Performance Work Statement- Privacy Compliance Service - RFI.docx

Privacy Compliance Support Services

VA-24-00061333

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information & Technology Compliance, Risk and Remediation VA Privacy Service

Privacy Compliance Support Services

Date: 04/01/2024

VA-24-00061333

PWS Version Number: 1.0

Contents

BACKGROUND

The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Compliance, Risk and Remediation, VA Privacy Service strives to provide high quality, effective, and efficient Information Technology (IT) services to those responsible for providing care to the Veterans at the point-of-care as well as throughout all the points of the Veterans’ health care in an effective, timely and compassionate manner. VA depends on Information Management/Information Technology (IM/IT) systems to meet mission goals.

Within OIT, the VA Privacy Service oversees programs that ensures, in the course of providing benefits and services to Veterans and other beneficiaries, VA collects, uses, and discloses personally identifiable information (PII) only as is consistent with law and the data subjects’ reasonable expectations. VA collects, uses, and stores information that falls into the categories of PII and protected health information (PHI). Laws that govern the collection, use, disclosure, and maintenance of this information include the Privacy Act of 1974 (as amended), the Computer Security Act of 1987 (as amended), the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing Privacy and Security Rules, and the Federal Information Security Modernization Act (FISMA). VA must also comply with regulations, policies, and guidelines promulgated by VA itself, the Office of Management and Budget (OMB), the National Institute of Standards and Technology (NIST) and the Department of Health and Human Services (HHS). Many of these laws and other authorities (hereafter “authorities”) require the VA to protect and maintain the privacy of PII, including PHI.

VA faces significant challenges in managing agency risk to its mission and infrastructure, including its information technology (IT) networks and information systems. Information assets have become increasingly difficult to protect due to advances in the threat landscape, such as easy-to-use cyber-attack frameworks, advanced threat actor persistence and technologic attack evolution, ransomware, and social engineering such as phishing attacks. VA must respond to increasingly sophisticated threats with innovative and forward-thinking approaches to privacy and security. VA strives to include security and privacy throughout its system and software development life cycles. It also uses continuous monitoring and ongoing authorization program. VA uses these approaches and others to protect the confidentiality, integrity, availability, and privacy of PII and PHI.

VA Privacy Service is responsible for overseeing, directing, and establishing the long and short-term goals of VA’s Privacy Program. VA Privacy Service advises and makes recommendations to senior officials concerning the privacy implications of VA’s planning, programming, and budgeting processes. VA Privacy Service develops policies, procedures, programs, and materials at an enterprise-wide level. VA Administration and Staff Office Privacy Officers (POs) at VA facilities and offices around the country are responsible for implementation of these policies within their realm of responsibility and oversight. VA Privacy Service also manages Department compliance programs to include privacy impact assessments (PIAs), system of records notices (SORNs) and computer matching agreements (CMAs).

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. 44 U.S.C. § 3541-3549, “Federal Information Security Management Act (FISMA) of 2002”

2. “Federal Information Security Modernization Act of 2014”

3. Federal Information Processing Standards (FIPS) Publication 140-2, “Security Requirements for Cryptographic Modules”

4. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

5. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

6. FIPS Pub 201-2, “Personal Identity Verification of Federal Employees and Contractors,” August 2013

7. 10 U.S.C. § 2224, "Defense Information Assurance Program"

8. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

9. Public Law 109-461, Veterans Benefits, Health Care, and Information Technology Act of 2006, Title IX, Information Security Matters

10. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”

11. VA Directive 0710, “Personnel Security and Suitability Program,” June 4, 2010, https://www.va.gov/vapubs/index.cfm

12. VA Handbook 0710, “Personnel Security and Suitability Program,” May 2, 2016, https://www.va.gov/vapubs/index.cfm

13. VA Directive and Handbook 6102, “Internet/Intranet Services,” August 5, 2019

14. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” January 18, 2017

15. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

16. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”

17. NIST SP 800-66 Rev. 1, “An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule,” October 2008

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended, January 18, 2017

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” March 12, 2019

23. VA Handbook 6500.5, “Incorporating Security and Privacy into the System Development Lifecycle,” March 22, 2010

24. VA Handbook 6500.6, “Contract Security,” March 12, 2010

25. VA Handbook 6500.8, “Information System Contingency Planning,” April 6, 2011

26. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018

27. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

28. OIT Process Asset Library (PAL), https://www.va.gov/process/ . Reference Process Maps at https://www.va.gov/process/maps.asp and Artifact templates at https://www.va.gov/process/artifacts.asp

29. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

30. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

31. VA Handbook 6508.1, “Procedures for Privacy Threshold Analysis and Privacy Impact Assessment,” July 30, 2015

32. VA Handbook 6510, “VA Identity and Access Management,” January 15, 2016

33. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

34. VA Directive 6300, “Records and Information Management,” September 21, 2018

35. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

36. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

37. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

38. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

39. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

40. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

41. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

42. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

43. Federal Identity, Credential, and Access Management (FICAM) Roadmap and Implementation Guidance, December 2, 2011, (NOTE: Part A of the FICAM Roadmap and Implementation Guidance, v2.0, was replaced in 2015 with an updated Architecture (https://arch.idmanagement.gov/#what-is-the-ficam-architecture)

44. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

45. NIST SP 800-63-3, 800-63A, 800-63B, 800-63C, “Digital Identity Guidelines,” updated March 02, 2020

46. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

47. NIST SP 800-164, “Guidelines on Hardware-Rooted Security in Mobile Devices (Draft),” October 2012

48. Draft National Institute of Standards and Technology Interagency Report (NISTIR) 7981, “Mobile, PIV, and Authentication,” March 2014

49. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

50. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

51. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

52. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

53. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

54. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

55. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (Public Law 110–140), December 19, 2007

56. Section 104 of the Energy Policy Act of 2005, (Public Law 109–58), August 8, 2005

57. Executive Order 13834, “Efficient Federal Operations,” dated May 17, 2018

58. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

59. VA Directive 0058, “VA Green Purchasing Program,” July 19, 2013

60. VA Handbook 0058, “VA Green Purchasing Program,” July 19, 2013

61. Office of Information Security (OIS) VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

62. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

63. “Veteran Focused Integration Process (VIP) Guide 4.0,” January 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

64. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

65. “DevSecOps Product Line Management Playbook” version 2.0, May 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

66. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

67. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

68. Social Security Number (SSN) Fraud Prevention Act of 2017

69. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

SCOPE OF WORK

The Contractor shall support the maintenance, enhancement and execution of a comprehensive Department-wide VA Privacy Program. The Contractor shall support activities to ensure compliance with applicable privacy requirements; evaluate and monitor privacy policies, procedures, and processes; and manage privacy risks. This includes the enhancement, implementation and maintenance of a Department-wide Privacy Continuous Monitoring Strategy and Privacy Continuous Monitoring Program to ensure ongoing awareness of privacy risks and assessment of privacy controls. This also includes supporting the Privacy Program Management Office (PPMO) focused on ensuring the Department-wide VA Privacy Program delivers high quality and high value services and products to Veterans and other VA internal and external stakeholders through using Federal and industry standards and best practices in program and project management. Additionally, the Contractor shall support activities related to social security reduction efforts, privacy controls and Privacy Act activities.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The PoP shall be a 12-month base period with four 12-month option periods. The overall PoP shall not exceed 62 months.

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government does not anticipate travel for this effort.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding Month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

Deliverable:

A. Monthly Progress Report

TECHNICAL KICKOFF MEETING

A technical kickoff meeting shall be held within 10 days after TO award. The Contractor shall coordinate the date, time, and location (can be virtual) with the CO, as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the Contract Specialist (CS), and the COR. The Contractor shall provide a draft agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees. During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint presentation. At the conclusion of the meeting, the Contractor shall update the presentation with a final slide entitled “Summary Report” which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting and the following statement “As the Post-Award Conference Chairperson, I have reviewed the entirety of this presentation and assert that it is an accurate representation and summary of the discussions held during the Technical Kickoff Meeting for the Privacy Compliance Services. The Contractor shall submit the final updated presentation to the CO for review and signature within three calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the meeting minutes of the kickoff meeting to the CO, COR, and all attendees within three calendar days after the meeting. The Contractor shall obtain concurrence from the CS on the content of the meeting minutes prior to distribution of the document.

PRIVACY ACT FUNCTIONS IMPLEMENTATION SUPPORT

The Contractor shall support the department-wide implementation of Privacy Act requirements to include the SORN and CMA programs. VA has approximately 109 SORNs (https://department.va.gov/privacy/system-of-records-notices/) . SORNs must be republished every six years or when there is a major change. VA is working on republishing all SORNs that are over six years old (approximately 31), and there is an average of 1-2 new SORNs per year. Additionally, VA has approximately 21 CMAs (https://department.va.gov/privacy/cma/). CMAs have expiration dates of 12 months or 18 months, depending on which type of CMA. VA reissues or processes extension requests on approximately 12 per year. There are approximately 15 Data Integrity Board (DIB) meetings per year to process the approval of CMAs.

The Contractor shall support the maintenance of the requirements of the Privacy Act and OMB Guidance, including OMB Circular A-108, Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act. The Contractor shall provide monthly updates to the listing of VA SORNs and CMAs and Other Related Documents such as SORN and CMA standard operating procedures and intra and internet webpage content (approximately 6 documents a month) and facilitate the coordination of posting these documents on VA’s public websites. The Contractor shall review all documents to be posted to any VA website (internal or external) for Section 508 compliance and modify the document to make it compliant. The Contractor shall support internal coordination activities to develop, update and publish CMA notices and SORNs, which include the following: identifying the appropriate owner of the document(s); drafting correspondence (e.g. – emails, memorandums, briefing materials) to internal and external stakeholders; preparing SORN and CMA Correspondence and Concurrence Packages for signature; tracking and entering documentation into VA’s correspondence system; and providing logistical support for meeting facilitation (e.g., Data Integrity Board meetings (approximately 15 per year)) to include Meeting Agendas and Presentation, Meeting Minutes, Action Items and Follow-up Documentation.

The Contractor shall develop and maintain the Guidance Documentation to support in the implementation of the SORN and CMA programs.

The Contractor shall develop monthly communications to all SORN System Owners/Managers to support awareness of their responsibilities under the Privacy Act and OMB guidance. This communication shall include a required confirmation that the identified System Owner/Manager is still accurate for each respective SORN. The Contractor shall document all communications and confirmations in the System Manager’s Monthly Communications and Validation Report. The Contractor shall develop and support the implementation of a SORN Communications Strategy when SORNs are published, revised, and rescinded. The SORN Communications Strategy, at a minimum, shall include clear and measurable communications objectives with evaluation; relevant audiences and available channels; a plan of activities and a timetable; and communication risks and mitigation.

The Contractor shall develop and maintain a SORN and CMA Tracking Report which details the status of each VA SORN and CMA and issues or risks related to the publication and/or compliance with VA and Federal requirements.

The Contractor shall coordinate with CMA program offices to facilitate convening the DIB as needed (approximately 15 per year) and providing support for the DIB, including preparation of meeting materials, minutes and follow-up documentation and communications. The Contractor shall maintain the list of matching activities and ensure that the list and CMAs are posted on the VA websites as required by OMB guidance. The Contractor shall create the Annual Report of Matching Activities, coordinate required concurrences, and prepare it for submission to OMB by March 31st of each year (must be submitted to OMB by June 1st).

Deliverables:

A. SORN and CMA Lists and Other Related Documents B. SORN and CMA Correspondence and Concurrence Packages C. Guidance Documentation D. System Manager’s Monthly Communications and Validation Report E. SORN Communications Strategy F. SORN and CMA Tracking Report G. Annual Report of Matching Activities

PRIVACY CONTROLS AND OVERLAYS COMPLIANCE PROGRAM

The Contractor shall support activities related to maintaining and enhancing a Privacy Controls and Overlays Compliance Program. The Privacy Controls and Overlays Compliance Program is responsible for providing privacy guidance related to the NIST Risk Management Framework and NIST 800-53 Privacy and Security Controls at all levels (organizational, mission and business process and information system); preparing stakeholders for privacy-related controls and overlays compliance activities; supporting oversight, assessment and audit activities related to the implementation of privacy-related controls and overlays; and supporting remediation activities to address weaknesses and deficiencies with the implementation of privacy-related controls and overlays. The core of the VA Privacy Controls and Overlays Compliance Program supports a comprehensive understanding of the requirements, duties, and processes to ensure privacy-related control and overlay compliance and secure practices. The Contractor shall ensure the Privacy Controls and Overlays Compliance Program complies with OMB, NIST and VA requirements, as applicable.

IMPLEMENTATION PLAN

The Contractor shall design, develop, prepare, and maintain an Implementation Plan to support the execution of the VA Privacy Controls and Overlay Compliance Program. The Contractor shall ensure this plan aligns with the VA Cyber and Privacy Strategy, VA Privacy Risk Management Strategic Plan, VA Privacy Program Plan(s), Information Security Program Plan(s), the privacy responsibilities outlined in VA’s Strategic Plan, Chief Information Officer (CIO)/OI&T implementation plans, and related privacy requirements outlined in the OI&T Digital Transformation Strategy, VA policies, and Federal guidance. The Implementation Plan shall include process maps (where applicable), a program execution schedule or timeline delineating program phasing, milestones, an ongoing task list, task descriptions, and responsible stakeholder(s). The Implementation Plan shall delineate activities at the six-month, 12-month, and 18-month mark of the program to anticipate key activities occurring throughout the PoP of the cycle year. The Contractor shall update and maintain the Implementation Plan throughout the PoP reflecting and incorporating changes due to: NIST revisions, audit schedules, FISMA reporting deadlines, software rollouts, fiscal year deadlines and other key program schedules and/or milestones.

Deliverable:

A. Implementation Plan

INTERNAL PROGRAM SUPPORT

The Contractor shall provide internal program support for VA Privacy Service staff in relation to privacy controls and overlays. These activities include:

a. Monitoring policy and guidance changes affecting privacy controls and overlays to include the management of transitions between NIST guidance revisions and identifying any gaps. The Contractor shall document these changes in a Privacy Controls and Overlays Change Management Report to include recommendations on how to implement the new or revised requirements.

b. Developing and maintaining Privacy Controls and Overlays Guidance within VA’s security control explorer and updating the newly Control Family Volumes to include drafting implementation guidance, test results and updating standard operating procedures and control system of records. The Contractor shall coordinate the review and approval of the Privacy Controls and Overlays Guidance with the Office of Information Security (OIS) and VA Privacy Service leadership and incorporate all edits received, until approved. The Contractor shall also work with OIS and IT stakeholders to ensure all updates to the Privacy Controls and Overlays Information is posted to the security control explorer. The Contractor shall also train VA Privacy Service staff on the review process of controls and updates in accordance with OIS Control Family Volumes.

c. Coordinating input from stakeholders in the development and preparation of the Processes, Plans and Procedures approved by the VA Privacy Service. The Processes, Plans and Procedures shall provide VA privacy controls and overlays stakeholders with tools and materials that are useful for day-to-day work activities demonstrating the knowledge, understanding, and skills to implement compliance with privacy control and overlays requirements. These Processes Plans and Procedures can include the drafting of business process maps, development of workflows, business process reengineering and analysis, operational and tactical plans, checklists, and standard operating procedures. There are estimated to be approximately 10 Processes, Plans and Procedures in total.

d. Providing review, assessment and recommendations of the automated governance, risk assessment and compliance (GRC) tool; the GRC report functionalities used to support privacy controls and overlays; and the privacy compliance reports and assessment results from GRC and Privacy Compliance Assessment teams to determine trends, gaps and areas of concern regarding the administration and implementation of the Privacy Controls and Overlay Compliance Program. The review results, assessments and recommendations shall be documented in a Recommendations and Analysis Report.

e. Working with OIS to ensure privacy is integrated into the System Security Plan and associated procedures (SSP) and the SSP meets the requirements detailed in NIST and OMB guidance. The Contractor shall coordinate approval of any updates or enhancements with OIS and Privacy Leadership, as appropriate, and provide implementation support responding to concerns from stakeholders.

f. Developing Privacy Control Implementation Guidance to provide the processes and procedures to ensure controls are implemented based on security and privacy requirements, risk tolerances, system risk assessments and system categorizations. The guidance shall be written to ensure they meet the intent of the control and control specifications as defined in NIST, OMB and other applicable federal and VA guidance.

g. Supporting the development of guidance to determine the proper privacy controls to select and implement for components of Artificial Intelligence systems, including third-party AI technologies. This guidance shall identify and provide AI privacy metrics; methods to effectively assess privacy controls in AI systems; and strategies to mitigate and manage risks and impacts on affected individuals whose information is processed through AI systems. The Contractor shall support VA Privacy Service with drafting of responses to inquiries from Veterans, other federal agencies, and members of the public regarding AI system implementation, use and design with respect to privacy.

Deliverables:

A. Privacy Controls and Overlays Change Management Report B. Privacy Controls and Overlays Information C. Processes, Plans and Procedures D. Recommendations and Analysis Reports E. Privacy Control Implementation Guidance

ENTERPRISE SOCIAL SECURITY NUMBER REDUCTION (ESSNR) SUPPORT

The Contractor shall support Department/Enterprise-wide efforts to eliminate unnecessary collection, maintenance, and use of Social Security Numbers (SSNs) and support Departmental compliance with the SSN Fraud Prevention Act, Consolidated Appropriations Act and Federal and VA requirements related to ESSNR efforts.

VA ENTERPRISE SOCIAL SECURITY NUMBER REDUCTION WORKING GROUP, STRATEGY AND ROADMAP The Contractor shall maintain the VA’s ESSNR Strategy which defines the strategic framework on what VA Administrations and Staff Office must do to meet Federal and VA requirements related to ESSNR. The VA ESSNR Strategy shall include a vision for the future state on how the Department will manage SSN data from collection to disposition in all operations and functions (specifically, in systems and programs); a guiding mission on what the Department objectives and correlating actions; strategies focusing on key success approaches; and goals and plans that guide daily, weekly, and monthly actions. The Contractor shall update the Strategy quarterly.

The Contractor shall maintain a VA ESSNR Roadmap to support, direct, communicate and monitor activities according to the VA ESSNR Strategy. The ESSNR Roadmap shall provide a strategic overview and visualization of the major elements of the ESSNR program to the project level. The VA ESSNR Roadmap, at a minimum, shall include objectives, milestones, deliverables, resources, and planned timelines. The VA ESSNR Roadmap shall communicate the strategic objectives to stakeholders, serve as a reference guide of the effort’s progress and articulate the strategic reasoning of the effort. The Contractor shall update the Roadmap quarterly.

In support of the development and maintenance of the VA ESSNR Strategy and ESSNR Roadmap, the Contractor shall provide coordination and administrative support to formally appoint ESSNR points-of-contacts for each VA Administration and Staff Office. This support shall include: drafting memorandums and appointment letters; collaborating with the designated points-of-contacts to obtain initial and updated reports on the status of ESSNR activities; coordinating responses to issues and questions related to ESSNR activities; providing review and comments on Administration and Staff Office level ESSNR strategies to ensure alignment with the overarching VA ESSNR Strategy and Roadmap; and facilitating communications between Administrations and Staff Offices to ensure effective coordination and executions of ESSNR efforts.

Deliverables:

A. ESSNR Strategy B. ESSNR Roadmap

VA ESSNR ACTION PLAN AND SUPPORT

The Contractor shall maintain and enhance the VA ESSNR Action Plan to support the implementation of the ESSNR Strategy. The Contractor shall design the ESSNR Action Plan to guide VA Administrations and Staff Offices to meet Federal and VA ESSNR requirements and provide strategic guidance to support VA offices in planning their optimal implementation approaches. The VA ESSNR Action Plan shall identify the required actions for VA Administrations and Staff Offices to comply with Federal and VA requirements concerning the use of SSNs and include the milestone(s), measurement(s), target date(s), reporting mechanism(s), whether the action is required or encouraged and deliverables for each identified action.

The Contractor shall provide support to obtain and track each respective Administration and Staff Offices progress on the VA ESSNR Action Plan. This support includes development of templates to obtain progress reports and plans; review and comment on reports and plan to ensure alignment with VAESSNR Action Plan; consolidation of reports and plans, as needed to reflect VA overall progress and status; and tracking of risks, challenges, and successes. The Contractor shall update the Action Plan monthly.

Deliverables:

A. VA ESSNR Action Plan

ESSNR FEDERAL REPORTING SUPPORT

The Contractor shall develop, maintain and enhance Department-wide ESSNR Federal Reports. The -primary annual ESSNR Federal Reports is the Federal Information Security Modernization Act (FISMA) – Senior Agency Official for Privacy (SAOP) and Elimination Report. The Contractor shall also support ad hoc Federal report request from Congress, Government Accountability Office (GAO), Office of Management and Budget (OMB) and other oversight bodies. It is anticipated there will be no more than four (4) ad hoc request per year.

Deliverables:

A. ESSNR Federal Reports

ESSNR DATA COLLECTION, MONITORING, ANALYSIS, AND RECOMMENDATIONS

The Contractor shall support data collection efforts associated with VA’s use of SSNs to include maintenance of a consolidated and searchable ESSNR IT Systems Inventory and Dashboard indicating all VA systems, programs and documents that use the SSN. The Contractor shall use the data from the ESSNR IT Systems Inventory to develop a Data Analysis and Statistical Report assessing current and new collections of uses of SSNs to determine whether the collection is authorized and acceptable and conduct research and make recommendations regarding alternatives to the use of SSNs as a personal identifier. The Contractor shall document the research and recommendations in a Research and Recommendations Report. The Contractor shall prepare and provide briefing materials for leadership and other stakeholders and conduct meeting(s) as needed on the status of the VA ESSNR Efforts (no more than 6 briefing/meetings per year). Due to the priority of the ESSNR effort, these briefing/meetings may be required within a short turnaround time of less than 24 hours.

Deliverables:

A. ESSNR IT System Inventory and Dashboard B. Data Analysis and Statistical Report C. Research and Recommendation Report

OIT INTEGRATED PROJECT TEAM (IPT) AND VA ENTERPRISE SOCIAL SECURITY NUMBER REDUCTION WORKING GROUP SUPPORT The Contractor shall provide weekly administrative support for the OIT IPT and monthly administrative support for the VA EESSNR Working Group sponsored by the VA Identity, Credential and Access Management Governance Council (ICAM GC). This support includes meeting set-up, meeting agendas and presentations, meeting minutes and actions item(s), communications, facilitation, logistics, and administrative tasking in preparation of weekly OIT IPT and monthly VA EESSNR Working Group meetings. The Contractor shall also provide support to the VA EESSNR Working Group to include setting up workgroup meetings, tracking task completion progress, preparing reports, maintaining the Working Group Charter, maintaining the Document Inventory, maintaining the Stakeholder Matrix and Responsible, Accountable, Consulted, and Informed (RACI) Matrix, and other related activities. Materials must be compliant with Section 508 of the Rehabilitation Act. The Contractor shall develop and maintain an Integrated Master Schedule (IMS)/Project Schedule for all ESSNR activities and a Action Items Tracking Report to manage and track all action items and tasks related to the ESSNR effort. The Contractor shall facilitate monthly updates of the IMS and weekly updates of the Action Items Tracking Report.

Deliverables:

A. Working Group Charter B. Document Inventory C. Stakeholder Matrix D. Responsible, Accountable, Consulted, and Informed (RACI) Matrix E. Integrated Master Schedule (IMS)/Project Schedule F. Action Items Tracking Report

PROGRAM MANAGEMENT SUPPORT

The Contractor shall provide program management support to include weekly and monthly Scheduling, Planning, and Calendar Management, meeting agendas with read ahead materials, meeting minutes and action items. The Contractor shall support the development, maintenance, and organization of two (2) program management office (PMO) process Standard Operating Procedures and participate in SSNR policy / directive reviews (no more than 2 policy / directive reviews per year). The Contractor shall support the development of executive read-ahead files/summary binders, executive correspondence packages, executive status reports, executive summaries, draft letters/papers/documents/memorandums, white papers. It is anticipated there will be no more than four (4) ad hoc request per year.

The Contractor shall provide administrative support and engage in Knowledge and Document Management, to include maintaining ESSNR-related data and document / file management via SharePoint and MS Teams.

The Contractor shall develop, enhance, and maintain ESSNR processes, plans and procedures including the drafting of business process maps, development of workflows, business process reengineering and analysis, operational and tactical plans, and checklists. The Contractor shall maintain the ESSNR Document Exemption Process Diagram and ESSNR IT System Exemption Process Diagram and facilitate the review and approval of exemptions via the VA ESSNR Working Group.

The Contractor shall support, direct, communicate and monitor ESSNR Risk Management activities and maintain a Risk Register (quarterly Risk Register updates). Risk Register shall include, at a minimum, risk description, response strategy, mitigation strategy, risk score / rating (probability and impact), risk owner, and status. The Contractor shall facilitate monthly updates of the Risk Register.

The Contractor shall participate in the development and implementation of an Communications Strategy and Supporting Materials (presentations, briefings, read-a heads, electronic communications). The Communications Strategy encompasses communications for all aspects of SSNR IT system remediation across VA. At a minimum, the Communications Strategy shall include intended audience, approach / method, communications channels, roles and responsibilities, and timelines.

The Contractor shall provide administrative support (presentations, briefings, read-a heads) to Organizational Change Management initiatives related to ESSNR activities.

Deliverables:

A. ESSNR Processes, Plans and Procedures B. ESSNR Document Exemption Process Diagram C. ESSNR IT System Exemption Process Diagram D. Risk Register E. Communications Strategy and Supporting Materials

Privacy Continous monitoring support

PRIVACY CONTINUOUS MONITORING STRATEGY

Continuous monitoring of information systems and organizations is used to determine the ongoing effectiveness of controls, changes in information systems and environments of operation, and the state of security and privacy organization wide. The Contractor shall support the enhancement and maintenance of a Privacy Continuous Monitoring (PCM) Strategy (formal document) that provides an overarching framework for privacy continuous monitoring across VA that can be used by VA Privacy Service to provide privacy continuous monitoring policy and oversight of the effectiveness of control implementation. The PCM Strategy shall integrate existing privacy continuous monitoring components and combine them with any additional components that need to be developed to fill gaps. The strategy shall address PCM requirements and activities at each organizational tier (organization, mission/business processes and information systems). The PCM Strategy shall include a separate Privacy Controls Catalog appendix that details all available privacy controls implemented across risk management tiers, control criticality, assessment frequency and procedures used to ensure the control is effectively monitored on an on-going basis and compliant with applicable privacy risk management requirements.

The Contractor shall coordinate with privacy, information security, risk, system/software development and engineers, and other VA officials to identify existing privacy continuous monitoring components and needed privacy continuous monitoring components and ensure the PCM Strategy (formal document) aligns with VA’s governance structure, risk management goals, organizational risk tolerance and privacy maturity models. The Contractor shall support the development of the PCM Strategy (formal document) in accordance with applicable statutes, directives, policies, instructions, regulations, standards, and guidelines.

The Contractor shall support the design, development, and maintenance of the following for inclusion into the PCM Strategy:

a. Activities and standards which support VA officials when determining organizational priorities and managing risks consistently throughout the organization

b. Activities and standards to support visibility, awareness and assessment into organizational assets, threats and vulnerabilities, and the effectiveness of deployed privacy controls and overlays

c. Activities and standards that provide ongoing assurance that planned and implemented privacy controls and overlays are aligned with organizational risk tolerance as well as the information needed to respond to risk in a timely manner should observations indicate that the privacy controls are inadequate.

d. Information on organizational privacy risk tolerance

e. Standards to verify compliance with privacy requirements derived from VA mission/business functions, federal legislation, directives, regulations, policies, and standards/guidelines

f. Criteria to describe the conditions that trigger a review or update of the PCM Strategy and the frequency of pre-established audit(s)

g. Description of the roles and responsibilities of participants needed to support the PCM process and activities

Throughout the design, development and maintenance processes, the Contractor shall, with VA Privacy Service concurrence, coordinate with VA entities responsible for existing privacy continuous monitoring components and different aspects of privacy, information security, risk management and system and software development. The Contractor shall incorporate the comments and feedback from these entities (e.g., VA Privacy Service, OIS, Administration and Staff Offices, Privacy Offices, and other stakeholders) into the PCM Strategy (formal document). The Contractor shall review and update the PCM Strategy (formal document) annually for relevance to ensure the continued effectiveness of all privacy controls and further increase the visibility into organizational assets, awareness of threats and vulnerabilities, and visibility into the effectiveness of privacy controls.

The Contractor shall support activities related to the approval process for the PCM Strategy (formal document). The Contractor shall coordinate actions related to obtaining approval from the Senior Agency Official for Privacy, Chief Privacy Officer and other senior officials within Privacy, Information Security, Risk Management, VA and OI&T Strategic Planning, Veterans Health Administration, Veterans Benefits Administration and National Cemetery Administration, and the Secretary of VA.

Deliverable:

A. Privacy Continuous Monitoring (PCM) Strategy

PRIVACY CONTINUOUS MONITORING GUIDANCE, PROCEDURES, TOOLS, AND TEMPLATES

The Contractor shall develop, enhance and maintain PCM Guidance, Procedures, Tools, and Templates to support organizational-wide, standardized processes in support of the PCM strategy, including integrating operational guidance, procedures, and tools in use within existing privacy continuous monitoring components at VA. There will be approximately 5 total guidance, procedures, tools and/or templates developed per year. The PCM Guidance, Procedures, Tools, and Templates shall address the following areas: system-level PCM strategies, assessment and authorization decisions, privacy metrics and data sources, modification and maintenance of the monitoring strategy, assessment procedures and evidence; assessment of privacy control effectiveness, privacy posture monitoring, privacy posture reporting (including control effectiveness), critical control and system methodologies; risk assessments, implementation and use of organizational-wide tools, and baseline monitoring frequencies.

The Contractor shall provide privacy status monitoring and reporting on control effectiveness by collaborating with the ISCM team to understand the tools, and reporting constructs that are available through the CDM program, to repurpose and leverage CDM tools for the PCM program. The Contractor shall gather privacy metrics and data sources among the many existing metrics and data sources to monitor the overall health of the program and progress of performance measurement metrics through executive dashboards.

A. PCM Guidance, Procedures, Tools, and Templates

PRIVACY CONTINUOUS MONITORING PROGRAM IMPLEMENTATION

The Contractor shall support establishing a PCM Program to implement the PCM Strategy to ensure the ongoing assessments of privacy controls in accordance with VA’s continuous monitoring strategies. The PCM Program shall support VA in the detection of anomalies and changes in the environment of operations and information systems; visibility into assets; awareness of vulnerabilities; knowledge of threats; control effectiveness and privacy status and compliance.

The Contractor shall support the performance of the following PCM Program activities:

a. Develop new or updated PCM metrics. The Contractor shall document all new and updated metrics in PCM Metrics Catalog for each organizational tier.

b. Support the tracking of PCM metrics and privacy control status for each organizational tier in accordance with the PCM Strategy

c. Develop PCM Privacy Status Dashboards and Reports for VA privacy, information security and other VA officials

d. Conduct trend analysis to determine if privacy control/overlay implementation, the frequency of continuous monitoring activities, and the types of activities used in the continuous monitoring process need to be modified based on empirical data and document the results in a Trend Analysis Report

e. If it is determined a control/overlay failed, conduct root cause analysis to determine the main cause(s) of the control/overlay failure. The Contractor shall create Root Cause Analysis Report, as needed.

f. Develop Response Action Materials to include briefings, reports, white papers, memorandums, and other communications to address the results of the analysis of control assessment and monitoring information

g. Correlation and analysis of information generated by control assessments and monitoring

h. Reports on the privacy status of the system to organizational and system stakeholders at a frequency defined by VA policies and standards

Deliverables:

A. PCM Metrics Catalog B. PCM Privacy Status Dashboards and Reports C. Trend Analysis Reports D. Root Cause Analysis Reports E. Response Actions Materials

PRIVACY PROGRAM AND PERFORMANCE MANAGEMENT OFFICE SUPPORT

The Privacy Program and Performance Management Office (PPMO) serves as the central focal point to provide oversight and guidance on program, project, and performance management activities within VA Privacy Service. The PPMO establishes and implements project management and performance best practices to ensure VA Privacy Service’s projects and activities deliver on customer, quality, performance, and regulatory goals to achieve OIT and VA Privacy Service mission and strategic objectives. The PPMO will use and promote industry best practices (such as Project Management Institute (PMI) standards) to provide a department-wide approach to identify, prioritize, and execute a portfolio of VA Privacy Program work consisting of approximately 15 major initiatives.