S02_36C10B21R0039_SSNR_Final_To Post.pdf

36C10B21R0039

Table of Contents

SECTION B

B.1 COMBINED SYNOPSIS/SOLICITATION

B.2 GOVERNING LAW CLAUSE

B.3 CONTRACT ADMINISTRATION DATA

B.4 PRICE SCHEDULE

B.5 PERFORMANCE WORK STATEMENT

1.0 BACKGROUND

2.0 APPLICABLE DOCUMENTS

3.0 SCOPE OF WORK

4.0 PERFORMANCE DETAILS

5.0 SPECIFIC TASKS AND DELIVERABLES

6.0 GENERAL REQUIREMENTS

ADDENDUM B- VA INFORMATION AND INFORMATION SYSTEM SECURITY /

PRIVACY LANGUAGE

SECTION C – CONTRACT CLAUSES

C.1 52.252-2 CLAUSES INCORPORATED BY REFERENCE (FEB 1998)

C.2 52.212-5 CONTRACT TERMS AND CONDITIONS REQUIRED TO IMPLEMENT

STATUTES OR EXECUTIVE ORDERS—COMMERCIAL ITEMS (JUL 2021)

C.3 52.217-9 OPTION TO EXTEND THE TERM OF THE CONTRACT (MAR 2000) ... 62

C.4 52.219-17 SECTION8(A) AWARD (OCT 2019)

C.5 VAAR 852.212-70 PROVISIONS AND CLAUSES APPLICABLE TO VA

ACQUISITION OF COMMERCIAL ITEMS (APR 2020)

C.6 VAAR 852.219-74 LIMITATIONS ON SUBCONTRACTING—MONITORING AND

COMPLIANCE (JUL 2018) (DEVIATION)

SECTION D - CONTRACT DOCUMENTS, EXHIBITS, OR ATTACHMENTS

SECTION E - SOLICITATION PROVISIONS

E.1 52.252-1 SOLICITATION PROVISIONS INCORPORATED BY REFERENCE (FEB

1998)

E.2 52.204-24 REPRESENTATION REGARDING CERTAIN TELECOMMUNICATIONS

AND VIDEO SURVEILLANCE SERVICES OR EQUIPMENT (OCT 2020)

E.3 52.204-26 COVERED TELECOMMUNICATIONS EQUIPMENT OR SERVICES—

REPRESENTATION (DEC 2019)

E.4 52.209-7 INFORMATION REGARDING RESPONSIBILITY MATTERS (OCT 2018)

E.5 52.212-3 OFFEROR REPRESENTATIONS AND CERTIFICATIONS—

COMMERCIAL ITEMS (FEB 2021)

E.6 52.216-1 TYPE OF CONTRACT (APR 1984)

E.7 52.233-2 SERVICE OF PROTEST (SEP 2006)

E.8 BASIS FOR AWARD

E.9 PROPOSAL SUBMISSION INSTRUCTIONS

SECTION B

B.1 COMBINED SYNOPSIS/SOLICITATION

This is a combined synopsis/solicitation for commercial items prepared in accordance with the format in Subpart 12.6, as supplemented with additional information included in this notice. This announcement constitutes the only solicitation; proposals are being requested and an additional solicitation will not be issued.

(ii) Request for Quotation (RFQ) 36C10B21R0039

(iii) The solicitation document and incorporated provisions and clauses are those in effect through Federal Acquisition Circular 2021-05.

(iv) Notice of an 8(a) sole source award to Economically Disadvantaged Women- Owned Small Business Concern.

(v) See Section B.4 below for the Price Schedule.

(vi) See Section B.5 below for the Performance Work Statement.

(vii) The period performance shall be a 12-month base period with four 12-month option periods. Freight-On-Board (FOB) is Destination.

(viii) The provision at 52.212-1, “Instructions to Offerors -- Commercial,” applies to this acquisition.

(ix) The provision at 52.212-2, “Evaluation -- Commercial Items,” does not apply to this acquisition. See Section E below for the Evaluation procedures and Basis for Award.

(x) Offerors shall include a completed copy of the provision at 52.212-3, “Offeror Representations and Certifications -- Commercial Items,” with its offer. See Section E below for addenda.

(xi) The clause at 52.212-4, “Contract Terms and Conditions -- Commercial Items,” applies to this acquisition.

(xii) The clause at 52.212-5, “Contract Terms and Conditions Required To Implement Statutes Or Executive Orders -- Commercial Items,” applies to this acquisition.

(xv) Proposals are due by Noon ET on September 16, 2021. Please see submission instructions in Section E.9.

(xvi) Please contact Contract Specialist John Vardouniotis, ioannis.vardouniotis@va.gov, (848) 377-5194, or Contracting Officer Iris Farrell, iris.farrell@va.gov, (848) 377-5154 for information regarding the solicitation.

B.2 GOVERNING LAW CLAUSE

Federal law and regulations, including the Federal Acquisition Regulations (FAR), shall govern this Contract/Order. Commercial license agreements may be made a part of this Contract/Order but only if both parties expressly make them an addendum hereto, as permitted by FAR 12.212. If the commercial license agreement is not made an addendum, it shall not apply, govern, be a part of or have any effect whatsoever on the Contract/Order; this includes, but is not limited to, any agreement embedded in the computer software (clickwrap), any agreement that is otherwise delivered with or provided to the Government with the commercial computer software or documentation (shrinkwrap), or any other license agreement otherwise referred to in any document. If a commercial license agreement is made an addendum, only those provisions addressing data rights regarding the Government’s use, duplication and disclosure of data (e.g., restricted computer software) are included and made a part of this Contract/Order, and only to the extent that those provisions are not duplicative or inconsistent with Federal law, Federal regulation, the incorporated FAR clauses and the provisions of this Contract/Order; those provisions in the commercial license agreement that do not address data rights regarding the Government’s use, duplication and disclosure of data shall not be included or made a part of the Contract/Order. Federal law and regulation including, without limitation, the Contract Disputes Act (41 U.S.C. § 7101 et seq.), the Anti-Deficiency Act (31 U.S.C. § 1341 et seq.), the Competition in Contracting Act (41 U.S.C. § 3301 et seq.), the Prompt Payment Act (31 U.S.C. § 3901 et seq.), Contracts for Data Processing or Maintenance (38 USC § 5725), and FAR clauses 52.212-4, 52.227-14, 52.227-19 shall supersede, control, and render ineffective any inconsistent, conflicting, or duplicative provision in any commercial license agreement. In the event of conflict between this clause and any provision in the Contract/Order or the commercial license agreement or elsewhere, the terms of this clause shall prevail. The Contractor shall deliver to the Government all data first produced under this Contract/Order with unlimited rights as defined by FAR 52.227-14.

Claims of patent or copyright infringement brought against the Government as a party shall be defended by the U.S. Department of Justice (DOJ) in accordance with 28 U.S.C. § 516; at the discretion of DOJ, the Contractor may be allowed reasonable participation in the defense of the litigation. Any additional changes to the Contract/Order must be made by modification (Standard Form 30) and shall only be made by a warranted Contracting Officer. Nothing in this Contract/Order or any commercial license agreement shall be construed as a waiver of sovereign immunity.

B.3 CONTRACT ADMINISTRATION DATA

1. Contract Administration: All contract administration matters will be handled by the following individuals:

a. CONTRACTOR: TBD

b. GOVERNMENT: Contracting Officer 36C10B Department of Veterans Affairs Technology Acquisition Center 23 Christopher Way Eatontown NJ 07724

2. CONTRACTOR REMITTANCE ADDRESS: All payments by the Government to the contractor will be made in accordance with:

[X] 52.232-33, Payment by Electronic Funds Transfer—System For Award

Management, or

[ ] 52.232-36, Payment by Third Party

3. INVOICES: Invoices shall be submitted in arrears:

a. Quarterly [ ]

b. Semi-Annually [ ]

c. Other [X] - Upon receipt of deliverables/services in accordance with Section B.4, Price Schedule

4. GOVERNMENT INVOICE ADDRESS: All Invoices from the contactor shall be submitted electronically in accordance with VAAR Clause 852.232-72 Electronic Submission of Payment Requests. - https://www.fsc.va.gov/fsc/einvoice.asp

5. ACKNOWLEDGMENT OF AMENDMENTS: The offeror acknowledges receipt of amendments to the Solicitation numbered and dated as follows:

AMENDMENT NO DATE

N/A https://www.fsc.va.gov/fsc/einvoice.asp

B.4 PRICE SCHEDULE

Vendors are instructed to complete Section B.4 and submit with their proposal.

Vendors are cautioned that alterations to the line items as specified below may render proposals unacceptable. All questions shall be directed to the Contract Specialist, John Vardouniotis, ioannis.vardouniotis@va.gov, (848) 377-5194, and Contracting Officer, Iris Farrell, iris.farrell@va.gov, (848) 377-5156, prior to the closing date and time specified in the Request for Proposal (RFP).

Inspection: Destination Acceptance: Destination FOB: Destination

Electronic submission to: VA Program Manager (VA PM), Contracting Officer (CO), Contract Specialist (CS) and Contracting Officer’s Representative (COR) unless otherwise specified in the line item.

Note: Days used in the table below refer to calendar days unless otherwise stated.

Deliverables with due dates falling on a weekend or holiday shall be submitted the following Government work-day after the weekend or holiday.

BASE PERIOD

The Period of Performance (PoP) shall be 12 months.

CLIN/

SLIN

DESCRIPTION/DELIVERABLE QTY UNIT UNIT PRICE TOTAL PRICE

0001 Social Security Number Reduction Tool (SNNR) and Database Management

In accordance with (IAW) Performance Work Statement (PWS) paragraphs 5.1 through 5.5, including all subparagraphs.

Firm Fixed Price (FFP)

This Contract Line Item Number (CLIN) includes all labor, material, supplies, and any other costs required for successful completion for the services detailed in PWS paragraphs 5.1 inclusive of all subparagraphs, excluding 5.1.1.5.

PoP: 12 months

12 Months

(MO)

0001AA Contractor Project Management Plan IAW PWS paragraph 5.1.1

1 Lot

(LO)

Not Separately Prices (NSP)

NSP

Initial draft due at Kickoff Meeting and updated monthly thereafter.

0001AB Weekly Progress Report IAW PWS paragraph 5.1.2

Due bi-weekly prior to alternate weekly meeting.

1 LO NSP NSP

0001AC Kickoff Meeting Presentation and Meeting Minutes IAW PWS paragraph 5.1.3

Due within three calendar days after the Kickoff Meeting.

0001AD Authority To Operate (ATO) Implementation Plan IAW PWS paragraph 5.2.1

Due within 60 days ARO

0001AE ATO Security Documentation IAW PWS paragraph 5.2.1

Due 45 days ARO and updated when new documents added thereafter throughout the PoP.

0001AF Test Scan Reports IAW PWS paragraph 5.2.2

Due 30 days prior to PoP end, and updated annually.

Electronic submission to: VA PM, COR, CO, System Steward

0001AG User Acceptance Testing (UAT) Test Case Scenarios and Test Scripts IAW PWS paragraph 5.2.2

Due 60 days ARO and updated when UATs implemented throughout the PoP.

0001AH UAT Reports IAW PWS paragraph 5.2.2.

Due 60 days ARO and updated quarterly thereafter throughout the PoP.

0001AJ Upgrade and Maintenance Report

Due 60 days ARO and updated when upgrade implemented throughout the PoP.

0001AK ATO Documentation IAW Development, Security, Operations (DevSecOps) Information Assurance (IA) System Checklist IAW PWS paragraph 5.2.3.

Due 60 days ARO and updated when new documents added throughout the PoP.

0001AL Monitoring Service Registry (MSR) Registration for the SSNR Web Application IAW PWS paragraph 5.3.

Due 60 days ARO.

0001AM Completion Report IAW PWS paragraph 5.3.

Due 60 days ARO and updated quarterly thereafter throughout the PoP.

0001AN Final Section 508 Compliance Test Results

IAW PWS paragraph 5.3.

Due 60 days ARO and updated thereafter when upgrade or changes to application completed

0001AP Database Management Support Activity Quarterly Report

IAW PWS paragraph 5.4

Due quarterly.

Electronic submission to: VA PM, COR, CO, System Steward

1 LO NSP NSP

0001AQ User Access and Help-Call Support Quarterly Report

IAW PWS paragraph 5.4

Due quarterly.

0001AR Quarterly System Troubleshooting Completion Report IAW PWS paragraph 5.4

Due quarterly.

0001AS Update User Manual

IAW PWS paragraph 5.4

Due within 10 days when there are routine or unanticipated changes to the User Manual in support of this Task Order.

0001AT Code and Upgrade SSNR Tool with Technical Reference Model (TRM) Compliant Technology IAW PWS paragraph 5.5

Due 60 days ARO and updated when TRM technology changes thereafter throughout the PoP.

0001AU Update SSNR tool with Veteran Health Administration (VHA) Facility Listing IAW PWS paragraph 5.5

Due 90 days ARO and updated if any VHA facility change thereafter throughout the PoP.

0001AV Updated Source Code IAW PWS paragraph 5.5

Due 60 days ARO and updated quarterly with any changes thereafter throughout the PoP.

BASE PERIOD TOTAL

OPTION PERIOD ONE

This option may be exercised in accordance with FAR 52.217-9, Option to Extend the Term of the Contract (MAR 2000). Work shall not commence until, and unless, a formal modification is issued by the

Contracting Officer. If exercised, this option shall commence immediately after expiration of the Base Period. The PoP shall be 12 months.

CLIN/

SLIN

DESCRIPTION/DELIVERABLE QTY UNIT UNIT PRICE TOTAL PRICE

1001 Social Security Number Reduction Tool (SNNR) and Database Management

IAW PWS paragraphs 5.1 through 5.5, including all subparagraphs.

FFP

12 MO $ $

This CLIN includes all labor, material, supplies, and any other costs required for successful completion for the services detailed in PWS paragraphs

5.1 inclusive of all subparagraphs, 1001AA Contractor Project Management Plan

1001AB Weekly Progress Report IAW PWS paragraph 5.1.2

1001AC Kickoff Meeting Presentation and Meeting Minutes IAW PWS paragraph 5.1.3

1001AD Authority To Operate (ATO) Implementation Plan IAW PWS paragraph 5.2.1

Due within 60 days after the beginning of the option PoP.

1001AE ATO Security Documentation IAW PWS paragraph 5.2.1

Due 45 days after the beginning of the option PoP and updated when new documents added thereafter throughout the PoP.

1001AF Test Scan Reports IAW PWS paragraph 5.2.2

Due 30 days prior to PoP end, and updated annually.

Electronic submission to: VA PM, COR, CO, System Steward

1 LO NSP NSP

1001AG User Acceptance Testing (UAT) Test Case Scenarios and Test Scripts

IAW PWS paragraph 5.2.2

Due 60 days after the beginning of the option PoP and updated when UATs implemented throughout the PoP.

1001AH UAT Reports

Due 60 days after the beginning of the option PoP and updated quarterly thereafter throughout the PoP.

1001AJ Upgrade and Maintenance Report IAW PWS paragraph 5.2.2.

Due 60 days after the beginning of the option PoP and updated when upgrade implemented throughout the PoP.

1001AK ATO Documentation IAW Development, Security, Operations (DevSecOps) Information Assurance (IA) System Checklist IAW PWS paragraph 5.2.3.

Due 60 days after the beginning of the option PoP and updated when new documents added throughout the PoP.

1001AL Monitoring Service Registry (MSR) Registration for the SSNR Web Application IAW PWS paragraph 5.3.

Due 60 days after the beginning of the option PoP.

1001AM Completion Report IAW PWS paragraph 5.3.

Due 60 days after the beginning of the option PoP and updated quarterly thereafter throughout the PoP.

1001AN Final Section 508 Compliance Test Results

IAW PWS paragraph 5.3.

Due 60 days after the beginning of the option PoP and updated thereafter when upgrade or changes to application completed

1001AP Database Management Support Activity Quarterly Report

IAW PWS paragraph 5.4

Due quarterly.

Electronic submission to: VA PM, COR, CO, System Steward

1 LO NSP NSP

1001AQ User Access and Help-Call Support Quarterly Report

IAW PWS paragraph 5.4

Due quarterly.

1001AR Quarterly System Troubleshooting Completion Report IAW PWS paragraph 5.4

Due quarterly.

1001AS Update User Manual

IAW PWS paragraph 5.4

Due within 10 days when there are routine or unanticipated changes to the User Manual in support of this Task Order.

1001AT Code and Upgrade SSNR Tool with Technical Reference Model (TRM) Compliant Technology IAW PWS paragraph 5.5

Due 60 days after the beginning of the option PoP and updated when TRM technology changes thereafter throughout the PoP.

1001AU Update SSNR tool with Veteran Health Administration (VHA) Facility Listing IAW PWS paragraph 5.5

Due 90 days after the beginning of the option PoP and updated if any VHA facility change thereafter throughout the PoP.

1001AV Updated Source Code IAW PWS paragraph 5.5

Due 60 days after the beginning of the option PoP and updated quarterly with any changes thereafter throughout the PoP.

OPTION PERIOD ONE TOTAL

OPTION PERIOD TWO

This option may be exercised in accordance with FAR 52.217-9, Option to Extend the Term of the Contract

Contracting Officer. If exercised, this option shall commence immediately after expiration of the Option Period One. The PoP shall be 12 months.

CLIN/

SLIN

DESCRIPTION/DELIVERABLE QTY UNIT UNIT PRICE TOTAL PRICE

2001 Social Security Number Reduction Tool (SNNR) and Database Management

IAW PWS paragraphs 5.1 through 5.5, including all subparagraphs.

FFP

This CLIN includes all labor, material, supplies, and any other costs required for successful completion for the services detailed in PWS paragraphs

5.1 inclusive of all subparagraphs, 2001AA Contractor Project Management Plan

2001AB Weekly Progress Report IAW PWS paragraph 5.1.2

2001AC Kickoff Meeting Presentation and Meeting Minutes IAW PWS paragraph 5.1.3

2001AD Authority To Operate (ATO) Implementation Plan IAW PWS paragraph 5.2.1 of the option PoP

2001AE ATO Security Documentation 1 LO NSP NSP

IAW PWS paragraph 5.2.1

Due 45 days after the beginning of the option PoP and updated when new

2001AF Test Scan Reports IAW PWS paragraph 5.2.2

Due 30 days prior to PoP end, and updated annually.

2001AG User Acceptance Testing (UAT) Test Case Scenarios and Test Scripts IAW PWS paragraph 5.2.2

Due 60 days after the beginning of the option PoP and updated when UATs implemented throughout the PoP.

2001AH UAT Reports IAW PWS paragraph 5.2.2.

Due 60 days after the beginning of the option PoP and updated quarterly thereafter throughout the PoP.

2001AJ Upgrade and Maintenance Report IAW PWS paragraph 5.2.2.

Due 60 days after the beginning of the option PoP and updated when upgrade implemented throughout the PoP.

2001AK ATO Documentation IAW Development, Security, Operations (DevSecOps) Information Assurance (IA) System Checklist IAW PWS paragraph 5.2.3.

Due 60 days after the beginning of the option PoP and updated when new documents added throughout the PoP.

2001AL Monitoring Service Registry (MSR) Registration for the SSNR Web Application IAW PWS paragraph 5.3.

Due 60 days after the beginning of the option PoP.

2001AM Completion Report IAW PWS paragraph 5.3.

Due 60 days after the beginning of the option PoP and updated quarterly thereafter throughout the PoP.

2001AN Final Section 508 Compliance Test Results

IAW PWS paragraph 5.3.

Due 60 days after the beginning of the option PoP and updated thereafter when upgrade or changes to application completed

2001AP Database Management Support Activity Quarterly Report

IAW PWS paragraph 5.4

Due quarterly.

Electronic submission to: VA PM, COR, CO, System Steward

1 LO NSP NSP

2001AQ User Access and Help-Call Support Quarterly Report

Due quarterly.

2001AR Quarterly System Troubleshooting Completion Report IAW PWS paragraph 5.4

Due quarterly.

2001AS Update User Manual

IAW PWS paragraph 5.4

Due within 10 days when there are routine or unanticipated changes to the User Manual in support of this Task Order.

2001AT Code and Upgrade SSNR Tool with Technical Reference Model (TRM) Compliant Technology IAW PWS paragraph 5.5

Due 60 days after the beginning of the option PoP and updated when TRM technology changes thereafter throughout the PoP.

2001AU Update SSNR tool with Veteran Health Administration (VHA) Facility Listing IAW PWS paragraph 5.5

Due 90 days after the beginning of the option PoP and updated if any VHA facility change thereafter throughout the PoP.

Electronic submission to: VA PM, COR, 2001AV Updated Source Code

Due 60 days after the beginning of the option PoP and updated quarterly with any changes thereafter throughout the PoP.

OPTION PERIOD TWO TOTAL

OPTION PERIOD THREE

This option may be exercised in accordance with FAR 52.217-9, Option to Extend the Term of the Contract

Contracting Officer. If exercised, this option shall commence immediately after expiration of Option Period Two. The PoP shall be 12 months.

CLIN/

SLIN

DESCRIPTION/DELIVERABLE QTY UNIT UNIT PRICE TOTAL PRICE

3001 Social Security Number Reduction Tool (SNNR) and Database Management

IAW PWS paragraphs 5.1 through 5.5, including all subparagraphs.

FFP

This CLIN includes all labor, material, supplies, and any other costs required for successful completion for the services detailed in PWS paragraphs

5.1 inclusive of all subparagraphs, 3001AA Contractor Project Management Plan

3001AB Weekly Progress Report IAW PWS paragraph 5.1.2

3001AC Kickoff Meeting Presentation and Meeting Minutes IAW PWS paragraph 5.1.3

3001AD Authority To Operate (ATO) Implementation Plan IAW PWS paragraph 5.2.1

3001AE ATO Security Documentation IAW PWS paragraph 5.2.1

Due 45 days after the beginning of the option PoP and updated when new

3001AF Test Scan Reports IAW PWS paragraph 5.2.2

Due 30 days prior to PoP end, and updated annually.

3001AG User Acceptance Testing (UAT) Test Case Scenarios and Test Scripts IAW PWS paragraph 5.2.2

Due 60 days after the beginning of the option PoP and updated when UATs implemented throughout the PoP.

3001AH UAT Reports IAW PWS paragraph 5.2.2.

Due 60 days after the beginning of the option PoP and updated quarterly thereafter throughout the PoP.

3001AJ Upgrade and Maintenance Report

Due 60 days after the beginning of the option PoP and updated when upgrade implemented throughout the PoP.

3001AK ATO Documentation IAW Development, Security, Operations (DevSecOps) Information Assurance (IA) System Checklist IAW PWS paragraph 5.2.3.

Due 60 days after the beginning of the option PoP and updated when new documents added throughout the PoP.

3001AL Monitoring Service Registry (MSR) Registration for the SSNR Web Application IAW PWS paragraph 5.3.

Due 60 days after the beginning of the option PoP.

3001AM Completion Report IAW PWS paragraph 5.3.

Due 60 days after the beginning of the option PoP and updated quarterly thereafter throughout the PoP.

3001AN Final Section 508 Compliance Test Results option PoP and updated thereafter when upgrade or changes to application completed

3001AP Database Management Support Activity Quarterly Report

IAW PWS paragraph 5.4

Due quarterly.

Electronic submission to: VA PM, COR, CO, System Steward

1 LO NSP NSP

3001AQ User Access and Help-Call Support Quarterly Report

IAW PWS paragraph 5.4

Due quarterly.

3001AR Quarterly System Troubleshooting Completion Report IAW PWS paragraph 5.4

Due quarterly.

3001AS Update User Manual

IAW PWS paragraph 5.4

Due within 10 days when there are routine or unanticipated changes to the User Manual in support of this Task Order.

3001AT Code and Upgrade SSNR Tool with Technical Reference Model (TRM) Compliant Technology option PoP and updated when TRM technology changes thereafter throughout the PoP.

3001AU Update SSNR tool with Veteran Health Administration (VHA) Facility Listing IAW PWS paragraph 5.5

Due 90 days after the beginning of the option PoP and updated if any VHA facility change thereafter throughout the PoP.

3001AV Updated Source Code IAW PWS paragraph 5.5

Due 60 days after the beginning of the option PoP and updated quarterly with any changes thereafter throughout the PoP.

OPTION PERIOD THREE TOTAL

OPTION PERIOD FOUR

This option may be exercised in accordance with FAR 52.217-9, Option to Extend the Term of the Contract

Contracting Officer. If exercised, this option shall commence immediately after expiration of Option Period Three. The PoP shall be 12 months.

CLIN/

SLIN

DESCRIPTION/DELIVERABLE QTY UNIT UNIT PRICE TOTAL PRICE

4001 Social Security Number Reduction Tool (SNNR) and Database Management

IAW PWS paragraphs 5.1 through 5.5, including all subparagraphs.

FFP

This CLIN includes all labor, material, supplies, and any other costs required for successful completion for the services detailed in PWS paragraphs

5.1 inclusive of all subparagraphs, 4001AA Contractor Project Management Plan

4001AB Weekly Progress Report IAW PWS paragraph 5.1.2

4001AC Kickoff Meeting Presentation and Meeting Minutes IAW PWS paragraph 5.1.3

4001AD Authority To Operate (ATO) Implementation Plan IAW PWS paragraph 5.2.1

4001AE ATO Security Documentation IAW PWS paragraph 5.2.1

Due 45 days after the beginning of the option PoP and updated when new

4001AF Test Scan Reports IAW PWS paragraph 5.2.2

Due 30 days prior to PoP end, and updated annually.

Electronic submission to: VA PM, COR, 4001AG User Acceptance Testing (UAT) Test

Case Scenarios and Test Scripts IAW PWS paragraph 5.2.2

Due 60 days after the beginning of the option PoP and updated when UATs implemented throughout the PoP.

4001AH UAT Reports IAW PWS paragraph 5.2.2.

Due 60 days after the beginning of the option PoP and updated quarterly thereafter throughout the PoP.

4001AJ Upgrade and Maintenance Report IAW PWS paragraph 5.2.2.

Due 60 days after the beginning of the option PoP and updated when upgrade implemented throughout the PoP.

4001AK ATO Documentation IAW Development, Security, Operations (DevSecOps) Information Assurance (IA) System Checklist IAW PWS paragraph 5.2.3.

Due 60 days after the beginning of the option PoP and updated when new documents added throughout the PoP.

4001AL Monitoring Service Registry (MSR) Registration for the SSNR Web Application IAW PWS paragraph 5.3.

option PoP.

4001AM Completion Report

Due 60 days after the beginning of the option PoP and updated quarterly thereafter throughout the PoP.

4001AN Final Section 508 Compliance Test Results

IAW PWS paragraph 5.3.

Due 60 days after the beginning of the option PoP and updated thereafter when upgrade or changes to application completed

4001AP Database Management Support Activity Quarterly Report

IAW PWS paragraph 5.4

Due quarterly.

Electronic submission to: VA PM, COR, CO, System Steward

1 LO NSP NSP

4001AQ User Access and Help-Call Support Quarterly Report

IAW PWS paragraph 5.4

Due quarterly.

4001AR Quarterly System Troubleshooting Completion Report IAW PWS paragraph 5.4

Due quarterly.

Electronic submission to: VA PM, COR, 4001AS Update User Manual

Due within 10 days when there are routine or unanticipated changes to the User Manual in support of this Task Order.

4001AT Code and Upgrade SSNR Tool with Technical Reference Model (TRM) Compliant Technology IAW PWS paragraph 5.5

Due 60 days after the beginning of the option PoP and updated when TRM technology changes thereafter throughout the PoP.

4001AU Update SSNR tool with Veteran Health Administration (VHA) Facility Listing IAW PWS paragraph 5.5

Due 90 days after the beginning of the option PoP and updated if any VHA facility change thereafter throughout the PoP.

4001AV Updated Source Code IAW PWS paragraph 5.5

Due 60 days after the beginning of the option PoP and updated quarterly with any changes thereafter throughout the PoP.

OPTION PERIOD FOUR TOTAL

Summary:

Base Period Total: $ Option Period One Total: $ Option Period Two Total: $

Option Period Three Total: $ Option Period Four Total: $

Grand Total: $

B.5 PERFORMANCE WORK STATEMENT

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

Office of Information and Technology

Office of Information Security, Information Security Operations VA Privacy Service

Social Security Number Reduction (SSNR) Tool & Database Management

Date: September 1, 2021

VA-21-00004967

PWS Version Number: 2.0

1.0 BACKGROUND

The use of Social Security Numbers (SSN) at Department of Veterans Affairs (VA) as a personal identifier, in most cases, are authorized by statute. Through this authorization, SSNs are commissioned in employment verification, taxation, Veterans’ benefits, and law enforcement. The increased availability of SSNs with the aggregation of other personal identifiers has exposed individuals to possible identity theft. Thus, VA has taken steps to reduce and, where possible, eliminate the use of the SSNs in VA operations, programs and services. Office of Management and Budget (OMB) Memorandum 07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, the Federal Information Security Act (FISMA), requires that VA establish short and long term plans to “eliminate the unnecessary collection and use of SSNs.”

VA published Directive 6507, Reducing the Use of Social Security Numbers, requiring Administrations and staff offices to conduct an inventory of the SSNs, in any form, including, but not limited to, truncated, masked, partially masked, encrypted, or disguised collections and uses thereof, and develop plans to reduce and/or eliminate SSN use. The SSN Reduction Tool adheres to this short-term requirement.

In 2018, the SSN Reduction (SSNR) Tool was developed by VA Privacy Service for use enterprise-wide and was hosted on a Contractor server. The SSNR tool operated with an approved Authority To Operate (ATO) and was in production with data collected on SSN usage across the VA. In September 2019, after expiration of the hosting contract, the SSNR Tool was migrated to the VA Enterprise Cloud (VAEC) with the requirement of a new ATO. The SSNR Tool application is currently in the process of obtaining the VAEC ATO to move into the implementation phase.

The SSNR tool was built using the following technologies but needs to be updated to newer versions to meet VA Technical Reference Model (TRM) requirements: Java 8;

SpringBoot 1.5; Angular 2 w/TypeScript and SQL Server. ; Gradle 3.1 (not used in production, this is just a build tool); Swagger 2.6.1 (API documentation software)

It is necessary to complete all steps to meet the requirements of obtaining the SSNR ATO and continued ATO and database management and maintenance including updating the application with technologies that are up-to-date, supported, and secure.

2.0 APPLICABLE DOCUMENTS

The Contractor shall comply with the following documents in the performance of this effort:

1. NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations, September 2011

2. VA Directive 6507, “Reducing the Use of Social Security Numbers”, November 20, 2008, http://www.va.gov/vapubs/

3. VA Directive 6500, VA Cybersecurity Program

4. VA Handbook 6300.4, “Procedures for Processing Requests for http://www.va.gov/vapubs/

Records Subject to the Privacy Act”, August 19, 2013, http://www.va.gov/vapubs/

5. VA Handbook 6300.5, “Procedures for Establishing and Maintaining Privacy Act Systems of Records”, August 03, 2017, http://www.va.gov/vapubs/

6. Social Security Number Fraud Prevention Act of 2017, Public Law No: 115-59 https://www.congress.gov/115/plaws/publ59/PLAW- 115publ59.pdf

7. Consolidated Appropriations Act, 2018 https://www.congress.gov/115/bills/hr1625/BILLS- 115hr1625enr.pdf

8. VA ATO Process for a cloud based system as follows (See SECTION D - Contract Documents, Exhibits, or Attachments):

• Cloud ATO Process - Explains how to get a VA ATO for a cloud-leveraged system. This document doesn't replace existing VA ATO process documentation but is meant to supplement it by explaining how the ATO process works with a cloud-leveraged system.

o Pre-Submission Checklist o Cloud Authority to Operate (ATO) Checklist - Cloud authorization checklist for deployments within the VAEC

The following templates include the VAEC information:

• AWS Incident Response Plan Associate Template

• AWS Disaster Recovery Plan Associate Template

• AWS Configuration Management Plan Associate Template

• AWS Information System Contingency Plan Associate Template

• Azure Incident Response Plan Associate Template

• Azure Disaster Recovery Plan Associate Template

• Azure Configuration Management Plan Associate Template

• Azure Information System Contingency Plan Associate Template

• ITOPS CP Test Script Template

• ITOPS DRP Test Script Template

• ITOPS Test Results Template

• ITOPS IRP Test Script Template

3.0 SCOPE OF WORK

The Contractor shall perform all functions to maintain the Authority To Operate (ATO) for the SSNR tool in the VAEC cloud based environment to include any and all ATO related requirements including code changes to enhance and upgrade the existing SSNR Tool to meet TRM requirements and for long-term sustainability and use; security and legal compliance; and the eventual collection, reduction and/or elimination of the use of SSNs in VA databases. The Contractor shall provide upgrades and maintenance of VAEC platform as needed in order to support functioning of the SSNR Tool. The Contractor shall also provide database management, troubleshooting, and user-support for VA officials utilizing the SSNR Tool.

http://www.va.gov/vapubs/ http://www.va.gov/vapubs/ https://www.congress.gov/115/plaws/publ59/PLAW-115publ59.pdf https://www.congress.gov/115/plaws/publ59/PLAW-115publ59.pdf https://www.congress.gov/115/bills/hr1625/BILLS-115hr1625enr.pdf https://www.congress.gov/115/bills/hr1625/BILLS-115hr1625enr.pdf https://vaww.portal.va.gov/sites/ECS/Shared%20Documents/Cloud%20101/ATO%20Cloud%20Security%20Process_Nov_19_2018_v2.0%20(004)%20signed.pdf https://vaww.portal.va.gov/sites/ECS/Shared%20Documents/Cloud%20101/Pre-Submission%20Checklist.pdf https://vaww.portal.va.gov/sites/ECS/Shared%20Documents/Cloud%20101/ATO%20Checklist.pdf https://vaww.portal.va.gov/sites/ECS/COMS/COMSExternal/VAEC%20Security%20ATO%20documents/Templates/AWS/VAEC%20AWS%20IRP%20Associate%2020JUN19.docx https://vaww.portal.va.gov/sites/ECS/COMS/COMSExternal/VAEC%20Security%20ATO%20documents/Templates/AWS/VAEC%20AWS%20DRP%20Associate%2020JUN19.docx https://vaww.portal.va.gov/sites/ECS/COMS/COMSExternal/VAEC%20Security%20ATO%20documents/Templates/AWS/VAEC%20AWS%20CMP%20Associate%2014JUN19.docx https://vaww.portal.va.gov/sites/ECS/COMS/COMSExternal/VAEC%20Security%20ATO%20documents/Templates/AWS/VAEC%20AWS%20ISCP%20Associate%2020JUN19.docx https://vaww.portal.va.gov/sites/ECS/COMS/COMSExternal/VAEC%20Security%20ATO%20documents/Templates/Azure/VAEC%20Azure%20IRP%20Associate%2020JUN19.docx https://vaww.portal.va.gov/sites/ECS/COMS/COMSExternal/VAEC%20Security%20ATO%20documents/Templates/Azure/VAEC%20Azure%20DRP%20Associate%2020JUN19.docx https://vaww.portal.va.gov/sites/ECS/COMS/COMSExternal/VAEC%20Security%20ATO%20documents/Templates/Azure/VAEC%20Azure%20CMP%20Associate%2014JUN19.docx https://vaww.portal.va.gov/sites/ECS/COMS/COMSExternal/VAEC%20Security%20ATO%20documents/Templates/Azure/VAEC%20Azure%20ISCP%20Associate%2020JUN19.docx https://vaww.portal.va.gov/sites/ECS/COMS/COMSExternal/VAEC%20Security%20ATO%20documents/Templates/ITOPS%20CP%20Test%20Script%20Template%202019.docx https://vaww.portal.va.gov/sites/ECS/COMS/COMSExternal/VAEC%20Security%20ATO%20documents/Templates/ITOPS%20DRP%20Test%20Script%20Template%202019.docx https://vaww.portal.va.gov/sites/ECS/COMS/COMSExternal/VAEC%20Security%20ATO%20documents/Templates/ITOPS%20Test%20Results%20Template%202019.docx https://vaww.portal.va.gov/sites/ECS/COMS/COMSExternal/VAEC%20Security%20ATO%20documents/Templates/ITOPS%20IRP%20Test%20Script%20Template%202019.doc

3.1 ORDER TYPE

The effort shall be proposed on a Firm Fixed Price (FFP) basis.

4.0 PERFORMANCE DETAILS

4.1 PERFORMANCE PERIOD

The period of performance (PoP) shall be a 12-month base period with four 12-month option periods.

4.2 PLACE OF PERFORMANCE

Efforts under this TO shall be performed at Contractor facilities or remotely; however, at any time, performance may change to VA facilities located in Washington, District of Columbia (DC) at 811 Vermont Avenue NW Washington, DC 20571. Work may be performed at remote locations with prior concurrence from the Contracting Officer’s Representative (COR). The COR and Contractor will coordinate the transition to VA facility.

The Contractor shall identify the Contractor’s place of performance in their Task Execution Plan submission.

4.3 TRAVEL OR SPECIAL REQUIREMENTS

The Government does not anticipate travel for this effort.

4.4 GOVERNMENT FURNISHED PROPERTY

The Government has multiple remote access solutions available to include Citrix Access Gateway (CAG), Site-to-Site Virtual Private Network (VPN), and RESCUE VPN.

The Government’s issuance of Government Furnished Equipment (GFE) is limited to Contractor personnel requiring direct access to the network to: development environments; install, configure and run Technical Reference Model (TRM) approved software and tools (e.g., Oracle, Fortify, Eclipse, SoapUI, WebLogic, LoadRunner);

upload/download/ manipulate code, run scripts, and apply patches; configure and change system settings; check logs, troubleshoot/debug, and test/QA.

When necessary, the Government will furnish desktops or laptops, for use by the Contractor to access VA networks, systems, or applications to meet the requirements of this PWS. The overarching goal is to determine the most cost-effective approach to providing needed access to the VA environment coupled with the need to ensure proper Change Management principles are followed. Contractor personnel shall adhere to all VA system access requirements for on- site and remote users in accordance with VA standards, local security regulations, policies and rules of behavior. GFE shall be approved by the COR and Program Manager on a case-by-case basis prior to issuance.

Based on the Government assessment of remote access solutions and the requirements of this TO, the Government estimates that the following GFE will be required by this TO:

1. Up to 6 standard laptops

The Government will not provide IT accessories including but not limited to Mobile Wi-Fi hotspots/wireless access points, additional or specialized keyboards or mice, laptop bags, extra charging cables, extra PIV readers, peripheral devices, additional RAM, etc.

The Contractor is responsible for providing these types of IT accessories in support of the TO as necessary and any VA installation required for these IT accessories shall be coordinated with the COR.

The Status of Government Furnished Equipment Report is applicable to this TO and shall be delivered to the COR/VA PM as required.

4.5 SECURITY AND PRIVACY

Specific TO requirements relating to Addendum B, Section B4.0 paragraphs j and k are as follows:

j. The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, based upon the severity of the incident.

k. When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes based upon the requirements identified within the TO.

4.6.1 POSITION/TASK RISK DESIGNATION LEVEL(S)

In accordance with VA Handbook 0710, Personnel Security and Suitability Program, the position sensitivity and the level of background investigation commensurate with the required level of access for the following tasks within the PWS are:

Position Sensitivity and Background Investigation Requirements by Task Task Number Tier1 / Low Risk Tier 2 / Moderate

Risk Tier 4 / High Risk

5.1 5.1.1 5.1.2 5.1.3 5.2

5.2.1 5.2.2 5.3 5.4 5.5 5.6

The Tasks identified above and the resulting Position Sensitivity and Background Investigation requirements identify, in effect, the Background Investigation requirements for Contractor individuals, based upon the tasks the particular Contractor individual will be working. The submitted Contractor Staff Roster must indicate the required Background Investigation Level for each Contractor individual based upon the tasks the Contractor individual will be working, in accordance with their submitted proposal.

5.0 SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

5.1 PROJECT MANAGEMENT

5.1.1 CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline and tools to be used in execution of this TO effort. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the TO.

The Contractor shall update and maintain the VA Program Manager (PM) approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

5.1.2 REPORTING REQUIREMENTS

The Contractor shall provide Weekly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding week.

The Weekly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The Contractor shall monitor performance against the CPMP and report any deviations. The Contractor shall keep in communication with VA so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

A. Weekly Progress Report

5.1.3 TECHNICAL KICK-OFF MEETING

A technical kickoff meeting shall be held within 10 days after award. The Contractor shall coordinate the date, time, and location (can be virtual) with the Contracting Officer (CO), as the Post-Award Conference Chairperson, the VA PM, as the Co-Chairperson, the

Contract Specialist (CS), and the COR. The Contractor shall provide a draft Agenda to the CO and VA PM at least five calendar days prior to the meeting. Upon Government approval of a final agenda, the Contractor shall distribute to all meeting attendees.

During the kickoff-meeting, the Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and project schedule for each effort via a Microsoft Office PowerPoint Presentation. At the conclusion of the meeting, the Contractor shall update the Presentation with a final slide which shall include notes on any major issues, agreements, or disagreements discussed during the kickoff meeting. The Contractor shall submit the final updated Presentation to the CO for review and signature within three calendar days after the meeting. The Contractor shall also work with the CS, the Government’s designated note taker, to prepare and distribute the Meeting Minutes of the kickoff meeting to the CO, COR and all attendees within three calendar days after the meeting.

Deliverable:

A. Kickoff Meeting Presentation and Meeting Minutes

5.2 SSNR Tool ATO Approval

The Contractor shall provide all technical, support services and steps necessary to sustain VA ATO for the SSNR tool which is currently housed in the VAEC Cloud and get it into implementation and production. The following includes but are not limited to the security and privacy requirements to be submitted as part of the ATO process maintenance:

5.2.1 ATO IMPLEMENTATION PLAN

The Contractor shall update and prepare an Implementation Plan to support the maintenance of the VA Privacy Controls and Overlay Compliance Program. The Contractor shall ensure this plan aligns with the VA Cyber and Privacy Strategy.

The Contractor shall prepare ATO - Security Documentation and testing as follows:

1. System Owner Responsibilities \ System Owner Attestation – The System Owner and Information System Security Officer (ISSO) (for the Attestation) will have to review and sign this document;

2. Configuration Management Plan (CMP) - identifies configuration management roles and responsibilities, resources, and processes to ensure any changes are evaluated and approved before implementation. There is a VAEC template available, which can be adjusted to reflect SSNR specific system;

3. Disaster Recovery Plan (DRP) - refers to measures to recover information system services to an alternate location after a disruption. Develop in conjunction with the hosting entity (in this case VAEC). Can use the VAEC DRP.

4. DRP Test – A document that test the DRP plan. Use much of the information from the ISCP and reference the VAEC DRP in this document. It will have to be a functional active test, not a tabletop;

5. Incident Response Plan (IRP) – used for rapidly detecting incidents, minimizing loss and destruction, mitigating weaknesses that were exploited, and restoring computing services;

6. Information System Contingency Plan (ISCP) - refers to interim measures to recover information system services after a disruption. Interim measures may include relocation of information systems and service to an alternate site. Plans are based upon current boundaries established by OIS. ISCP training will have to be completed for all participants involved with the ISCP.

7. ISCP Test – A document used to test the ISCP. This is a functional active testing exercise, not a tabletop;

8. Privacy Threshold Analysis (PTA)/Privacy Impact Assessment (PIA) – A PTA is required annually, a PIA does not apply to SSNR because there is no PII/PHI information.

9. Risk Assessment Report (RAR) - The RAR identifies, estimates, and prioritizes risk involved with organization operations. The RAR is generated within eMASS and utilizes the details provided on control risk, the 40 threats, and any ongoing or risk accepted Plan of Action and Milestones (POA&M) items. Generate this report after completion of the Risk Assessment and POA&Ms for the system.

10. System Security Plan (SSP) – This is another report that is generated in eMASS. This will be generated when the control selection and Implementation details are completed.

Deliverables:

A. ATO Implementation Plan B. ATO Security Documentation

5.2.2 TECHNICAL SCANS/TESTING REQUIREMENTS

The Contractor shall perform the following technical scans and testing requirements:

1. Nessus Scan - A credentialed Nessus vulnerability scan against all instances of the operating system and desktop configurations must be conducted to identify security flaws. This is a monthly requirement. Need to remediate vulnerabilities found within the given timeframes ( Critical – 30 days, High – 60 days, Medium – 90 days).

2. Database Scan – If the system uses a database, will have to run a database scan. This is an annual requirement.

3. Penetration Test/Application Assessment – Would need a Web Application Security Assessments (WASA). This is an annual requirement;

4. Application Security Testing - Application Security Testing is conducted during the development or maintenance of a VA application. Will need to register the application then perform a validation test on the custom code;

5. Application Threat Modeling - Application Threat Modeling is required for all custom developed systems/applications. Will have to use the latest Microsoft Threat Modeling Tool for this evaluation. Can also use a Sample VA application threat model as a template;

6. Security Configuration Compliance Data (SCCD) - All accreditation boundaries that contain an operating system are required to provide Security Configuration Compliance Data using BigFix. If no operating system within the SSNR system, will have to reevaluate.

7. VA User Acceptance Testing (UAT) - The Contractor shall facilitate VA User Acceptance Testing (UAT). The Contractor shall deploy the completed software solution to a 2-Factor authentication compliant, VAEC hosted environment, as well as potential future environments. The Contractor shall develop the UAT Test Scenarios, Test Cases, and Test Scripts necessary to test the functional requirements as specified within this PWS. The Contractor shall provide and input any sample data required by the system in order to complete the testing of the functional requirements. The Contractor shall track, resolve, and retest all defects found during UAT and provide updated software source code, compiled code, and software build instructions.

8. VAEC Platform Upgrade and maintenance - The Contractor shall upgrade and maintain the VAEC Cloud platform in order to facilitate appropriate functioning of the SSNR Tool.

A. Test Scan Reports for steps 1 – 6 B. UAT scenarios, Test cases and Test Script reports C. User Acceptance Testing reports D. Upgrade and Maintenance Report

5.2.3 AUTHORITY TO OPERATE (ATO)

The SSNR tool currently has a three year ATO. The Contractor shall provide all Assessment and Authorization (A&A) support required to achieve and maintain full A&A certification in compliance with the most current versions of VA Handbook 6500, VA Handbook 6500.6 (Section 3), and VA Handbook 6500.3. The A&A process is the end to end process for ensuring new VA information systems adhere to and are in compliance with Federal Information Security Management Act of 2002 (FISMA). The purpose of an ATO is to ensure the risks to VA (operations, assets, or individuals) are acceptable. The result is the issuance of an ATO. If the risk to Agency operations, assets or individuals are low, an ATO authorizes the system to be moved into production or use production data. The Contractor shall develop and submit all required security document artifacts as described in this PWS. VA requires an ATO for any device connected to the production network as well as the external hosting environment (VAEC). After ATO is achieved, the Contractor shall update and maintain documentation as required to ensure compliance. Also, in addition to the NIST 800-53 Rev 4/Rev 5 controls, the Contractor shall:

1. Perform bi-weekly reviews of Plan of Actions and Milestones (POA&M) with the VA PM/COR to ensure backlog is scheduled and prioritized for remediation, and to verify that defined milestones will be achieved.

2. Perform monthly reviews of Risk Based Decisions with the VA PM/COR to ensure remediation of outstanding risks or path forward is identified and achievable.

3. Support documentation of a Data Use and Reciprocal Support Agreement (DURSA)/Memorandum of Understanding (MOU)/Interconnection Support Agreement (ISA) between the hosting environment and VA, if applicable.

A. ATO Documentation based on DevSecOps Information Assurance (IA) System Checklist

5.3 SSNR WEB…