Attachment 14 - Authority to Operate.docx

36C79123R0007

Attachment 14 - Authority to Operate (ATO)

Security Specialization responsibilities shall include, at a minimum:

1. Developing the ATO package and remediating any findings that require resolution.

1. Implementing VA Office of Information Security (OIS) ATO direction and recommending improvements for continuous ATO process improvements for optimization and automation.

The Contractor shall:

1. Provide support for identification of field sites, test environments, acceptance criteria, and ATO requirements.

1. Develop and maintain the VA ATO package to obtain/maintain approval, as required. Required ATOs must be obtained prior to Product Increment release and ATO approval timelines, including all necessary security scanning and remediations, must be considered in Product Increment planning activities.

1. Support internal and external stakeholders in the creation of critical product artifacts supporting the ATO such as the Disaster Recovery Plan, Continuity of Operations (COOP) Plan, and Backup Policy and provide any other documentation required to obtain/maintain an ATO. Additional information is available in VHA Directive 0320.02, Veterans Health Administration Health Care Continuity Program available at the following link. https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwjprL7rqP3_AhXUBEQIHcxEBPIQFnoECBUQAQ&url=https%3A%2F%2Fwww.va.gov%2Fvhapublications%2FViewPublication.asp%3Fpub_ID%3D8644&usg=AOvVaw0Mm0-CvapZfFC13VvPfvHz&opi=89978449 The time period to obtain the ATO is expected to take up to 180 days and will be completed before the Pharmacy Benefit Management (PBM) Contractor is authorized system access and can begin contract performance which starts on April 1, 2024.