Cyber Attachment 2 DHA MDE PMO Cybersecurity-RMF Contracting Requirements V3.0
Updated
A Word document (1.3 MB) attached to DHA Enterprise Encounter-Based Endoscopy Video Imaging System (EEVIS), from the Defense Health Agency (DHA). Due Nov 16, 2026, 10:00 AM (UTC-5).
File name: Cyber Attachment 2 DHA MDE PMO Cybersecurity-RMF Contracting Requirements_V3.0.docx
The full file is for paid members, or buy this bid alone.
Preview
Department of Defense (DOW)
Defense Health Agency (DHA)
Medical Device Program Management Office (MDE-PMO)
Contracting Requirements for Medical Device and Equipment (MDE) Cybersecurity/Risk Management Framework (RMF) Version 3.0
21 May 2026
Version Matrix
Version
Date
Author
Description
1.0
16 November2018
CyberLOG
Completed initial draft of Cybersecurity Language.
1.1
31 January2019
CyberLOG
Updated document to reflect vendor comments/suggestions. 1.2
06 February2019
CyberLOG
Final Document.
1.3
25 March 2019
CyberLOG
Addition of Section B 1.11.
1.4
11 January 2022
CyberLOG
Review of and clarification of requirements.
1.5
03 October 2023
CyberLOG/ICS
Review of and clarification of requirements.
2.0
20 November 2024
CyberLOG/ICS/J6
Changes to support requirements, SMA, and NSP statement. 2.1
28 April 2025
DHA J-6
AO Overall Risk Assessment and Authorization Decision
3.0
21 May 2026
MDE PMO
Addition of SCRM/SBOM/HBOM/SCRM
TOC \o "1-3" \h \z \u A.Prohibition on Foreign Adversary Sourcing and Certain Telecommunications and Video Surveillance Services and Equipment. PAGEREF _Toc228266833 \h 1 B.Bills of Material (HBOM/SBOM) PAGEREF _Toc228266834 \h 2 C.Secure Development Practices and ICT Supply Chain Risk Management (SCRM) PAGEREF _Toc228266835 \h 3 D.Vulnerability Management, Continuous Monitoring and Notification of Non-Compliance PAGEREF _Toc228266836 \h 3 F.DHA Overall Risk Assessment and Authorization Decision PAGEREF _Toc228266837 \h 4 G.General Defense Health Agency (DHA) Medical Device and Equipment (MDE) Cybersecurity/Risk Management Framework (RMF) Contracting Requirements PAGEREF _Toc228266838 \h 4 H.DHA Cybersecurity/RMF Acceptance/MDE Delivery Requirements PAGEREF _Toc228266839 \h 7 Appendix A. Memorandum for Senior Pentagon Leadership Regarding the Removal of Acronis AG Products PAGEREF _Toc228266840 \h 18
This document establishes the minimum standards for cybersecurity, risk management, and supply chain risk management for all Medical Device and Equipment (MDE) acquisitions. These standards ensure alignment with federal, Department of War (DoW), and Defense Health Agency (DHA) policies, address emerging threats to the security and resilience of the DOW Information Network.
In accordance with Section 524B(c) of the Federal Food, Drug, and Cosmetic (FD&C) Act, a "cyber device" is defined as a device that: (1) includes software validated, installed, or authorized by the sponsor as a device or in a device; (2) has the ability to connect to the internet; and (3) contains any such technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats.
The beginning of the document. Download the full file to read on.