Loren Data's SAM Daily™

SAMDAILY.US - ISSUE OF SEPTEMBER 21, 2024 SAM #8334
SOURCES SOUGHT

J -- V20 Radimetrics Support

Notice Date

9/19/2024 1:55:27 PM
 

Notice Type

Sources Sought
 

NAICS

541512 — Computer Systems Design Services
 

Contracting Office

260-NETWORK CONTRACT OFFICE 20 (36C260) VANCOUVER WA 98662 USA
 

ZIP Code

98662
 

Solicitation Number

36C26024Q0960
 

Response Due

9/26/2024 3:00:00 PM
 

Archive Date

10/26/2024
 

Point of Contact

Nazanin Kreiner, Contract Specialist, Phone: (208) 429-2033
 

E-Mail Address

nazanin.kreiner@va.gov
(nazanin.kreiner@va.gov)
 

Awardee

null
 

Description

THIS IS A SOURCES SOUGHT NOTICE ONLY. This is not a solicitation for bids, proposals, proposal abstracts, or quotations. The purpose of this Sources Sought Notice is to obtain information regarding the availability and capability of all qualified sources to perform a potential requirement. The responses received from interested contractors will assist the Government in determining the appropriate acquisition method. The Department of Veterans Affairs (VA), Network Contracting Office (NCO) 20, is conducting market research to identify potential sources which can provide the following in support of the Veterans Integrated Service Network (VISN) 20 which is responsible for providing health care to Veterans in the states of Alaska, Washington, Oregon, and most of the state of Idaho: VISN 20 has a need for software support for the Radimetrics systems implemented in VISN 20. Support includes software support and upgrades and professional support (e.g., troubleshooting and problem resolution) as detailed below. PERFORMANCE WORK STATEMENT RADIMETRICS SUPPORT VISN 20 Contract Title. VISN 20 Radimetrics Support Background. The VA Northwest Health Network, Veterans Integrated Service Network (VISN) 20, is responsible for providing health care to Veterans in the states of Alaska, Washington, Oregon, most of the state of Idaho, and one county each in Montana and California. VISN 20 encompasses 135 counties which cover approximately 23% of the United States land mass; 17% of which are classified as health professional shortage areas. 67% of these same counties had a 2001 per capita income below $25,000. There are approximately 1.2 million Veterans living in the Pacific Northwest and Alaska, 18% of whom received VA services. A basic tenet of x-ray-based medical imaging is to use radiation in an as low as reasonably achievable (ALARA) amount while maintaining high quality images. In order to manage patient radiation doses, VISN 20 procured the Bayer Radimetrics system. Radimetrics monitors and manages radiation dose and contrast media dose allowing radiologists the ability to track x-ray dose across patients, for individual exams and cumulative dose; and track radiation dose from x-ray-based imaging modalities (e.g., CT scanners, fluoroscopy systems); and within and across various imaging protocols. Radiation-based imaging is an effective tool that can save lives. However, the higher the dose of radiation delivered at any one time, the higher the risk for long-term problems such as cancer. If a patient receives repeated doses, harm can also occur due to the cumulative effect of those multiple doses over time. Conversely, using insufficient radiation may increase the risk of misdiagnosis, delayed treatment, or, if the initial test is inadequate, repeat testing with the attendant exposure to even more radiation. One study (reference 1) estimated that of the 74 million CT scans performed in the US in 2017, 29,000 future cancers and 14,500 future deaths could develop due to radiation. This and similar studies highlight the need to maintain radiation doses as low as reasonably achievable while still obtaining the needed diagnostic information and therapeutic results. Patients most prone to harm from diagnostic radiation are children and young adults; pregnant women; individuals with medical conditions sensitive to radiation, such as diabetes mellitus and hyperthyroidism; and individuals receiving multiple doses over time. The imaging procedures most commonly associated with the potential for reducing radiation doses are CT, nuclear medicine and fluoroscopy. Radimetrics is a tool to help healthcare delivery organizations assure radiation doses are as low as possible while achieving the purposes of the imaging study. It provides several features including: Reducing repetitive, manual documentation, and dictation of dose information for more efficient radiology workflows; Faster reporting of radiation dose information via automatic outbound interfaces to PACS, RIS, and Speech Reporting systems; Establishing institutional, enterprise-wide dose ranges for studies; and Evaluating dose outcomes and linking them to technical factors, protocols, technologists, and equipment. These features improve patient safety and imaging department efficiency while helping to maintain high image quality. This procurement is to provide software support for the Radimetrics systems implemented in VISN 20. Support includes software support and upgrades and professional support (e.g., troubleshooting and problem resolution) as detailed below. Reference 1: https://www.jointcommission.org/resources/sentinel-event/sentinel-event-alert-newsletters/sentinel-event-alert-issue-47-radiation-risks-of-diagnostic-imaging-and-fluoroscopy/ Scope. VA intends to procure and renew annual support for the Radimetrics systems at the following seven (7) sites within VISN 20: Portland, Puget Sound, Roseburg, Spokane, Boise, Walla Walla, and White City. Radimetrics is currently implemented at Portland, Spokane, Seattle, Boise, and White City and expected to be implemented at the remaining sites (Walla Walla and Roseburg) during the first year of this procurement. Support includes software updates, troubleshooting, problem resolution, remote training and other remote support services. Requirements. The following support services are to be provided by the contractor: Contractor shall provide VA with telephone access, as outlined herein, to technical experts for technical assistance and error correction. Contractor shall provide services of a qualified Bayer Radimetrics representative to complete corrective actions which may consist of providing problem correction(s) and/or workaround solution(s). For purposes of this Agreement, Update shall mean a new update, modification, enhancement, or correction to the Licensed Software or Documentation that improves the performance of the Licensed Software and that is generally made available by Bayer from time to time as an entitlement of this Agreement. Updates may also include more current versions of existing third-party software, or new third-party software each provided by Bayer ( Bayer Provided Third Party Software ) that are required to enable the Licensed Software to perform as intended. Bayer Provided Third Party Software will be provided on an as is basis and Bayer does not warrant that Bayer Provided Third Party Software will be error free or operate without interruption. The parties agree that Updates will not include any new commercially available product, which will possess a discernible and significant difference in intended use and functionality when compared to the Licensed Software, and that Bayer licenses and prices separately from the Licensed Software or for which Bayer generally charges additional fees to its customers receiving Maintenance and Support Services. Bayer may, in its sole and absolute discretion, include in Updates or other products certain features or functionality suggested or requested by or on behalf of VA at any time, including any customizations or modifications that may be required during the installation of the Licensed Software pursuant to this Agreement that Bayer agrees to perform, and Bayer will exclusively own all such features and functionality and may provide them to other customers with or without charge, without any compensation due to VA, unless otherwise specifically agreed in writing between the Parties. Updates may include additional remote training or new self-help tools on the myRadiologySolutions portal. Unless indicated otherwise by Bayer all training services for an Update project will be provided from a remote location and any on-site training requested by VA will be a Billable Professional Service. Maintenance and Support Services Response Times Table 1: Maintenance and Support Services Response Times Priority Hours Available Response Times Critical Error * 24 x 7 Within 2-4 hours Technical Assistance and Non-Critical Errors 8-5, M-F, Local time Within 1 2 business days Critical Error means an Error which results in the Licensed Software being entirely inoperable due to a fault in the Licensed Software. Contractor will provide VA with telephone, email, and access to the myRadiologySolutions portal to request Technical Assistance and Error Correction as follows: US Support staff: Only US-based Tier 1, Tier 2, and Tier 3 Contractor Support staff ( US Support Staff ) will be able to initiate a remote connection to the Licensed Software.  US Support Staff will undergo pre-employment background checks, annual training, and will be certified to provide Services to the VA.  Although Tier 3 US Support Staff will be used whenever possible, Tier 3 Support may be required from Contractor staff based outside of the US ( Non-US Support Staff ).  In this scenario, Contractor will advise the VA of the participation of Non-US Support Staff and the VA may accept or decline their participation.   Contractor Support staff may encounter VA data transmitted by the Licensed Software as streamed images in the process of providing Maintenance and Support Services. VA data may include images of diagnostic data, error messages, and service status ( Support Data ).  VA data may also include images of log files, DICOM files, or images from the application user interface depicting patient data containing protected health information ( VA PHI ).   Only US Support Staff will access VA systems via the VA-approved VPN to provide remote support. For the purposes of providing Professional Services hereunder the Contractor standard used for remote support will be VA-approved VPN. Contractor will follow a defined process to initiate Error Correction with the VA, to establish remote access with the Licensed Software, to complete diagnostic and FboNotice cause analysis, to make changes to the Licensed Software or configuration settings, to test and validate Error Correction, and to confirm completion of Error Correction with VA at the conclusion of a support session (collectively Change Control Process ). VA is responsible for the following in support of this agreement: VA will make available a suitably qualified contact person who is knowledgeable of each error/problem reported to Bayer and who is available for discussion, and able to coordinate remote access to the server hosting the licensed software. VA will use reasonable efforts to submit and track all support requests. VA shall permit Contractor to gain remote access to the Licensed Software, to install software and make changes to the Licensed Software that are required to provide Error Correction. Contractor shall continue efforts to provide Error Correction only when these requirements have been met. VA will promptly install, or at a mutually agreed upon time agree to install, or permit Contractor to install, each Update provided by Bayer. Period of Performance. The base period of performance per site is indicated in Table 2. Then period of performance is four (4) additional twelve (12) month option periods for all sites. Table 2: Period of Performance Contract Period and Site Period of Performance Base Year: Puget Sound 13 June 2025 5 December 2025 Base Year: Spokane 6 December 2024 5 December 2025 Base Year: Portland 6 December 2024 5 December 2025 Base Year: White City 18 July 2024 2025 5 December 2025 Base Year: Boise 1 September 2025 - 5 December 2025 Base Year: Walla Walla 1 September 2025 - 5 December 2025 Base Year: Roseburg 1 September 2025 - 5 December 2025 Base Year: Portland 6 December 2024 5 December 2025 Option Year One (1) all sites 6 December 2025 5 December 2026 Option Year Two (2) all sites 6 December 2026 5 December 2027 Option Year Three (3) all sites 6 December 2027 5 December 2028 Option Year Four (4) all sites 6 December 2028 5 December 2029 Place of Performance. Contract performance shall take place at the contractor s location(s). Contractor travel or on-site support is NOT included in this agreement and, if needed, will require a separate agreement and will be billed separately. Table 3: VISN 20 Facility Locations Facility (VAMC/HCS) Address Boise VA Medical Center 500 Fort Street Boise, ID 83702 Roseburg Healthcare System Roseburg VA Medical Center 913 NW Garden Valley Blvd Roseburg, OR 97471 Portland Healthcare System Portland Campus 3710 SW US Veterans Hospital Road Portland, OR 97239-2999 VA Puget Sound Health Care System 1660 South Columbian Way Seattle, WA 98108-1597 Walla Walla Jonathan M. Wainwright Memorial VA Medical Center 77 Wainwright Drive Walla Walla, WA 99362 VA Spokane Medical Center N. 4815 Assembly Street Spokane, WA 99205 VA Southern Oregon Rehabilitation Center and Clinics 8495 Crater Lake Highway White City, OR 97503 Invoicing. Invoices shall be submitted electronically via the Financial Services Center Mandatory Electronic Invoice System, on a monthly basis for implementation tasks and an annual basis for license and maintenance tasks. Invoices must include, at a minimum, the following information: Contractor name, purchase order number, period of service the billing covers, and a list of equipment items covered during the stated period of performance. This requirement is in accordance with VARR Clause 852.232-72 Electronic Submission of Payment Requests: http://www.fsc.va.gov/einvoice.asp. Electronic payments are net 30 days. Hours of Coverage. Critical problem support will be provided 24 x 7. Non-Critical Services will be provided during Standard Hours, Monday through Friday, 8:00AM - 5:00PM, Local Time. Security Requirements. All contractor employees are subject to the same level of investigation as VA employees who have access to VA sensitive information or access to VA facilities. The background investigation includes the following requirements: 1) Completed documentation 2) Fingerprints 3) Completion of OPM s e-QIP Questionnaire. The Contractor is required to fulfill all of the security requirements. The Contractor, upon completion of fingerprinting, and an initial suitability determination, may be authorized tentative access to start the performance period of the contract, but only on condition of completion of all security requirements. This requirement is applicable to all subcontractor personnel requiring the same access. Access to VA Information and VA Information Systems. A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor. The contractor or subcontractor must notify the Contracting Officer immediately when an employee working on a VA system or with access to VA information is reassigned or leaves the contractor or subcontractor's employ. The Contracting Officer must also be notified immediately by the contractor or subcontractor prior to an unfriendly termination. VA Information Custodial Language Information made available to the contractor or subcontractor by VA for the performance or administration of this contract or information developed by the contractor/subcontractor in performance or administration of the contract shall be used only for those purposes and shall not be used in any other way without the prior written agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1). VA information should not be co-mingled, if possible, with any other data on the contractors/subcontractor's information systems or media storage systems in order to ensure VA requirements related to data protection and media sanitization can be met. If co-mingling must be allowed to meet the requirements of the business need, the contractor must ensure that VA's information is returned to the VA or destroyed in accordance with VA's sanitization requirements. VA reserves the right to conduct on site inspections of contractor and subcontractor IT resources to ensure data security controls, separation of data and job duties, and destruction/media sanitization procedures are in compliance with VA directive requirements. Prior to termination or completion of this contract, contractor/ subcontractor must not destroy information received from VA, or gathered/ created by the contractor in the course of performing this contract without prior written approval by the VA. Any data destruction done on behalf of VA by a contractor/subcontractor must be done in accordance with National Archives and Records Administration (NARA) requirements as outlined in VA Directive 6300, Records and Information Management and its Handbook 6300.1 Records Management Procedures, applicable VA Records Control Schedules, and VA Handbook 6500.1, Electronic Media Sanitization. Self-certification by the contractor that the data destruction requirements above have been met must be sent to the VA Contracting Officer within 30 days of termination of the contract. The contractor/subcontractor must receive, gather, store, back up, maintain, use, disclose and dispose of VA information only in compliance with the terms of the contract and applicable Federal and VA information confidentiality and security laws, regulations and policies. If Federal or VA information confidentiality and security laws, regulations and policies become applicable to the VA information or information systems after execution of the contract, or if NIST issues or updates applicable FIPS or Special Publications (SP) after execution of this contract, the parties agree to negotiate in good faith to implement the information confidentiality and security laws, regulations and policies in this contract. The contractor/subcontractor shall not make copies of VA information except as authorized and necessary to perform the terms of the agreement or to preserve electronic information stored on contractor/subcontractor electronic storage media for restoration in case any electronic equipment or data used by the contractor/subcontractor needs to be restored to an operating state. If copies are made for restoration purposes, after the restoration is complete, the copies must be appropriately destroyed. If VA determines that the contractor has violated any of the information confidentiality, privacy, and security provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisition Regulation (FAR) part 12. If a VHA contract is terminated for cause, the associated BAA must also be terminated and appropriate actions taken in accordance with VHA Handbook 1600.01, Business Associate Agreements. Absent an agreement to use or disclose protected health information, there is no business associate relationship. The contractor/subcontractor must store, transport, or transmit VA sensitive information in an encrypted form, using VA-approved encryption tools that are, at a minimum, FIPS 140-2 validated. The contractor/subcontractor's firewall and Web services security controls, if applicable, shall meet or exceed VA's minimum requirements. VA Configuration Guidelines are available upon request. Except for uses and disclosures of VA information authorized by this contract for performance of the contract, the contractor/subcontractor may use and disclose VA information only in two other situations: (i) in response to a qualifying order of a court of competent jurisdiction, or (ii) with VA's prior written approval. The contractor/subcontractor must refer all requests for, demands for production of, or inquiries about, VA information and information systems to the VA contracting officer for response. Notwithstanding the provision above, the contractor/subcontractor shall not release VA records protected by Title 38 U.S.C. 5705, confidentiality of medical quality assurance records and/or Title 38 U.S.C. 7332, confidentiality of certain health records pertaining to drug addiction, sickle cell anemia, alcoholism or alcohol abuse, or infection with human immunodeficiency virus. If the contractor/subcontractor is in receipt of a court order or other requests for the above mentioned information, that contractor/subcontractor shall immediately refer such court orders or other requests to the VA contracting officer for response. For service that involves the storage, generating, transmitting, or exchanging of VA sensitive information but does not require C&A or an MOU-ISA for system interconnection, the contractor/subcontractor must complete a Contractor Security Control Assessment (CSCA) on a yearly basis and provide it to the COR. Information System Design and Development. Information systems that are designed or developed for or on behalf of VA at non-VA facilities shall comply with all VA directives developed in accordance with FISMA, HIPAA, NIST, and related VA security and privacy control requirements for Federal information systems. This includes standards for the protection of electronic PHI, outlined in 45 C.F.R. Part 164, Subpart C, information and system security categorization level designations in accordance with FIPS 199 and FIPS 200 with implementation of all baseline security controls commensurate with the FIPS 199 system security categorization (reference Appendix D of VA Handbook 6500, VA Information Security Program). During the development cycle a Privacy Impact Assessment (PIA) must be completed, provided to the COR, and approved by the VA Privacy Service in accordance with Directive 6507, VA Privacy Impact Assessment. The contractor/subcontractor shall certify to the COR that applications are fully functional and operate correctly as intended on systems using the VA Federal Desktop Core Configuration (FDCC), and the common security configuration guidelines provided by NIST or the VA. This includes Internet Explorer 7 configured to operate on Windows XP and Vista (in Protected Mode on Vista) and future versions, as required. The standard installation, operation, maintenance, updating, and patching of software shall not alter the configuration settings from the VA approved and FDCC configuration. Information technology staff must also use the Windows Installer Service for installation to the default ""program files"" directory and silently install and uninstall. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges. The security controls must be designed, developed, approved by VA, and implemented in accordance with the provisions of VA security system development life cycle as outlined in NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems, VA Handbook 6500, Information Security Program and VA Handbook 6500.5, Incorporating Security and Privacy in System Development Lifecycle. The contractor/subcontractor is required to design, develop, or operate a System of Records Notice (SOR) on individuals to accomplish an agency function subject to the Privacy Act of 1974, (as amended), Public Law 93-579, December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Privacy Act may involve the imposition of criminal and civil penalties. The contractor/subcontractor agrees to: Comply with the Privacy Act of 1974 (the Act) and the agency rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies: The Systems of Records (SOR); and The design, development, or operation work that the contractor/ subcontractor is to perform; Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, or operation of a SOR on individuals that is subject to the Privacy Act; and Include this Privacy Act clause, including this subparagraph (3), in all subcontracts awarded under this contract which requires the design, development, or operation of such a SOR. In the event of violations of the Act, a civil action may be brought against the agency involved when the violation concerns the design, development, or operation of a SOR on individuals to accomplish an agency function, and criminal penalties may be imposed upon the officers or employees of the agency when the violation concerns the operation of a SOR on individuals to accomplish an agency function. For purposes of the Act, when the contract is for the operation of a SOR on individuals to accomplish an agency function, the contractor/subcontractor is considered to be an employee of the agency. ""Operation of a System of Records"" means performance of any of the activities associated with maintaining the SOR, including the collection, use, maintenance, and dissemination of records. ""Record"" means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and contains the person's name, or identifying number, symbol, or any other identifying particular assigned to the individual, such as a fingerprint or ""System of Records"" means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual. The vendor shall ensure the security of all procured or developed systems and technologies, including their subcomponents (hereinafter referred to as ""Systems""), throughout the life of this contract and any extension, warranty, or maintenance periods. This includes, but is not limited to workarounds, patches, hotfixes, upgrades, and any physical components (hereafter referred to as Security Fixes) which may be necessary to fix all security vulnerabilities published or known to the vendor anywhere in the Systems, including Operating Systems and firmware. The vendor shall ensure that Security Fixes shall not negatively impact the Systems. The vendor shall notify VA within 24 hours of the discovery or disclosure of successful exploits of the vulnerability which can compromise the security of the Systems (including the confidentiality or integrity of its data and operations, or the availability of the system). Such issues shall be remediated as quickly as is practical, but in no event longer than 3 days. When the Security Fixes involve installing third party patches (such as Microsoft OS patches or Adobe Acrobat), the vendor will provide written notice to the VA that the patch has been validated as not affecting the Systems within 10 working days. When the vendor is responsible for operations or maintenance of the Systems, they shall apply the Security Fixes within 3 days. All other vulnerabilities shall be remediated as specified in this paragraph in a timely manner based on risk, but within 60 days of discovery or disclosure. Exceptions to this paragraph (e.g. for the convenience of VA) shall only be granted with approval of the contracting officer and the VA Assistant Secretary for Office of Information and Technology. 13. Information System Hosting, Operation, Maintenance, or Use 13.1 For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, contractors/subcontractors are fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerablity scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The contractor's security control procedures must be equivalent, to those procedures used to secure VA systems. APrivacy Impact Assessment (PIA) must also be provided to the COR and approved by VA Privacy Service prior to operational approval. All external Internet connections to VA's network involving VA information must be reviewed and approved by VA prior to implementation. 13.2 Adequate security controls for collecting, processing, transmitting, and storing of Personally Identifiable Information (PII), as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls are to be assessed and stated within the PIA and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII. 13.3 Outsourcing (contractor facility, contractor equipment or contractor staff) of systems or network operations, telecommunications services, or other managed services requires certification and accreditation (authorization) (C&A) of the contractor's systems in accordance with VA Handbook 6500.3, 13.4 Certification and Accreditation and/or the VA OCS Certification Program Office. Government- owned (government facility or government equipment) contractor-operated systems, third party or business partner networks require memorandums of understanding and interconnection agreements (MOU-ISA) which detail what data types are shared, who has access, and the appropriate level of security controls for all systems connected to VA networks. 13.5 The contractor/subcontractor's system must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the PIA. Any deficiencies noted during this assessment must be provided to the VA contracting officer and the ISO for entry into VA's POA&M management process. The contractor/subcontractor must use VA's POA&M process to document planned remedial act...
 

Web Link

SAM.gov Permalink
(https://sam.gov/opp/c281591fc8ae413ea1df3cca6dd978dc/view)
 

Place of Performance

Address: Department of Veteran Affairs VISN 20 Multiple Sites, see SOW for details 1601 E Fourth Plain Blvd, Vancouver 98661, USA

Zip Code: 98661

Country: USA
 

Record

SN07218579-F 20240921/240919230130 (samdaily.us)
 

Source

SAM.gov Link to This Notice
(may not be valid after Archive Date)

---

| FSG Index  |  This Issue's Index  |  Today's SAM Daily Index Page |