OPAL Tier 1 Acquisition Business Systems Support Services

Background
The solicitation is for OPAL Tier 1 Acquisition Business Systems Support Services. The contractor is required to perform various tasks related to the design, development, and operation of systems of records (SOR) on individuals that are subject to the Privacy Act. The contract also includes provisions for ensuring the security of all procured or developed systems and technologies throughout the life of the contract and any extension, warranty, or maintenance periods. Additionally, it outlines requirements for notifying VA of successful exploits of vulnerabilities, applying security fixes within specified timeframes, and remediating vulnerabilities in a timely manner based on risk.

Work Details
The work includes performing activities associated with maintaining systems of records, ensuring the security of procured or developed systems and technologies, notifying VA of successful exploits of vulnerabilities, applying security fixes within specified timeframes, and remediating vulnerabilities in a timely manner based on risk. It also involves hosting, operating, maintaining, or using information systems on behalf of VA at non-VA facilities, ensuring compliance with HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. Additionally, it requires conducting compliant risk assessments, routine vulnerability scanning, system patching and change management procedures, completion of an acceptable contingency plan for each system hosted at non-VA facilities. The contractor's security control procedures must be equivalent to those used to secure VA systems. Furthermore, it involves providing a Privacy Impact Assessment (PIA) to the COR and approved by VA Privacy Service prior to operational approval. All external Internet connections to VA network involving VA information must adhere to the TIC Reference Architecture and be reviewed and approved by VA prior to implementation. For Cloud Services hosting, the Contractor shall ensure compliance with the Federal Risk and Authorization Management Program (FedRAMP). Adequate security controls for collecting, processing, transmitting, and storing Personally Identifiable Information (PII) must be in place as determined by the VA Privacy Service. Outsourcing of systems or network operations requires A&A of the Contractor’s systems as per VA Handbook 6500.3.