Cybersecurity Pre-Assessment Process

The U.S. Army Medical Materiel Agency (USAMMA) has entered into a Cooperative Research and Development Agreement (CRADA) with DeltaStrac(tm) LLC in January 2016, to start a new Cybersecurity Pre-Assessment Process for medical device vendors seeking to do business with the Army. Many modern medical devices connect to the hospital networks and in an effort to ensure medical devices purchased by the Government do not introduce security vulnerabilities, each device must pass a robust cybersecurity certification process. Participation in a cybersecurity pre-assessment (CAP) does not guarantee that the Army will purchase a device; however, the new agreement allows DeltaStrac(tm) LLC to work directly with industry partners to help them understand cybersecurity requirements, so they can engineer medical devices to meet the cybersecurity standards. The CAP CRADA will benefit industry by providing a cybersecurity sponsorship mechanism outside the procurement process offering authoritative Army cybersecurity assessment guidelines and standards. Specific potential benefits include reducing engineering/development costs associated with early security integration/incorporation in the system development file-cycle and improved marketability of the product/device. Cybersecurity pre-assessments are intended to improve the overall acquisition process. The pre-assessment is designed to save time initiating system specific cybersecurity testing prior to contract award, in the design and engineering of the software systems, rather than after contract award, where significant re-engineering may need to occur before the equipment can be put into operation. USAMMA believes working with industry partners early to achieve cybersecurity requirements will significantly shorten the time from acquisition to actual use. Other benefits include: Improve industry's compliance to Department of the Army (DA) cybersecurity requirements: - Reduction of re-work/re-engineering by improving vendor knowledge of DA cybersecurity requirements permitting improved integration into their engineering and manufacturing process; - Deliver operational product to Government faster; - Improve marketability of products by having pre-assessment certification. Increased product availability to meet DA needs: - Improves USAMMA purchasing power as more qualified participating vendors should promote pricing competitiveness; - Increases medical device product availability and product options to meet USAMMA mission capability gaps/mission needs. - Increased DoD cybersecurity posture: Reduction of waivers of non-compliant systems currently introducing risk to the global information grid (GIG). Under the CRADA arrangement, USAMMA will provide no funding whatsoever to DeltaStrac, LLC. Individual companies participating will pay for the services provided by DeltaStrac. The CAP CRADA will pursue two routes for medical device/equipment enrollment into the study. First, are the market outreach efforts by DeltaStrac to vendors producing equipment with the capabilities aligned with USAMMA's requirements and acquisition objectives. Second is vendor initiated nomination of equipment. Both routes will require an enrollment phase to qualify the product as a viable candidate for the CRADA and mutual development and acceptance of the project plan. During the CRADA initial operating capability (IOC) phase, equipment enrollment will be limited to validate the initial process, procedures, and assess demand for resource planning. USAMMA is the procurement authority for the Super Capital Expense Equipment Program (SuperCEEP) and the Medical Case Support Equipment (MEDCASE), which are Army-funded programs that validate all high dollar medical device requirements through Army Medicine. USAMMA is a subordinate agency of the U.S. Army Medical Research and Materiel Command (USAMRMC), which is the Army's main medical materiel developer. USAMMA's mission is to develop, tailor, deliver, and sustain medical materiel capabilities and data in order to build and enable health readiness. Vendors who are interested in finding out more about the cybersecurity pre-assessment process should submit their queries to the USAMRMC New Products and Ideas (NPI) web portal: http://mrmc-npi.amedd.army.mil/ or contact Gilroy Gotiangco, 301-337-0523 DeltaStrac (www.deltastrac.com).