RFI Loopback - Cancer Registry Modernization (CRM) New Task Order (VA-24-00020603) |   2

Background
The Department of Veterans Affairs (VA) is seeking a contractor for the Cancer Registry Modernization (CRM) New Task Order (VA-24-00020603). The goal of the contract is to modernize the cancer registry system and ensure compliance with privacy and security regulations, including HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives. The contractor will be responsible for hosting, operating, maintaining, or using information systems on behalf of VA at non-VA facilities and ensuring compliance with various security and privacy requirements.

Work Details
The contractor is required to perform various tasks including ensuring the security of all procured or developed systems and technologies throughout the life of the contract. They should notify VA of any successful exploits of vulnerabilities within 24 hours, apply security fixes within specified timeframes, conduct compliant risk assessments, routine vulnerability scanning, system patching and change management procedures. Additionally, they are responsible for providing Privacy Impact Assessments (PIA) for each system hosted or operated on behalf of VA, ensuring compliance with the Federal Risk and Authorization Management Program (FedRAMP) for Cloud Services hosting, and adhering to FISMA, FIPS, and NIST standards related to annual security controls assessment. Furthermore, outsourcing of systems or network operations requires Assessment and Authorization (A&A) of the Contractor’s systems as per VA Handbook 6500.3.

Period of Performance
The period of performance for this contract is not explicitly provided in the solicitation document.