Directive_6008_6_Jan_2023.pdf

Department of Veterans Affairs VA Directive 6008 Washington, DC 20420 Transmittal Sheet January 06, 2023

ACQUISITION AND MANAGEMENT OF

VA INFORMATION TECHNOLOGY RESOURCES

1. REASON FOR ISSUE: This Directive revises Directive 6008 issued in November 2017 and establishes policy for the acquisition and management of information technology (IT), IT-related and other assets and resources, across the Department of Veterans Affairs (VA). VA's IT, IT-related and other assets and resources are core resources of the Department and their effective management is critical to the provision of services to our Nation's Veterans. This directive only pertains to the type of funding that can be used for procuring resources. This oversight is necessary to ensure alignment of items throughout VA enterprise to the information management information assurance policies, VA wide rules, standards and guidance. Additionally, this policy ensures that all IT funded and IT-related assets are acquired within the constraints and intent of the VA's IT Systems appropriations account, providing specific guidance as to when IT-related assets must be funded through IT Systems account or other authorized accounts. In consultation with VA Administrations and offices, all of VA's IT and IT-related assets and resources and services are subject to the laws, executive mandates and policies of the VA Chief Information Officer (CIO).

This includes information assurance, security and privacy; enterprise architecture, standards and specifications; and IT management, technical and operational internal controls, regardless of the funding source, unless otherwise indicated by appropriation, regulation, or policy. This policy, which replaces all previous memoranda on this subject, is necessitated by the growing magnitude and speed of change in information technologies, network-attached devices (i.e., the "Internet of Things (IoT)") and information security risks, procedures and regulations. Its full implementation will improve VA’s effectiveness in the use of resources to deliver a standardized, integrated, interoperable and Veteran-centric information environment in accordance with all Federal laws, regulations and industry best practices.

2. SUMMARY OF CONTENTS/MAJOR CHANGES: This directive supersedes VA Directive 6008 dated November 2, 2017. This directive reaffirms the VA CIO's oversight authority over all IT- related assets regardless of funding source and requesting office as highlighted by the Federal Information Technology Acquisition Reform Act (FITARA).

a. Clarifies the CIOs authority and role in planning, programming, budgeting and execution (PPBE) of all IT resources; clarifies the definition for IT, IT-related and other assets and resources; and expands language on funding sources.

b. Specifies that any VA IT and/or IT-related asset and resource, or service, that stores, transmits, manipulates, displays, or supports VA information assets, shall comply with all laws, executive mandates and VA CIO policies regarding IT.

Department of Veterans Affairs VA Directive 6008 Washington, DC 20420 Transmittal Sheet January 06, 2023

c. Provides policy, guidance and principles on the use of the VA IT Systems appropriations account and other VA appropriations for the acquisition, development and operation of VA IT and IT related assets in a secure, consistent, effective and efficient manner, as directed by congressional authority.

d. Establishes rules and standards relative to enterprise-wide management of IT and IT-related resources are published as part of VA's Enterprise Architecture and governed by the IT Investment Board.

3. RESPONSIBLE OFFICE: Assistant Secretary for Information and Technology (005), Information Technology Resource Management (ITRM) (005F).

4. RELATED HANDBOOK: None.

5. RESCISSION: VA Directive 6008, Acquisition and Management of VA Information Technology Resources dated November 2, 2017.

CERTIFIED BY:

/s/ Guy T. Kiyokawa Assistant Secretary for Enterprise Integration

BY DIRECTION OF THE SECRETARY

OF VETERANS AFFAIRS:

/s/ Kurt DelBene Assistant Secretary for Office of Information and Technology and Chief Information Officer.

Distribution: Electronic Only

VA Directive 6008 January 06, 2023

TABLE OF CONTENTS

1. PURPOSE AND SCOPE:

2. POLICY

3. RESPONSIBILITIES

4. REFERENCES

5. DEFINITIONS:

APPENDIX A: ACQUISITION AND MANAGEMENT OF

VA INFORMATION TECHNOLOGY ASSETS

APPENDIX B: EXPLANATORY NOTES

APPENDIX C: ACQUISITION AND MANAGEMENT OF VA INFORMATION

TECHNOLOGY PROCESSES

ACQUISITION AND MANAGEMENT OF VA INFORMATION TECHNOLOGY ASSETS

1. PURPOSE AND SCOPE: This directive establishes policy for the funding of development, acquisition, operations and management of Information Technology (IT), IT-related and other assets and resources across the Department of Veterans Affairs (VA). See Appendix B Explanatory Notes # 1 through 3 for clarification of IT, IT-related and other assets and resources. As the accountable official for the management and security of all of VA’s IT resources, including but not limited to, VA’s operational information and associated resources such as personnel, equipment and funds, VA’s Chief Information Officer (CIO) has authority over all IT and IT- related assets that are part of, or interact with, VA’s information networks, systems, services and capabilities. This policy:

a. Clarifies the scope of VA’s IT, IT-related and other assets and resources.

b. Specifies that any VA asset, resource, or service, that stores, transmits, manipulates, or displays VA information shall comply with all IT and IT-related laws, executive mandates and policies.

(1) All IT, IT-related and other assets and resources must comply with all laws, executive mandates and policies regarding information assurance, security and privacy; enterprise architecture, standards and specifications; IT management, technical and operational controls, regardless of the funding source and requesting office.

(2) IT, IT-related and other assets and resources must conform to all VA policies governing connection to the VA network.

c. Affirms all VA IT, IT related and other assets and resources connecting to the VA Network, regardless of funding source and requesting or managing office, are subject to those rules, standards and oversight processes as prescribed by the VA CIO and VA policy. This directive clarifies and strengthens the ability of the VA CIO to manage enterprise compliance with value measurement, architecture, accessibility and information assurance standards, in accordance with Congressional direction/mandate and the highest standards of public transparency and resource stewardship.

d. Ensures all IT and IT-related assets within VA are developed, procured and operated in the most effective and efficient manner possible within the legal limitations of VA appropriations and other relevant information resource management laws and regulations.

e. Defines those circumstances under which assets must be developed, acquired, or operated with the IT Systems appropriations account (or other funding source authorized to acquire IT and IT-related assets) and those circumstances under which they may be acquired by VA organizations and facilities with other funds.

If any asset connects to the VA Network, IT policies governing security and maintenance must be followed.

f. Assigns roles and responsibilities related to the funding and management of VA’s IT, IT- related and other assets and resources.

g. Specifies that acquisition of all IT and IT-related assets shall be strictly limited to acquisition vehicles that adhere to VA IT policies such as cybersecurity and accommodation for persons with disabilities.

h. Reinforces VA’s use of life cycle management and total cost of ownership in the planning and management of all IT, IT-related and other assets and resources planned for or deployed in VA.

i. States that VA items/services not purchased from the IT Systems account or other authorized accounts are to be funded by the appropriate Administration or Staff Office with the allowable appropriations account or fund.

2. POLICY.

a. A Federal Information Technology Acquisition Reform Act (FITARA) Review is required for all requirements with IT and IT-related capabilities (including cloud services) utilizing OMB’s Information Technology and Telecommunications Product Service Codes (PSCs), regardless of funding appropriation, funding source and dollar value as outlined in accordance with policy. These assets and resources must adhere to the policies and processes of IT and IT-related assets.

The review is conducted in the Budget Tracking Tool (BTT) under the Acquisition Review Module (ARM) which expands the CIO’s accessibility and visibility on IT procurements in accordance with FITARA. For additional information contact the Office of Strategic Sourcing at: Ask Strategic Sourcing

b. Funded with IT Systems Account and other Authorized Accounts.

(1) Generally, only the IT Systems appropriations account, the Franchise Fund, Supply Fund, Veterans Canteen Fund, the Office of the Inspector General (OIG) account, the VA/Department of Defense (DoD) Joint Incentive Fund, Electronic Health Record Modernization (EHRM) account and VA/DoD Federal Health Care Center Joint Fund have the legal authority to fund VA IT items (hardware, software and services), subject to the laws and regulations governing these Funds. IT items are identified as those utilizing the Office of Management and Budget’s (OMB) Information Technology and Telecommunications Product Service Codes (PSC).

(2) IT products for delivery to Veterans provided by benefits programs under Title 38 authorities will not be charged to the IT Systems account but have explicit legal authority to reimburse the IT Systems account.

(3) VA IT funded items and services include but are not limited to:

mailto:askstrategicsourcing@va.gov

(a) All IT networks and equipment except networks and equipment on either the Medical Device Isolation Architecture (MDIA) or Specialized Device Isolation Architecture (SDIA).

(b) All commercially developed software for the VA, except for Commercially available off-the-shelf (COTS) software used exclusively for items funded without IT funds as specifically defined in this directive (except for those systems funded by accounts other than IT as noted in section 2.c. of this directive).

(c) VA developed software application costs, including the development, acquisition, product support and management of the software applications, as well as any associated open source, innovations or pilots.

(d) Any interface, mechanism, or service for providing access to applications in any IT environment operating under VA control, including private/commercial cloud operations, except items funded from accounts other than those that fund IT (i.e., Software as a Service (SaaS)).

(e) IT systems administration training, IT development and testing environments, IT performance testing, IT life cycle planning and IT technical requirements gathering (but not including business requirements gathering).

(f) VA IT infrastructure (i.e., servers, storage, networks) required to maintain IT funded persistent data sources, both authoritative and non-authoritative and legacy stores, including all data storage (on premises and cloud based), backup and disaster recovery capabilities (except those items listed in section 2.c. of this directive).

(g) Voice, data and video telecommunications infrastructure (i.e., circuits and switches, wired cabling to the wall), regardless of whether the space is owned or leased by VA.

(h) Patch cabling requiring IT funding includes:

i IT funded device to wall jack;

ii Patch panel to distribution switch in the telecom closet; and iii Patch panel in server room to core routers in server room.

(i) Telecommunications and telephone services and equipment except dedicated lines or services to patient residences for telemedicine.

(j) All enterprise and limited number software and software licenses (except for those systems funded by accounts other than IT as noted in section 2.c).

(k) Employee and contractor support for IT help desk and customer service operations.

(l) Other service models used in VA’s IT production environment, such as infrastructure-as-a-service (IAAS), platform-as-a-service (PAAS) and telecommunications-as-a-service, as defined by the National Institute of Standards and Technology’s (NIST) guidelines, that require VA maintenance and/or interfaces to VA’s IT production environment, applications, or data stores.

(m) All mixed-use systems, computers and mixed-use servers, (i.e., those that support both OIT offices and other VA administration offices).

(n) Single focal point for VA cloud policy and VA Enterprise Cloud (VAEC) environment.

(o) Assessment, planning, management and migration for VA Enterprise Cloud infrastructure.

(p) IT support for Veterans Canteen Service (VCS) that is provided to other components of VA, such as use of VA network servers and installation and maintenance of security software. However, VCS is responsible for funding all costs (including related sustainment) that are specific only to VCS or VCS operations, such as Point of Sale (POS) systems.

c. Accounts other than those that fund IT, IT-related and Other Assets and Resources referenced in Section 2.b. of this directive:

(1) VA IT related assets are to be funded by the requesting Administrations or Staff Offices, including related subsequent operations and maintenance costs, using its proper appropriation. VA’s offices and administrations requiring IT resources (i.e., interfaces, network storage) for IT, IT-related and other asset requirements must have a plan to fund their entire set of requirements prior to completing a procurement. If an IT-related or other asset procurement has IT dependencies, it is the responsibility of the requesting office to comply with OIT intake processes to ensure available IT resourcing and funding for all requirements prior to the start of the project (i.e., hosting, operations and maintenance support). The funding must be programmed in compliance with the funding requirements of this directive.

(2) Medical and Clinical Systems, Equipment, Devices, or Software (MCSEDS) which meets one or more of the following criteria or definitions.

NOTE: The definitions of the terms mentioned in Section 2.c.(2) can be found in section 5: Definitions of this directive:

(a) Medical Device.

(b) Medical Device as defined by Food and Drug Administration (FDA).

(c) Medical Device Data System (MDDS) as defined by FDA; see Definitions section 5.

(d) Clinical System.

(e) Clinical Information System (CIS).

(f) Clinical Decision Support (CDS) tool.

(g) A mobile medical application (app) which meets the FDA definition of a Medical Device.

(h) This includes the procurement, development and ongoing maintenance and operations costs of the mobile medical app. This includes the costs of hosting and services related to the management of medical apps in the VA Enterprise Cloud but does not include the app store itself, which is an IT “persistent data source” and as such requires IT management and funding.

(i) Computers, tablets, mobile devices and accompanying data services (data plans) that are supplied to a clinician running MCSEDS applications and/or meets one or more of the MCSEDS criteria or definitions. Any non-medical applications on a device (i.e., e-mail) must be funded by IT.

(j) Telehealth equipment, which includes devices to report symptoms and measure vital signs for Veterans in their homes and the equipment necessary to connect Veterans and clinicians virtually via interactive video sessions, as well as the technology used to collect, store and forward telehealth information for clinical treatment purposes.

(k) Medical systems, equipment, or devices required in support of medical training and simulation.

(l) Computers and servers which are non-severable components of a medical device system (i.e., diagnostic imaging, Picture Archiving and Communication System (PACS), Clinical Information Systems (CIS), etc.).

(m) Any MCSEDS that has an FDA product code.

(n) Any MCSEDS that do not otherwise meet the definitions above and/or are not regulated by the FDA but aid in the:

i Diagnosis, treatment, or monitoring of a patient, including but not limited to telehealth, radiology, cardiology, pulmonary, anesthesia, laboratory, intensive care unit and surgery systems and/or;

ii Investigation, replacement, modification, or support of the anatomy or of a physiological process and which does not achieve its principal intended action in or on the human body by pharmacological, immunological, or metabolic means, but which may be assisted in its function by such means and/or;

iii Single and/or dedicated medical function, either directly or in support of another medical device, clinical service or application that directly impact a patient's health care, (i.e., Biological Refrigeration (Blood Banks), etc.), Optical Fabrication, Pharmacy packaging equipment, Nurse Call systems, Radio- Frequency Identification/real-time location system and Temperature Monitoring systems.

(3) Commercially available Off-The-Shelf (COTS) Software for Direct Patient Care items are purchased solely for purposes of direct patient care, as defined herein and/or meets one of more of the definitions listed under section 2.c. of this directive.

(4) Office Equipment and Office Supplies.

(a) High-capacity multifunction devices that have copying, emailing and/or printing capabilities within one device and support a large office or workgroup.

(b) Office supplies, including consumables and peripherals for end-users.

This includes anything that attaches to a computing device that does not store or process information, but rather serves just as an input or output device. Examples include privacy screens, bar code readers, monitors, headsets, insurance card readers, microphones, speakers, wireless keyboards, mice and mouse pads and desktop Uninterruptible Power Supply (UPS) units.

(c) 3D printers, models, software and services used to manufacture physical objects are considered additive manufacturing devices.

(5) Facility Equipment includes industrial control equipment, fire alarms, building automation systems, building security systems, digital signage systems, energy efficient lighting monitors/transmitters, information boards/electronic signage, elevator systems, carrier neutral distributed antenna systems, carrier neutral cell repeater sets/boosters and Uninterruptable Power Supplies (UPS) except small desktop UPS.

(6) Construction Projects includes modifications to a building’s infrastructure even though required specifically for IT purposes, the acquisition and installation of a wire closet fiber optic infrastructure, power surge protection, distribution and battery backup systems and heating, ventilation and air conditioning (HVAC) equipment to comply with either operating requirements and/or manufacturer warranties. This includes construction of data centers. However, the IT Systems account, Franchise Fund, Supply Fund, Veterans Canteen Fund, EHRM account and OIG account do not have the legal authority to incur any construction or cabling costs associated with major or minor construction, Non-Recurring Maintenance (NRM) projects and station level construction projects.

(7) Cabling infrastructure:

(a) Device funded by accounts other than IT to wall jack.

(b) All patch panel to patch panel and patch panel to wall jack cabling (including but not limited to behind the wall, above the ceiling or under the floor).

(c) Servers in a server room connecting to core routers (Including but not limited to security systems or biomedical devices).

(8) Purchase or migration of applications to VA OIT Managed Cloud Environments funded from accounts other than those that fund IT:

(a) Any IT purchase that requires IT funding, if not operated on the cloud, remain an IT funding requirement if migrated to, or purchased for, usage in the cloud.

(b) Similarly, any IT related purchase that is allowable for funding from accounts other than those that fund IT, if not operated on the cloud, remain allowable for funding from accounts other than IT if migrated to, or purchased for, usage in the cloud.

(9) Miscellaneous VA IT-related Products and Services.

(a) Information Technology Assets Purchased by a Vendor:

i IT related hardware procured by a vendor incidental to a Federal contract and required to support the performance of that contract, will be funded by the same appropriations account(s) as the contract if the hardware is not used by any VA employee or connected to any VA network, except through an approved Virtual Private Network (VPN) such as the Citrix Access Gateway (CAG).

ii Any IT asset, as defined by this policy, procured by a vendor incidental to a contract and intended to be turned over to the VA must comply with all VA asset management and security policies and be procured using an IT funding source.

(b) Software-as-a-Service (SaaS) solutions where the software is not owned or hosted by VA and no additional capabilities were added as a customization of the software and made part of the procurement.

Also, the user must log on to a vendor site where all the functionality is made available and the vendor must be responsible for software, hardware, data security, help desk, etc. functions. See Appendix C, of this directive, for the SaaS approval process.

(c) Costs of IT-related items and services funded by non-VA grants or other non-VA funding sources, such as non-VA research efforts.

(d) IT-related assets for delivery to Veterans provided by benefits programs under Title 38 authorities.

(e) Business process re-engineering. (This does not include associated software and infrastructure costs).

(f) End-user training costs, including train-the-trainer costs are the responsibility of the benefitting organization(s) to pay for their users as the system is deployed.

(g) Networks, wired or wireless, provided for patient care and therapeutic use for the benefit of Veterans and/or their family that are not connected to any VA network.

(h) Web content creation (such as textual copy, photos, video), services and management. (NOTE: This only pertains to content creation and does not pertain to software development of websites).

(i) Compensated Work Therapy purchases exclusively supported by reimbursements from clients to support the program.

(j) Specific bequests or gifts of funds to the VA for the purchase of IT products or services will be deposited in the General Post Fund and funded from the General Post Fund. This is a legally authorized augmentation of the IT Systems account.

d. Other Internal Controls.

(1) The Chief Financial Officer (CFO) or other designated official for each VA Administrations and Staff Office must submit an annual certification letter to the Office of Information & Technology CFO. This letter shall state that to the best of their knowledge no funding outside of the IT Systems account will be used to procure IT assets, as defined by this policy.

(2) Administration and Staff Office CFOs, other designated officials and/or program managers shall immediately coordinate with the OIT CFO should they become aware of any non-conformity to this policy.

(3) The VA IT Workgroup (ITW) shall review and interpret IT related acquisitions’ questions, as they relate to VA Directive 6008 and appropriations law, to make decisions about whether a specific project requires IT Systems account funding or is allowable for funding from accounts other than those that fund IT, when this policy does not allow for a clear determination. Issues that cannot be resolved by the ITW will be forwarded to the VA CFO Council for resolution.

3. RESPONSIBILITIES.

a. Assistant Secretary for Information and Technology, as the Department’s CIO, in planning, managing and overseeing the VA’s information resources shall:

(1) Plan, program, budget and execute the IT Systems appropriations account.

(2) Define the IT Strategic Plan and objectives of the organization, aligning this Plan to the larger VA strategic objectives and ultimately providing review, concurrence, or requisite feedback on IT acquisition strategies/plans, regardless of funding source.

(3) Ensure VA optimizes standardization, interoperability, security, reliability and flexibility of the technology infrastructure across the enterprise, as well as adherence to information protection standards and initiatives. Monitors alignment of IT programs and systems for consistency with the Department’s Strategic Plan, Administrations and Staff Offices Lines of Business priorities, IT Strategic Plan and Enterprise Architecture.

(4) Manage approved reimbursable budget transfers when required to move the applicable funding between affected organizations.

(5) Design, develop, implements and maintain a VA IT governance structure to:

(a) Ensure the proper use of the IT Systems appropriations account and acquisition of VA enterprise IT capabilities.

(b) Ensure that this policy is maintained and revised as required based on changing technologies.

(c) Ensure that the ITW SharePoint Portal and intake process is maintained and updated as new decisions or documentation become available Link:

https://dvagov.sharepoint.com/sites/VHAITRMITFMOS/SiteAssets/ITN ONITV2/IT NonIT.aspx

(d) Implement the policies to set criteria for whether a given asset or service is funded by the IT Systems account or not.

(e) Ensure all VA information resources, including those funded outside the IT Systems appropriations account, are compliant with enterprise policy, rules, standards and guidance related to IT, information management (IM) and information security (IS) and FITARA.

(f) Provide visibility through the VA’s enterprise architecture to all policies, rules, standards, guidance and configurations necessary to guide VA IT and IT-related item design, acquisition, development and deployment.

(g) Develop, maintain and assure completeness and proper use of standard IT configurations.

(h) Establish, maintain and make available bulk buy and enterprise purchase programs for IT and IT-related assets (including assets such as end user devices which may be purchased outside the IT Systems appropriations account) and services to ensure standardization, interoperability, economies of scale and accessibility of VA information environment.

(i) Oversee and collaborates with VA stakeholders at the local level to ensure that IT and IT-related capabilities, funded and deployed at local sites, are appropriately vetted and aligned to enterprise policies, rules, standards and guidance, including FITARA. Ensure that the operations and sustainment costs for all IT and IT-related acquisitions at the local level are properly funded.

(j) Integrate compliance with this policy within decision processes that OIT oversees or participates in.

b. Under Secretaries, Assistant Secretaries and Other Key Officials shall:

(1) Ensure all VA IT and IT-related items/services which connect to any VA Network follow rules, standards and oversight processes as prescribed by the VA CIO in order to comply with information assurance, accessibility, security, privacy and enterprise architecture standards.

(2) Integrate compliance with this policy within established decision processes in which they oversee or participate.

https://spsites.cdw.va.gov/sites/ITRM_ITFMOS/SiteAssets/ITNONITV2/ITNonIT.aspx https://dvagov.sharepoint.com/sites/VHAITRMITFMOS/SiteAssets/ITNONITV2/ITNonIT.aspx https://dvagov.sharepoint.com/sites/VHAITRMITFMOS/SiteAssets/ITNONITV2/ITNonIT.aspx https://dvagov.sharepoint.com/sites/VHAITRMITFMOS/SiteAssets/ITNONITV2/ITNonIT.aspx

(3) Maximize collaboration with the open source OIT community; and

(4) Plan, program and budget for VA IT-related items/services to ensure they are supportive of VA Administration and Staff Office requirements.

(5) Ensure all VA IT and IT-related items/services that meet the OMB definition of IT comply with all Federal laws and regulations and VA enterprise policies, rules, standards and guidance related to IT, information management (IM) and information security (IS) and FITARA.

c. The Office of General Counsel provides appropriate legal advice and interpretation of appropriations law, as necessary, to assist in determining whether a given appropriations account or Fund proposed to be used to acquire IT or IT-related resources has legal authority to fund the proposed acquisition.

This advice and interpretation will also aid in determining whether an item must be purchased with the IT Systems appropriations account or not.

4. REFERENCES.

a. 21 CFR Parts 862-892-FDA Medical Device Classification Panels

b. 48 CFR § 2.101(b) Definitions Electronic Code of Federal Regulations (eCFR)

c. 29 USC § 794d: Disabled VA Employees and Members of the Public

d. 38 USC §§ 5705, 5701 and 7332: Protection of Medical Records

e. 40 USC § 11101, Definitions and SUBTITLE III: Information Technology Management and The Clinger-Cohen Act of 1996

f. 44 USC chapter 35: Information Resources Management

g. 44 USC § 3501-3521: Paperwork Reduction Act of 1995 (PRA)

h. 44 USC § 3541-49, Dec 2014: Federal Information Security Modernization Act of

2014 (FISMA)

i. Consolidated Appropriations Act, 2002, S-515, Information Quality Act (also known as the Data Quality Act)

j. Federal Information Technology Acquisition Reform Act: Title VIII, Subtitle D of the National Defense Authorization Act for Fiscal Year 2015, Pub. L. No. 113-

k. OMB Circular No. A-11: Preparation, Submission and Execution of the Budget

l. OMB Circular No. A-130, Management of Federal Information Resources https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H https://www.ecfr.gov/current/title-48/chapter-1/subchapter-A/part-2/subpart-2.1/section-2.101#p-2.101(b) https://uscode.house.gov/view.xhtml?req=29%2BUSC%2B794d&f=treesort&fq=true&num=4&hl=true&edition=prelim&granuleId=USC-prelim-title29-section794d https://uscode.house.gov/view.xhtml?path=/prelim%40title38&edition=prelim https://uscode.house.gov/view.xhtml?path=/prelim%40title40/subtitle3&edition=prelim https://uscode.house.gov/view.xhtml?path=/prelim%40title40/subtitle3&edition=prelim https://uscode.house.gov/view.xhtml?path=/prelim%40title44/chapter35&edition=prelim https://uscode.house.gov/view.xhtml?path=/prelim%40title44/chapter35&edition=prelim https://uscode.house.gov/view.xhtml?path=/prelim%40title44/chapter35&edition=prelim https://uscode.house.gov/view.xhtml?path=/prelim%40title44/chapter35&edition=prelim https://uscode.house.gov/view.xhtml?path=/prelim%40title44/chapter35&edition=prelim https://www.govinfo.gov/content/pkg/PLAW-106publ554/pdf/PLAW-106publ554.pdf https://www.govinfo.gov/content/pkg/PLAW-106publ554/pdf/PLAW-106publ554.pdf https://uscode.house.gov/statutes/pl/113/291.pdf https://uscode.house.gov/statutes/pl/113/291.pdf https://uscode.house.gov/statutes/pl/113/291.pdf https://www.whitehouse.gov/wp-content/uploads/2018/06/a11.pdf https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf

m. OMB Memorandum (M-06-16) Protection of Sensitive Agency Information (June 23, 2006)

n. OMB Memorandum M-12-18, Managing Government Records Directive, Aug

o. OMB Memorandum M-15-14, June 10, 2015: Management and Oversight of Federal Information Technology

p. OMB Memorandum (M-19-13) Category Management: Making Smarter Use of Common Contract Solutions and Practices

q. Public Law 107-347, December 2002: E-Government Act of 2002

r. Public Law 117-103, Division J, March 15, 2022: Military Construction, Veterans Affairs and Related Agencies Appropriations Act, 2022

s. Public Law 111-352, Jan 2011: Government Performance Results Act (GPRA) of

t. VA Directive 6300, Records and Information Management

u. VA Directive 6500, VA Cybersecurity Program (formally Managing Information Security Risk: VA Information Security Program)

v. VA Directive 6517, Risk Management Framework for Cloud Computing Services.

w. VA Directive 6518, Enterprise Information Management

x. VA Directive 6550, Pre-Procurement Assessment for Medical Device/Systems

y. VA IT Workgroup (ITW) Technical Working Group Charter (formally VA IT/Non- IT Workgroup Charter)

z. VA OGC Memorandum opinion, “Information Technology (IT) Support to the Veterans Canteen Service” (Mar. 2019)

aa. VAOPGCADV 6-2015, “Use of the Franchise Fund to Purchase Information Technology Services and Systems (Apr. 2015)

5. DEFINITIONS:

a. Acquisition Review Module (ARM). ARM is the tool of record that expands the accessibility and visibility in accordance with the Federal Information Technology Acquisition Reform Act (FITARA). ARM combines the acquisition, budget and technical reviews that streamlines the acquisition approval process and provides the ability to track and approve IT and IT-related procurement and process decisions.

https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2006/m06-16.pdf https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2006/m06-16.pdf https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2012/m-12-18.pdf https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2012/m-12-18.pdf https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2015/m-15-14.pdf https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2015/m-15-14.pdf https://www.whitehouse.gov/wp-content/uploads/2019/03/M-19-13.pdf https://www.whitehouse.gov/wp-content/uploads/2019/03/M-19-13.pdf https://www.congress.gov/107/plaws/publ347/PLAW-107publ347.pdf https://www.congress.gov/117/plaws/publ103/PLAW-117publ103.pdf https://www.congress.gov/117/plaws/publ103/PLAW-117publ103.pdf https://www.congress.gov/111/plaws/publ352/PLAW-111publ352.pdf https://www.congress.gov/111/plaws/publ352/PLAW-111publ352.pdf https://vaww.va.gov/vapubs/viewPublication.asp?Pub_ID=997&FType=2 https://vaww.va.gov/vapubs/viewPublication.asp?Pub_ID=1254&FType=2 https://vaww.va.gov/vapubs/viewPublication.asp?Pub_ID=1254&FType=2 https://vaww.va.gov/vapubs/viewPublication.asp?Pub_ID=852&FType=2 http://vaww.va.gov/vapubs/viewPublication.asp?Pub_ID=791&FType=2 https://vaww.va.gov/vapubs/viewPublication.asp?Pub_ID=1042&FType=2 https://gcc02.safelinks.protection.outlook.com/ap/b-59584e83/?url=https%3A%2F%2Fdvagov.sharepoint.com%2F%3Ab%3A%2Fr%2Fsites%2FOITProcessAssetLibrary%2FTechnical_Working_Group_Charters%2Fit_workgroup_twg_charter_itw.pdf%3Fcsf%3D1%26web%3D1&data=05%7C01%7C%7C074e1322d4624259f85708dab8f41911%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C638025655770671524%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=RAIsXmtidkCZRgjNAAIn%2FcFD3aF2LJXLZDRC7x9W%2Be0%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/ap/b-59584e83/?url=https%3A%2F%2Fdvagov.sharepoint.com%2F%3Ab%3A%2Fr%2Fsites%2FOITProcessAssetLibrary%2FTechnical_Working_Group_Charters%2Fit_workgroup_twg_charter_itw.pdf%3Fcsf%3D1%26web%3D1&data=05%7C01%7C%7C074e1322d4624259f85708dab8f41911%7Ce95f1b23abaf45ee821db7ab251ab3bf%7C0%7C0%7C638025655770671524%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=RAIsXmtidkCZRgjNAAIn%2FcFD3aF2LJXLZDRC7x9W%2Be0%3D&reserved=0 https://dvagov.sharepoint.com/sites/OGC-Client/offices/ILG/SharedDocuments/Forms/AllItems.aspx?id=%2Fsites%2FOGC%2DClient%2Foffices%2FILG%2FSharedDocuments%2FAppropriations%20Law%2F2019%20IT%20Support%20to%20VCS%20%2802%29%2Epdf&parent=%2Fsites%2FOGC%2DClient%2Foffices%2FILG%2FSharedDocuments%2FAppropriations%20Law https://dvagov.sharepoint.com/sites/OGC-Client/offices/ILG/SharedDocuments/Forms/AllItems.aspx?id=%2Fsites%2FOGC%2DClient%2Foffices%2FILG%2FSharedDocuments%2FAppropriations%20Law%2F2019%20IT%20Support%20to%20VCS%20%2802%29%2Epdf&parent=%2Fsites%2FOGC%2DClient%2Foffices%2FILG%2FSharedDocuments%2FAppropriations%20Law https://dvagov.sharepoint.com/sites/OGC/lawlibrary/OfficialOpinions/Forms/AllItems.aspx?id=%2Fsites%2FOGC%2Flawlibrary%2FOfficialOpinions%2F2015%2FVAOPGCADV06%2D2015%2Epdf&parent=%2Fsites%2FOGC%2Flawlibrary%2FOfficialOpinions%2F2015 https://dvagov.sharepoint.com/sites/OGC/lawlibrary/OfficialOpinions/Forms/AllItems.aspx?id=%2Fsites%2FOGC%2Flawlibrary%2FOfficialOpinions%2F2015%2FVAOPGCADV06%2D2015%2Epdf&parent=%2Fsites%2FOGC%2Flawlibrary%2FOfficialOpinions%2F2015

b. Application. (See OMB Circular A-130 Appendix III) The use of information resources (information and information technology) to satisfy a specific set of user requirements.

c. Authoritative Data Source. A source of data or information designated and recognized as official that is trusted, timely, secure and used within VA’s information environment in support of VA business processes. An authoritative data source is the one and only (logical) location where a respective data element is created, updated and deleted. Administrations and Staff Offices designate these sources within domains for which they are the stewards. The Office of Information and Technology may develop and maintain technology solutions (i.e., services) that use these sources. [VA Directive 6518, Enterprise Information Management Policy]

d. Authority to Operate (ATO). The official management decision given by a senior organizational official to authorize operation of an information system and to explicitly accept the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations and the Nation based on the implementation of an agreed-upon set of security controls.

e. Clinical. Pertaining to actual observation and treatment of patients, as distinguished from theoretical or experimental.

f. Clinical Decision Support. Clinical decision support (CDS) provides clinicians, staff, patients or other individuals with knowledge and person-specific information, intelligently filtered, or presented at appropriate times, to enhance health and health care. CDS encompasses a variety of tools to enhance decision-making in the clinical workflow. These tools include computerized alerts and reminders to care providers and patients; clinical guidelines; condition-specific order sets; focused patient data reports and summaries; documentation templates; diagnostic support and contextually relevant reference information, among other tools. This does not include tools that only provide administrative support for clinical staff.

g. Clinical Information System. A Clinical Information System (CIS) is a computer-based system that is designed for collecting, storing, manipulating and making available clinical information concerning the diagnosis/treatment of patients’ healthcare. Clinical Information Systems provide a repository that stores clinical data, such as the patient’s history of illness and the interactions with care providers. The repository encodes information capable of helping physicians decide about the patient’s condition, treatment options and wellness activities as well as the status of decisions and actions undertake.

h. Clinical System. Defined as a health IT system, inclusive of server infrastructure, workstations, middleware and software which facilitate clinical functions, decisions and tasks. Typically, clinical systems collect, store, analyze, retrieve, display and/or print information related to patient care within one or more clinical specialties. This includes systems that provide Clinical Decision Support.

i. Clinician. The term clinician refers to a healthcare professional qualified in the clinical practice of medicine. Clinicians are those who provide: principal care for a patient where there is no planned endpoint of the relationship; expertise needed for the ongoing management of a chronic disease or condition; care during a defined period and circumstance, such as hospitalization; or care as ordered by another clinician. Clinicians may be physicians, nurses, pharmacists, or other allied health professionals (which includes, but is not limited to, pharmacy staff, laboratory staff, respiratory staff, clinical social workers, medics and paramedics).

j. Cloud computing. (Or cloud). Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (i.e., networks, servers, storage, applications and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

k. Cloud Credits. Process to pay for cloud computing services available from the VA Enterprise Cloud (VAEC) service providers, via the Enterprise Cloud Solutions Office (ECSO) procurement vehicles established to provide migration and sustainment services in support of the VAEC.

l. Commercially available off-the-shelf (COTS) software is a term for software products that are ready-made and available for purchase in the commercial market. Public sector organizations are relying more and more on COTS applications to supplement, enhance or replace proprietary systems

m. Configuration. The administrative set-up (look & feel, access constraints, global parameters, etc.) of the front end of an application or system to adhere to network requirements. (See also definition for Interface.)

n. Data. An elementary description of things, events, activities and transactions recorded, classified and stored, but that may not be organized to convey any specific meaning. Data items can be numeric, alphabetic, figures, sounds or images. A database consists of stored data items organized for expeditious use, including reading, updating and deleting.

o. Direct Patient Care. Care of a patient provided by a clinician or staff member.

Direct patient care may involve many aspects of the health care of a patient, including monitoring, diagnosis, treatments (and execution of treatment plans, i.e., dietary restrictions, etc.), care plans, counseling, or self-care by a Veteran where medical devices are used in support of telecare (i.e., wound cameras), patient education and the administration of medication. This includes products or services which provide clinical decision support, such as those which support clinical telecare triage done by clinicians.

p. Enterprise IT Capabilities. Enterprise level IT capabilities built using IT resources and data that are shared across two or more organizational components regardless of location. Within the VA this includes all IT-related services for Veterans and eligible beneficiaries, support functions and resource management. Embodied in this concept are technical efforts such as infrastructure engineering for building, managing and evolving shared IT; IT or infrastructure operations for administering and monitoring the performance of the IT service being provided to the enterprise; and IT services management.

Efforts such as IT strategy, portfolio management and IT governance enable this concept to function effectively.

q. Federal Information Technology Acquisition Reform Act (FITARA). A law that puts Federal agency CIOs in control of agency IT investments. FITARA was enacted in response to specific Federal IT challenges, such as duplication of IT spending between and within agencies, understanding cost & performance of Federal IT investments, providing more visibility into IT spending with an ability to benchmark IT spending within Federal entities and between Federal and private-sector counterparts.

r. Information. Any communication or representation of knowledge such as facts or data, in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual forms. This definition includes information that an agency disseminates from a web page.

s. Information Environment. The aggregate of the information created and used by an organization; the information architecture of the organization (models, authoritative and redundant data stores, data flows); the governance framework and policies and standards that ensure information is managed as an asset.

t. Information Lifecycle. The stages through which information passes, typically characterized as creation or collection, processing, dissemination, use, storage and disposition.

u. Information Management. The planning, budgeting, manipulating and controlling of information throughout its life cycle.

v. Information Resources. (See 44 USC § 3502) Information and related resources, such as personnel, equipment, funds and information technology.

w. Information System. (See 44 USC § 3502) A discrete set of information resources organized for the collection, processing, maintenance, transmission and dissemination of information in accordance with defined procedures, whether automated or manual.

x. Information Technology. (See 40 USC § 1110 and OMB M-15-14)

(1) With respect to an executive agency, any equipment, interconnected system, or subsystem of equipment used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission or reception of data or information by the executive agency. This includes if the equipment is used by the executive agency directly or is used by a contractor under a contract with the executive agency that requires the use:

(a) of that equipment; or

(b) of that equipment to a significant extent in the performance of a service or the furnishing of a product.

(2) Includes computers, ancillary equipment (including imaging peripherals, input, output and storage devices necessary for security and surveillance), peripheral equipment designed to be controlled by the central processing unit of a computer, software, firmware and similar procedures, services (including provisioned services such as cloud computing and support services that support any point of the lifecycle of the equipment or service) and related resources; but

(3) Does not include any equipment acquired by a Federal contractor incidental to a Federal contract.

(4) When “IT” is referenced in this document it is meant to describe all requirements/acquisitions funded with congressionally IT appropriated funds.

y. Infrastructure. The substructure or underlying foundation, platform or network used for providing goods and services, including communications facilities, cable, wiring, data centers, power plants and communication systems.

z. Infrastructure as a Service (IaaS). The capability provided to the consumer to provision processing, storage, networks and other fundamental computing resources where the consumer can deploy and run any software, which can include operating systems and applications.

The consumer does not manage or control the underlying cloud infrastructure, but has control over operating systems, storage, deployed applications and possibly limited control of select networking components (i.e., host firewalls).

aa. Interface. A shared boundary across which two or more separate components of a computer system exchange information. The exchange can be between software, computer hardware, peripheral devices, humans and combinations of these (see also configuration)

bb. IT Asset. Any equipment, interconnected system, or subsystem of equipment, which in whole or by virtue of component parts, are used in the automatic acquisition, storage, analysis, evaluation, manipulation, management, movement, control, display, switching, interchange, transmission or reception of data or information by the Executive Agency.

cc. IT Infrastructure. The term IT Infrastructure is applied to a group defined by OMB Circular A-11 Section 300 to include infrastructure, office automation and telecommunications. These are defined in OMB Circular A-11 Section 300 as “… all IT investments that support common user systems, communications and computing infrastructure. These investments usually involve multiple mission areas and might include general Local area Network (LAN)/Wide Area Network (WAN), desktops, data centers and cross-cutting issues such as shared IT security initiatives and telecommunications.” (OMB A-11 Section 300)

dd. IT Network. The grouping of two or more computer systems that are physically or virtually linked together.

ee. IT Managed Services. A solution delivered by an IT managed service provider to supply certain IT processes and functions. Services include network, application, infrastructure and security, via ongoing and regular support and active administration. Services can be provided on customers' premises, in the service provider’s data center (hosting), or in a third-party data center. Beyond traditional application and infrastructure management, managed services may also include storage, desktop and communications, mobility, help desk and technical support. (Everything that falls outside of the NIST definition of SaaS)

ff. IT Project. Includes projects for software development, mobile applications, hardware installations, network upgrades, cloud computing/external hosting and virtualization rollouts, enterprise architecture, information assurance, business analytics, data management projects and the implementation of IT services.

gg. IT Related. Products and services that may have IT components but are not required to be funded by the IT Systems appropriations account. Items are identified under OMB’s Specialized Information Technology and Telecommunications Product Service Codes, Appendix B, regardless of dollar amount and includes interagency acquisitions of IT/IT-related requirements.

hh. IT Shared Services. The consolidation of IT operations used by multiple parts of the same organization. The goal of a shared services delivery model is to allow each organization within the entity to focus its limited resources on activities that directly support that organization’s mission. Thus, the providing organization effectively becomes an internal service provider.

ii. Medical Device. Any device or system that meets one or more of the following requirements:

(1) Used in patient healthcare for diagnosis, treatment (therapeutic), or…