Specifications include, but are not limited to: 1. Cybersecurity Controls: The Selected Proposer will have a set of cybersecurity controls, in accordance with FDA Guidance for Management of Cybersecurity in Medical Devices, for each of the devices quoted/purchased to manage cybersecurity risk at an acceptable level and to maintain the safety and efficacy of the devices including, but not limited, to the following: (Patching) The selected proposer is expected to maintain the equipment with up-to-date patches during the warranty period. (Patching) The selected proposer will allow JHS to maintain up-to-date patches on the medical device(s) after the warranty period to ensure the equipment remains secure and uninfected should JHS contract a third party to provide equipment maintenance. Only vendor approved patches can be administered on the medical device. Each patch is tested and verified within a timeframe that is appropriate based on the level of risk, to ensure the product is functioning properly prior to introduction at installed customer locations. (Firewall) The selected proposer will implement a device host firewall, if necessary for the medical device and configure their device only with the ports and services needed for the device’s functionality. If the vendor is unable or unwilling to configure a host firewall the vendor must identify specifically why they are unable to perform such action in technical detail. (Remediation/Rebuild) If the device were to become infected during the initial warranty period, the selected proposer is expected to dispatch support staff without delay to rebuild and resolve the issue accordingly. (Configuration/Controls) The selected vendor will provide JHS IT Security with specific technical information as agreed upon related to the medical device, including but not limited to the following: o Interfaces o Ports o Processes o Security Controls o Hardware specifications o Information useful in determining when a device is not functioning normally and may need security remediation action 2. Upon completion of installation operational verification data shall be taken, documented, and presented to the hospital prior to acceptance and first clinical utilization. At the hospital's option, acceptance testing may be performed to verify the specifications and clinical operation. 3. If the equipment does not pass acceptance testing, the awarded proposer has the right to review the method of testing and take exception to any test methodology. Any exceptions to test methods or results must be made in writing. Final resolution of compliance with specification and clinical operation must be made before final acceptance by the hospital. 4. Guarantees on equipment, materials and workmanship shall not commence until Trust acceptance. 5. If the installed equipment does not comply with the agreed upon performance specifications, the selected proposer shall upgrade the system to meet the agreed-upon performance specifications within thirty (30) days at no additional cost to the JHS.
