Attachment B_Cloud Authoity to Operate Checklist.pdf
PDF 168 KB Posted
- Solicitation number
- 36C10B21R0039
About this file
This document includes an Authority to Operate (ATO) checklist for applications hosted in the VA Enterprise Cloud, along with details of a related federal contract opportunity. The ATO checklist outlines prerequisites and registration requirements, including completing pre-registration in eMASS and uploading required security artifacts. It also lists technical scanning and testing requirements to be conducted on VA assets, such as Nessus scans, database scans, penetration tests, application security testing, and security control assessments.
The related federal contract opportunity is a sole source task order to maintain ATO for the Social Security Number Reduction tool in the VA Enterprise Cloud environment. The contractor will perform all ATO-related requirements including enhancing and upgrading the existing tool to meet TRM standards for long-term sustainability. The contractor will also provide security and legal compliance, collection and reduction of SSNs in VA databases, upgrades and maintenance of the VAEC platform, database management, troubleshooting, and user support for VA officials using the tool. The solicitation was issued by the Department of Veterans Affairs Technology Acquisition Center Austin.
View the file
Other files
Show all 15
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
ATO Checklist for Applications hosted in VAEC (FedRAMP Cloud)
Please reference the Authorization Requirements SOP when completing this checklist
Authorization Prerequisites and Registration
☐ eMASS pre-registration
☐ Fill out the eMASS pre-registration SharePoint request form
☐ System Name and System Acronym MUST match with CloudKey Record
☐ Approval received via auto generated email in eMASS
☐ System Steward completes eMASS System Registration
☐ System Name and System Acronym MUST match with CloudKey Record
☐ GRC Oversight Committee Approval received
☐ Begin documentation for security and privacy controls
☐ Upload System Owner Responsibilities and System Owner Attestation to eMASS Artifacts
☐ Application Registration with VA Software Assurance Program Office- 3.2
☐ Document the Boundary- 3.3
Assessment and Authorization Requirements
☐ Required Security Artifacts completed- 4
☐ Status of Requirements completed and uploaded to eMASS. Items include:
Security Documentation
☐ Minor Application Self-Assessment (Minor Applications Only)- 4.1.1.6
☐ Configuration Management Plan (CMP)- 4.3.1.1
☐ Disaster Recovery Plan (DRP)- 4.3.1.2
☐ Incident Response Plan (IRP)- 4.3.1.3
☐ Information Security Contingency Plan (ISCP)- 4.3.1.4
☐ Interconnection Security Agreement (ISA)/Memorandum of Understanding (MOU)- 4.3.1.5
☐ Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA)- 4.3.1.6
☐ Risk Assessment Report (RAR)- 4.3.1.7- in eMASS
☐ System Security Plan (SSP)- 4.3.1.8- in eMASS
Technical Scans/Testing requirements Findings identified in each technical/testing requirement should be mitigated from the initial detection date within the remediation timeframe specified in the VA Handbook 6500 and BOD 19-02.
☐ Nessus Scan (of VA asset)- 4.3.2.1
☐ Database Scan (of VA asset)- 4.3.2.2
☐ Penetration Test/Application Assessment (of VA asset)- 4.3.2.3
☐ Application Security Testing- 4.3.2.4
☐ Application Threat Modeling- 4.3.2.5
☐ Security Configuration Compliance Data (SCCD)- 4.3.2.6
☐ Security Control Assessment (SCA) (SCA team maintains)- 4.3.2.7 https://vaww.vashare.oit.va.gov/sites/ois/KnowledgeService/Pages/eMASS.aspx https://vaww.vashare.oit.va.gov/sites/ois/KnowledgeService/eMassDocumentLibrary/Status%20of%20Req%20Docs-Tech%20(03-09-2020).pdf https://vaww.portal2.va.gov/sites/infosecurity/ca/CA%20Home%20Documents/ATO%20Documents/Minor%20Application_Self%20Assessment_Workbook_Jan%202019.xlsx
File details come from the government source that posted it. Updated .