Combined Synopsis/Solicitation to obtain instruments and reagents to perform automated microbial identification and susceptibility testing for the Brooke Army Medical Center (BAMC) Department of Pathology and Area Laboratory Services

Form / Attachment / Pricing Sheet

This document outlines the Defense Health Agency (DHA) Cyber Logistics (CyberLOG) Cybersecurity/Risk Management Framework (RMF) Requirements. It details the cybersecurity standards and processes that vendors must adhere to when providing equipment, products, systems, and software to the DHA.

• General Overview of DHA Cybersecurity Requirements: Covers new equipment/product systems, pricing for cybersecurity, and maintenance/upgrades.
• DHA Cybersecurity/Risk Management Framework (RMF) Requirements: Details system security requirements, RMF assessment timeframes, Assessment and Authorization (A&A) processes, and privileged user training/certification requirements.
• Cybersecurity Regulations and Guidance: Lists relevant US laws, OMB publications, NIST publications, FIPS, and DoD instructions that vendors must comply with.
• Specific Requirements: Includes detailed requirements for software patches, updates, reauthorization, vulnerability management, technical scans (NESSUS, SCAP, STIGs), and reporting.
• Timelines: Outlines specific timeframes for vendor and government actions within the RMF process.

This document is critical for any vendor bidding on opportunities involving DHA IT systems or medical devices. It specifies the cybersecurity compliance, documentation, testing, and ongoing maintenance obligations. Bidders must understand these requirements to accurately price their proposals and ensure successful contract performance. Key areas include adherence to RMF, vulnerability mitigation, specific scan requirements, and personnel certifications.

Form / Attachment / Pricing Sheet

This document is Attachment B, a Pricing Worksheet for the Vitek Requirement. It is intended for offerors to provide their pricing for the services outlined.

• Base Period (POP 1 October 2026 - 30 September 2027): Includes CLINs for various microbiology identification and testing services (e.g., Automated Mass Spectrometry, Gram Negative/Positive Susceptible Testing, Blood Cultures). Offerors are to provide Unit Price and Total for each CLIN.
• Option Periods 1-4 (POP 1 October 2027 - 30 September 2031): Mirrors the CLIN structure of the Base Period for potential future contract years.
• Total Price: A field is provided to sum the total price for the Base Year and all Option Years.

This pricing worksheet is critical for bidders to accurately calculate and submit their proposed costs for the services required. Bidders must complete the Unit Price and Total columns for each CLIN across all periods of performance to comply with submission requirements.

Form / Attachment / Pricing Sheet

This document is a questionnaire designed to assess the cybersecurity risk of medical devices. It requires vendors to provide detailed information about the device's system identification, operating system, data processing capabilities, security posture, and network configurations. The information gathered will be used to support stakeholders in achieving an Authorization Certificate for the medical device. Failure to meet cybersecurity requirements or disclose system limitations may result in denial of an Authority to Operate (ATO).

• Preparer Identification Information: Details about the individual completing the questionnaire.
• System Identification: Comprehensive information about the medical device, including its name, functionality, mode of operation, data processing capabilities, and operating systems used.
• System Identification Questions: Detailed questions covering confidentiality, integrity, availability, non-repudiation, data at rest, and data in transit.
• Application Development Environment: Information on programming languages and target applications.
• Medical Device Hardware/Firmware and Software Inventory: Details on the device's components and software.
• Topology Diagrams: Visual representations of the system's architecture and data flow.
• Essential Services, Ports/Protocols, Processes, and File System: Technical details regarding the device's operational components.
• Group Policy Objects (GPO): Specific questions related to Microsoft Windows operating systems.
• Authentication, Auditing, BIOS Firmware, Remote Access, Vulnerability Management, Antivirus/Antimalware, Data at Rest/Transit, Availability, IPv6: Security-focused sections detailing the device's protective measures and compliance.
• Commercial Point of Contact (POC) Information: Contact details for various roles related to the product.

Vendors must complete this questionnaire thoroughly and accurately to demonstrate their medical device's compliance with federal, DoD, and DHA cybersecurity directives and NIST standards. The responses will directly impact the device's ability to obtain an Authority to Operate (ATO). Bidders should pay close attention to all sections, as they cover a wide range of technical and security aspects critical for the evaluation.

Form / Attachment / Pricing Sheet

This document, Exhibit 1, outlines the Risk Management Framework (RMF) Assessment Timeframes for vendors. It details the required actions and their associated timelines for both vendor and government responsibilities following contract or order issuance.

Vendor Requirements:

• Contacting Government POC: Within 10 business days post-award.
• Submitting Hardware/Software/Architecture Documents: Within 15 business days post-award, with a final due date of 20 business days post-award.
• RMF Documentation Production: Within 6 weeks post-award, with a final due date of 4 months post-award.
• Technical Nessus Scans: Within 1 month post-award, with a final due date of 6 months post-award.
• Technical STIG Checklists: Within 1 month post-award, with a final due date of 6 months post-award.
• Technical SCAP: Within 1 month post-award, with a final due date of 6 months post-award.

Government Requirements:

• Kickoff Meeting: Within 15 business days post-award.
• Security Assessment Plan Generation: Within 20 business days post-award, with a final due date of 30 days post-award.
• RMF Templates sent to Vendor: Within 5 business days post vendor initial contact.
• Copies of Applicable STIGs sent to Vendor: Within 17 business days post-award, with a final due date of 30 days post-award.
• Authorization to Operate (ATO-C) Recommendation: Submitted to 3rd party validator 2 weeks after final documentation/technical scans received.
• Independent Verification and Validation (IV&V) Scheduling: Scheduling request to 3rd party validator 3 weeks after final documentation/technical scans received.

This document is crucial for bidders as it clearly defines the expected timelines for critical RMF assessment activities. Understanding these timeframes is essential for project planning, resource allocation, and ensuring compliance with the contract requirements. It highlights the vendor's responsibilities and the government's role in the RMF process, impacting the overall project schedule and success.

Statement of Objectives (SOO)

This document outlines the objectives for reagents and equipment to support automated mass spectrometry rapid microbiology identification, automated antimicrobial susceptibility testing, automated biochemical identification, and blood culture incubation and monitoring at the Department of Pathology and Area Laboratory Services (DPALS) at Brooke Army Medical Center (BAMC).

• The contractor shall furnish all necessary equipment (instruments, reagents, software, consumables, controls) and services for the specified testing.

• Reagents and data management/quality control software must be compatible with government-owned Biomerieux BacT/Alert Virtuo and Vitek2 XL equipment.

• Instruments and software will not be government-owned; the contractor is responsible for their maintenance and service.

• Base Period: October 1, 2026 – September 30, 2027

• Four Option Periods, each one year long, extending through September 30, 2031.

• Government will order on an as-needed basis, paying only for tests ordered, received, and accepted.

• Instruments/Equipment: Must be contractor-owned, FDA-approved, and capable of identifying a wide range of organisms, performing antimicrobial sensitivities, and detecting emerging resistance mechanisms. Must include automated alerts, quality control features, and be compatible with LIS (e.g., MHS Genesis).

• Software: Must include data management/quality control software capable of generating various statistical, epidemiological, and instrument reports. Software upgrades must be provided at no cost.

• Reagents/Consumables: Must be FDA-approved with a minimum shelf life of six months. Blood culture reagents must be compatible with specific government systems and use absorbent beads instead of charcoal. All reagents and quality control materials must be marked with storage temperature and expiration dates.

• Maintenance & Repairs: Contractor is responsible for all scheduled preventive maintenance, safety inspections, calibrations, and unscheduled repairs. Response times for unscheduled repairs are within 24 hours, with on-site repair within 72 hours. Replacement instruments must be provided within seven days if repair is not possible.

• Training: Initial operator training and annual refresher training for BAMC staff are required.

• Delivery: Equipment delivery and installation within 30 days of contract award, with full operational setup and training within six weeks.

• Security: Personnel must comply with local installation requirements for vehicle registration, identification, and access. Safety regulations, including OSHA standards, must be followed.

• Data Management: Instruments must interface with the hospital LIS. Software must be up-to-date and meet Risk Management Framework and security requirements (Windows 11, Microsoft 2022, SQL 2022).

• Reporting: Contractor must provide service reports within one business day of repair completion.

• Privacy & HIPAA: Contractor must comply with all applicable privacy laws, including HIPAA and DoD issuances, and may require a Business Associate Agreement (BAA).

• Exclusions: Contractor shall not employ individuals listed on the HHS OIG List of Excluded Individuals and Entities (LEIE) or the TRICARE Sanctioned Provider List.

• Tobacco-Free Campus: Contractor personnel must comply with Tobacco Free Medical Campus (TFMC) policies.

A table provides estimated annual test volumes for various categories, including automated mass spectrometry, antimicrobial susceptibility, microbial identification, and blood cultures, for the base year and option periods.

Solicitation / RFP / RFQ

This solicitation seeks offers for a cost-per-test (CPT) agreement for automated mass spectrometry rapid microbiology identification, automated antimicrobial susceptibility, and automated biochemical identification, and blood culture incubation and monitoring testing. The services are to be provided to the Department of Pathology and Area Laboratory Services (DPALS), Microbiology Laboratory Section at Brooke Army Medical Center (BAMC), Fort Sam Houston, Texas.

• Provision of reagents and data management/quality control software compatible with government-owned Biomerieux BacT/Alert Virtuo and Vitek2 XL equipment.

• Furnishing of all necessary equipment, reagents, consumables, controls, and support services (e.g., maintenance, repairs).

• Offerors may propose reagents compatible with government-owned equipment or an alternate solution.

• Specific testing includes:

  • Automated mass spectrometry rapid microbiology identification
  • Automated antimicrobial susceptibility testing (Gram-negative and Gram-positive)
  • Blood culture incubation and monitoring (aerobic, anaerobic, pediatric bottles)

• RMF Compliance and MHS Genesis interfacing capabilities are required.

• The contract type is anticipated to be Firm-Fixed-Price.

• Delivery periods span from October 1, 2026, through September 30, 2031, with multiple option periods.

• The NAICS Code for this acquisition is 325413.

• Offers are due by April 13, 2026, 1:00 PM, Central Standard Time.

• Proposals must be submitted via email to medina.l.woodson.civ@health.mil and salameya.paulouskaya2.civ@health.mil.

• Questions deadline is April 6, 2026, 08:00 AM, CST.

• Award will be made using the Lowest Price Technically Acceptable (LPTA) process.

• Evaluation factors include Technical Capability (Instruments/Equipment/Reagents, Service/Maintenance, Training, Delivery/Installation), Risk Management Framework (RMF) Compliance, Military Health System (MHS) Capability, and Price.

• The acquisition is unrestricted.

• Offerors must complete SF1449 blocks 12, 17, and 30A-C, and any amendments.

• Offerors must be registered in SAM.gov.

• A capability statement, product literature, and FDA approval documentation are required.

• Specific attachments include Statement of Objectives (A), Pricing Matrix (B), DHA Cybersecurity RMF Requirements (C1), RMF Timelines (C2), and RMF Cybersecurity Assessment Questionnaire (C3).