VA Data SaaS Contract Language.pdf

Software-as-a-Service (SaaS) Templated Language | VA Data

VA Data

Please insert the following language into the requirements section:

1.1 ASSESSMENT, AUTHORIZATION, AND CONTINUOUS MONITORING

1. The information system solution selected by the Contractor shall comply with the

Federal Information Security Management Act (FISMA).

2. The Contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement.

3. Following guidance from the Federal CIO, VA will utilize existing JAB ATO or agency ATO issued by another agency as a starting point for FedRAMP requirements. If neither of those exist, VA will sponsor FedRAMP ATO. VA will be using the FedRAMP baselines as a starting point, since they are specifically tailored for cloud services.

4. The Contractor shall, where applicable, assist with the VA ATO Process to help achieve agency authorization of the cloud service or migrated application.

5. The Contractor shall complete a FedRAMP System Security Plan (SSP) and supporting documentation within 30 days after contract award.

6. The Contractor shall complete a Third-Party Assessment Organization (3PAO) Security Assessment Plan (SAP) within 75 days after contract award.

7. The Contractor shall complete a 3PAO Security Assessment Report (SAR) within 90 days after contract award.

8. The Contractor shall afford VA access to the Contractor’s and Cloud Service Provider’s (CSP) facilities, installations, technical capabilities, operations, documentation, records, and databases.

9. If new or unanticipated threats or hazards are discovered by either VA or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party in accordance with the security addendum B.

10. The Contractor shall not release any data without the consent of VA in writing. All requests for release must be submitted in writing to the Contracting Officer’s Representative (COR)/Contracting Officer (CO).

11. In order for live VA data to be used in this system, a FedRAMP Authorization and Agency ATO will be required.

Deliverables:

A. FedRAMP System Security Plan (SSP) and supporting documentation B. 3PAO Security Assessment Plan (SAP) C. 3PAO Security Assessment Report (SAR) https://www.fedramp.gov/agency-authorization/

Software-as-a-Service (SaaS) Templated Language | VA Data

Phase-Out Plan (Decommission):

The Contractor shall develop a Phase-Out Plan, which addresses the following:

(1) The Contractor shall provide an overall plan describing the specifics for the phase-out. All deployment actions shall be completed prior to the expiration or termination date of the contract. The Phase-Out Deployment Plan shall address the following areas:

i. An inventory and deployment of historical data.

ii. Techniques for ensuring that all retrieved data supplied is provided in the original or other VA agreed-upon format

iii. Provide procedures used to migrate all VA endpoints to the VAEC.

iv. Provide procedures to migrate/recreate all server settings, policies, profiles, communication channel, compliance settings

(2) Plan for ensuring that, prior to termination or completion of this effort, the

Contractor/Subcontractor does not destroy any information in any form received from VA, or gathered/created by the Contractor in the course of performing this effort without prior written approval by VA PM/COR. Any data destruction done on behalf of VA by a Contractor/Subcontractor must be done IAW National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization.

(3) Providing an orientation phase to introduce the successor (FCSP) personnel, programs, and users to the incoming team, explaining tools, methodologies, and business processes.

(4) Providing the Contractor’s strategy and planned approach for personnel staffing and training during the transition period to a new provider shall begin as soon as deployment notification is conveyed.

(5) Providing a Phase-Out Deployment Checklist (Contractor format).

(6) Providing signed turnover agreements in the designated format.

(7) The Contractor shall coordinate with the PM/COR during the last 60 calendar days of the effort to transition all environments, applications, configurations and data residing on the VAEC to VA or VA designated site.

(8) The Contractor shall provide copies of data from all enclaves in a format that is exportable by Contractor and importable by VA and partners at the replacement site in Secure Export Data Files.

(9) The Contractor shall deliver white glove transfer of any existing artifacts.

(10) Step-by-step instructions for installation of the most current and up-to-date applications and data in the VAEC.

Deliverables:

A. Phase-Out Plan B. Secure Export Data Files Plan

Ackermann, Herbert I don’t think we need this here… to much info.. what do you all think?

Ackermann, Herbert Is this applicable?

Ackermann, Herbert Do we need this?

1.1 ASSESSMENT, AUTHORIZATION, and CONTINUOUS MONITORING