Clarksville, TN OPC Amendment #3 FSL 2 258, 210 ANSI/BOMA

Background
The solicitation is for X1DA--Clarksville, TN OPC Amendment #3 FSL 2 258,210 ANSI/BOMA. The contract requires ensuring that contractors, third party partners, and servicers implement the VA security and privacy requirements as defined in the contract. It also involves ensuring that contractor systems storing, generating, transmitting, or exchanging VA sensitive information are certified and accredited and registered and monitored in VA’s Security Management and Reporting Tool (SMART) database. Additionally, it requires monitoring compliance with the contract or agreement security requirements throughout the life of the contract.

Work Details
(4) Ensure that contractors, third party partners, and servicers implement the VA security and privacy requirements as defined in the contract. These requirements can also be added to the contract Statement of Work (SOW). The requirements apply to applicable contracts in which VA sensitive information is stored, generated, transmitted, or exchanged by VA, a contractor, subcontractor or a third-party, or on behalf of any of these entities regardless of format or whether it resides on a VA system or contractor or subcontractor’s electronic information system(s) operating for or on the VA’s behalf.
(5) Ensure that contractor systems that have negotiated with VA to store, generate, transmit, or exchange VA sensitive information in a contractor developed and maintained system are certified and accredited (authorized), and registered and monitored in VA’s Security Management and Reporting Tool (SMART) database that monitors FISMA compliance. The Program Manager and/or the ISO is responsible for contacting the Information Protection and Risk Management’s (IPRM) Certification Program Office (CPO) within OI&T to register the system or to answer questions regarding the authorization of systems.
(6) Ensure that Certification and Accreditation (Authorization) (C&A), is accomplished in compliance with VA policy (per the results of the completed checklist provided in Appendix A) and VA Handbook 6500.3, Certification and Accreditation of VA Information Systems. The OI&T CPO within the Office of Cyber Security (OCS) must be contacted regarding procedures for C&A (Authorization) of contractor managed systems.
(7) Ensure that the Program Manager, the COTR and the CO, with the assistance of the ISO, monitor compliance with the contract or agreement security requirements throughout the life of the contract. For IT systems, this includes ensuring that annual self-assessments are conducted by the contractor with appropriate Plan of Actions and Milestones (POA&M) initiated and completed.

Place of Performance
The geographic location(s) for performance is Clarksville, TN.