996 (HIPAA)

ii. The Federal Information Security Management Act (FISMA)

iii. The E-Government Act of 2002

7.6.2. Office of Management and Budget (OMB)

i. The following publications are located at https://www.whitehouse.gov/omb/agency/default

ii. Circular A-130

iii. Guidance M-05-24, Implementation of Homeland Security Presidential Directive (HSPD) 12-Policy for a Common Identification Standard for Federal Employees and Vendors

7.6.3. National Institute of Standards and Technology (NIST)

i. The following publications are located at http://www.nist.gov/publication-portal.cfm

ii. NIST Special Publication (SP) 800-37 – Guide for Applying the Risk Management Framework (RMF) to Federal Information Systems

iii. NIST SP 800-53 – Security and Privacy Controls for Federal Information Systems and Organizations

7.6.4. Federal Information Processing Standards (FIPS)

i. The following publications are located at http://www.nist.gov/itl/fipscurrent.cfm

ii. FIPS Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules

iii. FIPS PUB 199 – Standards for Security Categorization of Federal Information and Information Systems

iv. FIPS PUB 201-2, Personal Identity Verification of Federal Employees and Vendors

7.6.5. Department of Defense (DoD)

i. The following publications are located at http://www.dtic.mil/whs/directives/

ii. DoD Instruction 5200.2, DoD Personnel Security Program (PSP)

iii. DoD Instruction 8500.1, Cybersecurity

iv. DoD Instruction 8520.02, Public Key Infrastructure (PKI) and Public Key (PK) Enabling

v. DoD Instruction 8510.01, Risk Management Framework Process (RMF)

vi. DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM)

vii. DoD Instruction 8580.02, Security of Individually Identifiable Health Information in DoD Health Care Programs

viii. DoD Instruction 6025.18, Privacy of Individually Identifiable Health Information in DoD Health Care Programs

ix. DoD Directive 5400.11, DoD Privacy Program

x. DoD Manual 5400.11-R, Department of Defense Privacy Program

7.7. SECURITY CLEARANCES.

7.7.1. Personnel to be assigned to an ADP/IT position must undergo a successful security screening before being provided access to DoD information technology resources. Prior to an employee being granted interim access to DoD sensitive information, Martin Army Community Hospital must receive notification that the Office of Personnel Management (OPM) has scheduled the employee's investigation. This requirement must be met by contractors, subcontractors and other who have access to information systems containing information protected by the Privacy Act of 1974 and protected health information under HIPAA. Background checks are required for all ADP/IT personnel who receive, store, display, or transit sensitive information. Employees must have at a minimum an ADP Sensitivity Designation of Level II to access the DoD Network.

7.7.2. All contractors that use the DoD gateways to access government systems must submit a DISA Form 41 or equivalent in accordance with Contracting Officer guidance. In addition, Form 41s are required for each system administrator responsible for each host-to-host interface. Contractors shall complete and submit to TMA one Form 41 for their organization, attached to which shall be a listing of those individuals for whom background checks have been completed, submitted to the Office of Personnel Management (OPM), and acknowledgements have been received from OPM that the applications are complete and are pending action by OPM. The request must clearly delineate the ports and protocols used for each IP address. The contractor shall complete the form and submit to the government for final processing. All costs for the background investigations are the responsibility of the contractor.

8. BUSINESS to BUSINESS (B2B) REQUIREMENTS for CONTRACTOR.

8.1. General Security Requirements. The Contractor shall establish appropriate administrative, technical, and physical safeguards to protect any and all Government data, to ensure the confidentiality, integrity, and availability of government data. As a minimum, this shall include provisions for personnel security, electronic security and physical security as listed in the sections that follow.

8.2. Personnel Security.

8.2.1. The contractor shall comply with DoD Directive 8500.1, “Information Assurance (IA),” DoD Instruction 8500.2, “Information Assurance (IA) Implementation,” DoD Directive 5400.11, “DoD Privacy Program,” DoD 6025.18-R, “DoD Health Information Privacy Regulation,” DoD 5200.2-R, “Personnel Security Program Requirements.” AR25-1, “Army Knowledge Management and Information Technology”, AR 25-2 “Information Assurance.” And local regulations as deemed appropriate by the activity Information Assurance personnel.

8.2.2. Contractor responsibilities for ensuring personnel security include, but are not limited to, meeting the following requirements:

(a). Follow the Army guidelines for submittal of Automated Data Processor/Information Technology (ADP/IT) background investigations and ensure all contractor personnel are designated as ADP/IT-I, ADP/IT-II, or ADP/IT-III where their duties meet the criteria of the position sensitivity designations outlined in AR25-2.

(b). Initiate, maintain, and document personnel security investigations appropriate to the individual’s responsibilities and required access to Information Systems within the logical boundaries of the facility LAN.

(c). Immediately report to the Martin Army Community Hospital Personnel Security Manager Travis Butler at 762-408-0308 and deny access to any automated information system (AIS), network, or information if a contractor employee filling a sensitive position receives an unfavorable adjudication, if information that would result in an unfavorable adjudication becomes available, or if directed to do so by the appropriate government representative for any reason.

8.3. Electronic Security.

8.3.1. Disposing of Electronic Media. Vendors shall follow the DoD standards, procedures, and use approved products to dispose of unclassified hard drives and other electronic media, as appropriate, in accordance with DoD Memorandum "Disposition of Unclassified Computer Hard Drives," June 4, 2001. Vendors are required to also follow DoD guidance on sanitization of other internal and external media components in DODI 8500.2 "Information Assurance (IA) Implementation," 6 Feb 2003 (see PECS-1 in enclosure 4 Attachment 5) and DoD 5220.22-M "Industrial Security Program Operating Manual (NISPOM)," (Chapter 8).

8.3.2. Information Assurance Vulnerability Management (IAVM) The contractor shall implement an information assurance vulnerability management program for all AIS and corresponding subnets that are connected to or intermittently connect to Army networks. The program shall meet the scope and intent of AR25-2 and Martin Army Community Hospital IA policies to provide protection against known threats and vulnerabilities. Compliance with Army IAVM alerts and bulleting is required for these systems, and shall be completed within the specified timeframe.

8.4. Information Systems (IS)/Networks Physical Security.

8.4.1. The contractor shall employ physical security safeguards for IS/Networks involved in processing or storage of Government Data to prevent the unauthorized access, disclosure, modification, destruction, use, etc., and to otherwise protect the confidentiality and ensure use conforms with DoD regulations. In addition, the contractor will support a Physical Security Audit performed by the Government of the contractor's internal information management infrastructure. The MHS Physical Security Audit Matrix is available at: http://www.tricare.osd.mil/tmis_new/Policy/PSA_Matrix_%20012304%200930%20clean%20version.xls. The contractor shall correct any deficiencies identified by the Government of the contractor's physical security posture.

8.4.2. Special Requirements for Protected Health Information. Whenever a contract is awarded that requires the vendor to collect, use, copy, access or store Protected Health Information (PHI) in commercial office space, the contractors must notify the Martin Army Community Hospital HIPAA Security Manager, Ms. Beverly Simmons at 762-408-0032.

8.4.3. Follow all DUA and DoD requirements for secure disposal, destruction, and/or sanitization of all equipment that contained PHI.

End of Statement of Objectives