Loren Data's SAM Daily™

SAMDAILY.US - ISSUE OF SEPTEMBER 10, 2022 SAM #7589
SOURCES SOUGHT

Q -- Pharmacy-USP 797/800 Testing

Notice Date

9/8/2022 7:31:19 AM
 

Notice Type

Sources Sought
 

NAICS

325412 — Pharmaceutical Preparation Manufacturing
 

Contracting Office

257-NETWORK CONTRACT OFFICE 17 (36C257) ARLINGTON TX 76006 USA
 

ZIP Code

76006
 

Solicitation Number

36C25722Q1155
 

Response Due

9/12/2022 6:00:00 AM
 

Archive Date

09/17/2022
 

Point of Contact

Dr. Vinicky Ann Ervin Ph.D., Contract Specialist, Phone: 210-694-6306, Fax: Questions will be address via email only
 

E-Mail Address

vinicky.ervin@va.gov
(vinicky.ervin@va.gov)
 

Awardee

null
 

Description

Department of Veterans Affairs Veterans Health Administration (VHA) Sources Sought Notice Obtain sterile compounding testing. This is a Sources Sought notice and not a request for quotes. This request is solely for the purpose of conducting market research to enhance VHA s understanding of your company s offered services and capabilities. The Government will not pay any costs for responses submitted in response to this Source Sought Notice. This Sources Sought notice provides an opportunity for respondents to submit their capability and availability to provide the service requirement described below. Vendors are being invited to submit information relative to their potential to fulfill this requirement, in the form of a capability response that addresses the specific requirement identified in this Sources Sought. This Sources Sought is to facilitate the Contracting Officer s review of the market base, for acquisition planning, size determination, and procurement strategy. General Requirements: Brand name or equal sterile compounding testing is needed for the Temple, TX in accordance with the following requirements: ITEM NUMBER DESCRIPTION OF SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT 0001 1.00 YR $00.00 $00.00 USP 797/800 TESTING-TEMPLE PHARMACY MAIN LOCAL STOCK NUMBER: 1 0002 1.00 YR $00.00 $00.00 USP 797/800 TESTING-TEMPLE PHARMACY ONC-CSCA LOCAL STOCK NUMBER: 2 0003 1.00 YR $00.00 $00.00 USP 797/800 TESTING-TEMPLE PHARMACY ONC-SCA LOCAL STOCK NUMBER: 3 0004 1.00 YR $00.00 $00.00 USP 797/800 TESTING-AUSTIN PHARMACY ONC (SCA-CSCA) LOCAL STOCK NUMBER: 4 GRAND TOTAL $00.00 Base Year 01 Nov 2022- 31 Oct 2023 Option Year 1 01 Nov 2023- 31 Oct 2024 Option Year 2 01 Nov 2024- 31 Oct 2025 Option Year 3 01 Nov 2025- 31 Oct 2026 Option Year 4 01 Nov 2026- 31 Oct 2027 Statement of Work USP 797/800 IV Room and Hood Testing Certification of Sterile Compounding Facilities Central Texas Veterans Health Care System 1901 Veterans Memorial Drive Temple, TX 76504 BACKGROUND: The United States Pharmacopeia (USP) establishes standards for cleanroom design, environmental monitoring, and competencies for the preparation, handling, and storage of Compounded Sterile Preparations (CSPs). The Joint Commission (TJC) established new Medication Compounding (MC) standards for non-sterile and sterile compounded preparations which are based on USP standards. Additionally, the Food and Drug Administration (FDA) has the authority to inspect VA medical facilities using the USP standards. VHA Directive 1108.12, Management and Monitoring of Pharmaceutical Compounded Sterile Preparations, dated November 5, 2018, defines organizational responsibility for USP and USP standards for cleanroom design and engineering controls, environmental monitoring and cleaning of primary and secondary engineering controls, and the core competencies for personnel involved in the processes of compounding sterile preparations including HDs (both sterile and nonsterile dosage form preparations). It is VHA policy that each VA medical facility that provides CSPs have a pharmaceutical CSP program in place that conforms to the standards in USP Chapter Pharmaceutical Compounding Sterile Compounding and USP Hazardous Drugs Handling in Healthcare Settings. According to VHA Directive 1108.12, all VA medical facilities must establish a separate and dedicated contract for all applicable USP and USP CSP performance evaluations, testing, and certifications requirements. OBJECTIVE: Central Texas Veterans Healthcare System seeks a contract for testing and certification of the Olin E. Teague Veterans' Medical Center and Austin Outpatient Clinic Pharmacy Service s primary engineering controls (PECs) and secondary engineering controls (SECs) used for preparation of Compounded Sterile Preparations (CSPs). PECs include biological safety cabinets (BSCs), laminar airflow workstations (LAFWs) hoods, compounding aseptic containment isolators (CACI), and compounding aseptic isolators (CAI). Testing and certification will be completed in accordance with United States Pharmacopeia (USP) Chapter and guidelines using Controlled Environment Testing Association (CETA) Certified National Board of Testing (CNBT) certified individuals/companies to establish consistent PEC certification procedures using the Certification Guide for Sterile Compounding Facilities CAG-003-2006. USP implies Controlled Environment Testing Association (CETA) Controlled Applications Guides (CAGs) or equivalent may be used. CETA CAGs define certification procedures to assess the PEC is performing and operating as designed to maintain a sterile environment for the preparation of CSPs. According to VHA Directive 1108.12, VA adopted CETA CAGs as the mandatory standard; no equivalent standards may be used. All vendors used to conduct primary and secondary engineering controls certifications/assessments must be registered with CETA, as Registered Certified Professionals for Sterile Compounding Facilities (RCPSCF). SCOPE OF WORK Primary Engineering Controls (PECs) Certification: Certification procedures defined in CETA CAG-003-2006 must be performed by a CETA National Board of Testing (CNBT) certified testing individual no less than every 6 months or whenever the PEC or room is relocated or altered or when major service to the sterile compounding facility is performed. Certification of PECs must include the following: Airflow testing: Airflow testing is performed to determine acceptability of the air velocity and volume, the air exchange rate, and the room pressure differential in doorways between adjacent rooms to ensure consistent airflow and that the appropriate quality of air is maintained under dynamic operating conditions. The ACPH from HVAC, ACPH contributed from the PEC, and the total ACPH must be documented on the certification report. HEPA filter integrity testing: HEPA filters must be leak tested at the factory and then leak tested again after installation and as part of recertification. Total particle count testing: Total particle count testing must be performed under dynamic operating conditions using calibrated electronic equipment. Calibration of equipment used must be included in the final report. Airflow smoke pattern test: Both static and dynamic smoke studies verifying a continuous flow of HEPA filtered air void of turbulence, dead air zones, and refluxing from the HEPA filters to and across the entire work area and to the air returns must be performed and documented by video. Video of dynamic smoke test must document the demonstration of unidirectional airflow and sweeping action over and away from the preparation(s). Contractor to leave digital video via the preferred technology by the customer (i.e., email, flash drive, etc.) of smoke test on site prior to completion of certification process for each of the listed PECs. The contractor shall test and certify each PEC to the most current version of IEST RP-CC-002 (Unidirectional-flow, clean-air devices) and to the manufacturer s specifications. The contractor shall use a NIST traceable or comparable calibrated piece of equipment to perform all testing. The contractor shall report each individual face velocity reading and the average of those readings, the downstream concentration reading of the HEPA filter leak test and the results of the induction leak test and backstreaming test. Any failures shall be reported directly to the identified site point of contact(s) as soon as practicable. Horizontal Laminar Flow Hoods certifications shall be certified according to The Institute of Environmental Sciences RP-CC-002 Testing Laminar Air Flow Devices. The contractor shall certify all Class II biological safety cabinets to the current version (2016 or higher) of NSF/ANSI 49, Annex F specifications. All equipment used to certify biological safety cabinets shall have National Institute of Standards and Technology (NIST) traceable or comparable calibration certification. Any unit that fails to meet NSF 49 specifications shall be clearly marked with a sign that will notify technicians that the unit is out of order until further notice. In addition, any failures shall be reported directly to the site identified point(s) of contact (POC) as soon as practicable. The list of tests includes, but is not limited to: HEPA filter leak test Cabinet leak test Inflow velocity test to include exhaust airflow volume rate Airflow Smoke pattern test Electrical leakage and ground circuit resistance and polarity tests Lighting intensity test Vibration test Noise level test Ultraviolet (UV) lamp test For each PEC passing the required certification tests, the contractor will supply each unit with a certification sticker with the following information: Company name and address Unit make, model and serial number Report number Location (room number) Certification date Recertification date Technician name and signature Secondary Engineering Controls (SECs) Certification: The contractor will provide comprehensive cleanroom testing and certification services every 6 months to include: HEPA filter integrity testing: HEPA filters must be leak tested after installation and as part of recertification. Airflow profiling and uniformity testing Particulate monitoring Room pressurization monitoring Temperature and Humidity monitoring Air pattern analysis Airflow smoke pattern test (commissioning of new sterile compounding areas): Both static and dynamic smoke studies verifying a continuous flow of HEPA filtered air void of turbulence, dead air zones, and refluxing from the HEPA filters to and across the entire work area and to the air returns must be performed and documented by video. Video of dynamic smoke test must document the demonstration of unidirectional airflow and sweeping action over and away from the preparation(s). Contractor to leave video of smoke test on site prior to completion of certification process for each of the listed SECs. Air Changes per Hour: The contractor shall calculate the total room volume for each buffer, ante room, and hazardous drug storage room. A sketch of the room with dimensions, exhaust/supply diffuser locations and equipment locations shall be included in the report. The report provided will specify flow rates detailing returns and supply that were obtained during the testing. The contractor shall calculate air changes per hour (ACPH) for each buffer and ante room and include their findings in the report. In the event that a room does not meet USP requirements for ACPH the identified site POC(s) shall be informed immediately. Pressure Requirements: The contractor shall include in their report differential pressure readings from each buffer/ante room and hazardous drug storage room to all surrounding areas. The report shall indicate whether the room is required to be a negative or positive pressure room per USP and USP . The contractor shall report all pressures to an accuracy of 0.0001 water column (4 decimal places). Pressure differentials will be reflected on a report showing the sketch of the room(s). Pass-through chambers must be included in the facility s certification to ensure that particles are not compromising the air quality of the negative-pressure buffer room Non-Viable Testing: The contractor shall perform environmental nonviable particle testing at least once every 6 months. The contractor shall derive the minimum number of sampling locations using Annex A in the ISO 14644-1.2 standard. Testing shall be performed by qualified operators using current, state-of-the-art electronic equipment with results of the following: ISO Class 5: not more than 3520 particles 0.5 µm and larger size per cubic meter of air for any area primary engineering control (BSC, LAFW, CACI or CAI). ISO Class 7: not more than 352,000 particles 0.5 µm and larger size per cubic meter of air for any buffer area or hazardous compounding ante room. ISO Class 8: not more than 3,520,000 particles 0.5 µm and larger size per cubic meter of air for any non-hazardous compounding ante room. Viable Environmental Testing: The contractor shall perform viable environmental air sampling at least once every 6 months for fungi and bacteria using high volume impaction samplers to conduct the sampling, and viable surface sampling of all classified areas, and pass-through chambers connecting to classified areas for microbial contamination every month. A general microbiological growth media that supports the growth of bacteria and fungi must be used. COAs from the manufacturer must verify that the media meets the expected growth promotion, pH, and sterilization requirements. Samples must be incubated in an incubator at temperatures that will promote growth of bacteria and fungi. The incubator temperature must be monitored during incubation, either manually or by a continuous recording device, and the results must be reviewed and documented as described in the Contractor s SOPs. Quality assurance results of media plates being used, and calibrations of equipment used to incubate media plates must be provided in each report. Air Sampling: Volumetric active air sampling of all classified areas using an impaction device must be conducted in each classified area during dynamic operating conditions at least once every 6 months. A minimum volume of air (1000 liters) shall be tested at each location to maximize sensitivity. Samples of less than 1000 liters will not be acceptable. Air sampling sites must be selected in all classified areas and illustrated on a diagram of the cleanroom suite. The Contractor shall perform Air samples for bacteria using Tryptic Soy Agar (TSA) contact plates and Malt Extract Agar (MEA) or Sab DEX contact plates for sampling fungi. If levels measured during the viable air monitoring program exceed the levels as defined in USP for the ISO classification levels of the area sampled, the Contractor must identify any microorganisms recovered to the genus level with the assistance of a microbiologist and provide the results within one business day of results. Surface Sampling: The Contractor must perform surface sampling of all classified areas and pass-through chambers connecting to classified areas for microbial contamination every month. The Contractor shall perform surface samples for bacteria using Tryptic Soy Agar (TSA) contact plates and Malt Extract Agar (MEA) or Sab DEX contact plates for sampling fungi. The Contractor must perform the surface sampling at the end of compounding activity or shift, but before the area has been cleaned and disinfected. The areas that require surface sampling include, but are not limited to the following: The interior of the PEC and the equipment contained in it Staging or work area(s) near the PEC Frequently touched surfaces Any laboratory results equal to or greater than the action level will require notification of the POC(s) within 24 hours upon receipt of results. Reports to include at a minimum: Date and time sampling was taken. Environmental sampling reports will contain both the quantitative number of bacterial/fungal isolates reported as colony forming units (CFUs) as well as the species grown. Report shall immediately notify the site identified POC(s) of any highly pathogenic microorganisms identified. The identification of highly pathogenic microorganisms will be highlighted in the report. Medial lots used for samples Comments indicating when dynamic conditions were used Certificates of analysis of media used Results of quality assurance media plates Calibration of equipment used Sketch identifying location of each sample obtained REPORTING REQUIREMENTS: The results of each viable and non-viable sampling and testing shall be recorded and submitted as a comprehensive report, along with a statement of compliance or non-compliance with the specified tests. A written report of certification for all primary engineering controls, with statement of Pass/Fail, will be furnished on the day of certification. The Contractor must provide the full report, to include all items as listed above in Section 3, to the Chief of Pharmacy Service and other designated facility staff timely upon completion of all analyses, including identification of viable microorganisms, fungi, etc. not to exceed two weeks from the certification date. The following information should be included in the report for clean room certification. Pass/Fail notifications should be included on a per-test basis where applicable. Executive summary or summary of findings. Room number and/or location Room type (e.g., non-hazardous buffer room) Date of testing Date of next required certification Standards used to test room Notes Room sketch (location of supply/exhaust diffusers, equipment, room dimensions) Total room area and volume Room humidity and temp Air changes per hour Pressure differential Nonviable particle counts Viable particle count analysis Picture of viable particle test location in room In case of Fail. Retest will be completed within 2 days of notification. Follow up reporting same as 4.1. CONTRACTOR QUALIFICATIONS: The Contractor will provide all parts, labor, equipment, material, travel expenses to test and certify the operation and performance of equipment systems and personnel per the Statement of Work listed in Section 3. All inspections, testing and certifications must be performed by properly trained and appropriately accredited on-site field certification technicians. that are also certified technicians must be trained on all types of equipment listed in this SOW. Documentation shall be provided to the VA certifying that each field certification technician has been trained and certified in the work required by this SOW as follows: Contractor must have a working knowledge of most recent publications of USP Pharmaceutical Compounding-Sterile Preparations and USP Chapter Hazardous Drugs-Handling in Healthcare Settings. Contractor must have a working knowledge of NSF/ANSI 49-2016 Biosafety Cabinetry: Design, Construction, Performance and Field Certification. Contractor must be able to provide a technician with current certification as a Registered Cleanroom Certified Professional for Sterile Compounding Facilities by the CNBT for cleanroom certification. Proof of current CETA-accredited certification for a specific individual must be provided to facility s POC prior to performing any work. Contractor must provide a technician with current certification as an NSF Class II Biosafety Cabinet Field Certifier for Class II BSC testing and certification. Proof of current certification for an NSF-accredited certifier must be provided to facility s POC prior to performing any work. Contractor must provide Certified Environmental Microbiology Laboratory - ISO/IEC 17025:2005 Accreditation Contractor must have documented competencies for any technicians sent to perform testing and for any technicians who read the media tests. Copies of each technician s current competencies must be provided to facility s POC prior to performing any work. Note: A Certified Industrial Hygienist (CIH) credential does not waive any of the above certification requirements. Contractor must have standard operating procedures (SOPs) for testing, troubleshooting, repair, and certification including documentation of certification equipment calibration to National Institute of Standards and Technology (NIST)-traceable primary standards, a safety plan to include job hazard analysis, respiratory protection program, hazard communication and safety data sheets (SDS) for all chemical products that will be used during this contract. Copies of the SOPs must be provided to facility s POC prior to performing any work. Contractor must have a specific SOP for changing out biologically contaminated HEPA filters in Class II BSCs, and a specific SOP for changing out HEPA filters contaminated with hazardous drugs in Class II BSCs. Copies of the SOPs must be provided to facility s POC prior to performing any work. Technicians must successfully demonstrate competency in garbing and hand hygiene when performing work in classified areas. Due to the sensitive nature of the work area, prior to entering sterile compounding areas (buffer room, ante room), the Contractor will maintain a clean work area at all times by wearing appropriate personal protective equipment (set forth by USP standards) and cleaning any equipment with 70% sterile isopropyl alcohol. LOCALITY: Awarding company must do all testing (no subcontractors); must be local within 100 miles of facility and campuses. Contractor must have working knowledge of the following CETA Documents referenced by USP and USP : CAG-001-2005 Applications Guide for The Use of Compounding Isolators in Compounding Sterile Preparations in Healthcare Facilities (Revised December 2008) CAG-002-2006 Compounding Isolator Testing Guide (Revised December 2008) CAG-003-2006 Sterile Compounding Facilities (Revised May 2015) CAG-004-2007 Application Guide for the use of Surface Decontaminants in Biosafety Cabinets CAG-005-2007 Servicing Hazardous Drug Compounding Primary Engineering Controls CAG-006-2010 CETA High Efficiency Filter Application Guide CAG-007-2010 Application Guide for Exhaust System Requirements of Class II, Type B Biosafety Cabinets CAG-008-2022 CETA Certification Matrix for Sterile Compounding Facilities (Updated January 2012) CAG-009-2020 CETA Certification Application Guide USP Viable Environmental Sampling & Gowning Evaluation CAG-010-2011 CETA Application Guide for Informational Notes to Meet the NSF/ANSI 49:2010a Standard Requirements Contractor must have working knowledge of the following ISO standards: 14644-1:2015 Cleanrooms and associated controlled environments -- Part 1: Classification of air cleanliness by particle concentration 14644-2:2015 - Cleanrooms and associated controlled environments -- Part 2: Monitoring to provide evidence of cleanroom performance related to air cleanliness by particle concentration 14644-3:2005 Cleanrooms and associated controlled environments -- Part 3: Test methods 14644-9:2012 Cleanrooms and associated controlled environments -- Part 9: Classification of surface cleanliness by particle concentration 14698-2:2003 - Cleanrooms and associated controlled environments -- Biocontamination control -- Part 2: Evaluation and interpretation of biocontamination data PLACE OF PERFORMANCE: CTVHCS Olin E. Teague Veterans Medical Center and Austin Outpatient Clinic, 1901 Veterans Memorial Dr. Temple, Texas 76504. CTVHCS Olin E. Teague Veterans Medical Center BB115 has one cleanroom suite which has the following: ISO 7 Ante Room ISO 7 Non-Hazardous Buffer Room Two ISO 5 CAI (Germfree -3ft AND 6 ft) no more than 2 CAI. Two pass-through chambers 6 HEPA filters CTVHCS Olin E. Teague Veterans Medical Center has one SCA and CSCA, which has the following: Two ISO 5 (1 Germfree 3ft CAI and 1 NuAire 3ft CACI). Non-Classified Hazardous Drug Storage Room CTVHCS Austin Outpatient Clinic (AOPC) Oncology clinic has one SCA and CSCA, which has the following: One ISO 5 Horizontal LAFW (Baker) One Class II Type B2 Biological Safety Cabinets (Baker) Vertical LF Non-Classified Hazardous Drug Storage Room TERM OF CONTRACT AND PRICING: Firm Fixed Price PERFORMANCE PERIOD: The contract term is for 12 months with four options of 12 months each beginning upon signature of the contract. Olin E. Teague VAMC will issue a delivery order only for the current fiscal year. The VA's obligation under this contract shall terminate at the end of each fiscal year. Olin E. Teague VAMC shall unilaterally renew by issuing a renewal delivery order that shall be effective on the first day of each succeeding fiscal year. Proposed Period of Performance as follows: POP BEGIN 11/01/2022 POP END 10/30/2023 (Base Year) POP BEGIN 11/01/2023 POP END 10/30/2024 (Option Year 1) POP BEGIN 11/01/2024 POP END 10/30/2025 (Option Year 2) POP BEGIN 11/01/2025 POP END 10/30/2026 (Option Year 3) POP BEGIN 11/01/2026 POP END 10/30/2027 (Option Year 4) HOURS OF WORK: Work required in the performance of the contract shall be performed during hours agreed upon between the Contractor and Olin E. Teague VAMC Pharmacy Supervisors. Certifications and samplings shall be scheduled with the COR and an Olin E. Teague VAMC Pharmacy Supervisor a minimum of three (3) working days in advance but no longer than one week at the Pharmacy Supervisor s request. Close coordination with the COR and Pharmacy Supervisor is necessary. Contractor will be responsible for ensuring all certifications and samplings are completed within the required timeframes for all Pharmacy cleanrooms, equipment, and personnel. GOVERNMENT RESPONSIBILITIES: The government will work in concert with the Contractor to help enable completion of the work of the contract. CONFIDENTIALITY AND NONDISCLOSURE: It is agreed that: The preliminary and final deliverables, and all associated working papers, application source code, and other material deemed relevant by VA which have been generated by the contractor in the performance of this task order, are the exclusive property of the U.S. Government and shall be submitted to the CO at the conclusion of the task order. The CO will be the sole authorized official to release, verbally or in writing, any data, draft deliverables, final deliverables, or any other written or printed materials pertaining to this task order. No information shall be released by the contractor. Any request for information relating to this task order, presented to the contractor, shall be submitted to the CO for response. Press releases, marketing material, or any other printed or electronic documentation related to this project, shall not be publicized without the written approval of the CO. VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY language FOR Inclusion into CONTRACTS, as appropriate GENERAL: Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security. ACCESS to VA INFORMATION AND VA INFORMATION SYSTEMS A contractor/subcontractor shall request logical (technical) or physical access to VA information and VA information systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order. All contractors, subcontractors, and third-party servicers and associates working with VA information are subject to the same investigative requirements as those of VA appointees or employees who have access to the same types of information. The level and process of background security investigations for contractors must be in accordance with VA Directive and Handbook 0710, Personnel Suitability and Security Program. The Office for Operations, Security, and Preparedness is responsible for these policies and procedures. Contract personnel who require access to national security programs must have a valid security clearance. National Industrial Security Program (NISP) was established by Executive Order 12829 to ensure that cleared U.S. defense industry contract personnel safeguard the classified information in their possession while performing work on contracts, programs, bids, or research and development efforts. The Department of Veterans Affairs does not have a Memorandum of Agreement with Defense Security Service (DSS). Verification of a Security Clearance must be processed through the Special Security Officer located in the Planning and National Security Service within the Office of Operations, Security, and Preparedness. Custom software development and outsourced operations must be located in the U.S. to the maximum extent practical. If such services are proposed to be performed abroad and are not disallowed by other VA policy or mandates, the contractor/subcontractor must state where all non-U.S. services are provided and detail a security plan, deemed to be acceptable by VA, specifically to address mitigation of the resulting problems of communication, control, data protection, and so forth. Location within the U.S. may be an evaluation factor. The C & A requirements do not apply, and that a Security Accreditation Package is not required. The contractor generated data is NOT VA sensitive information. INFORMATION SYSTEM HOSTING, OPERATION, MAINTENANCE, OR USE For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, contractors/subcontractors are fully responsible and accountable for ensuring compliance with all HIPAA, Privacy Act, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerability scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The contractor's security control procedures must be equivalent to those procedures used to secure VA systems. A Privacy Impact Assessment (PIA) must also be provided to the COTR and approved by VA Privacy Service prior to operational approval. All external Internet connections to VA's network involving VA information must be reviewed and approved by VA prior to implementation. Adequate security controls for collecting, processing, transmitting, and storing of Personally Identifiable Information (PII), as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls are to be assessed and stated within the PIA and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII. Outsourcing (contractor facility, contractor equipment or contractor staff) of systems or network operations, telecommunications services, or other managed services requires certification and accreditation (authorization) (C&A) of the contractor's systems in accordance with VA Handbook 6500.3, Certification and Accreditation and/or the VA OCS Certification Program Office. Government-owned (government facility or government equipment) contractor-operated systems, third party or business partner networks require memorandums of understanding and interconnection agreements (MOU-ISA) which detail what data types are shared, who has access, and the appropriate level of security controls for all systems connected to VA networks. The contractor/subcontractor's system must adhere to all FISMA, FIPS, and NIST standards related to the annual FISMA security controls assessment and review and update the PIA. Any deficiencies noted during this assessment must be provided to the VA contracting officer and the ISO for entry into VA's POA&M management process. The contractor/subcontractor must use VA's POA&M process to document planned remedial actions to address any deficiencies in information security policies, procedures, and practices, and the completion of those activities. Security deficiencies must be corrected within the timeframes approved by the government. Contractor/subcontractor procedures are subject to periodic, unannounced assessments by VA officials, including the VA Office of Inspector General. The physical security aspects associated with contractor/subcontractor activities must also be subject to such assessments. If major changes to the system occur that may affect the privacy or security of the data or the system, the C&A of the system may need to be reviewed, retested and re-authorized per VA Handbook 6500.3. This may require reviewing and updating all documentation (PIA, System Security Plan, Contingency Plan). The Certification...
 

Web Link

SAM.gov Permalink
(https://sam.gov/opp/bd05a68bbc4341ce97d216dd2c4f5b44/view)
 

Place of Performance

Address: Central Texas Veterans Health Care Sys. 1901 Veterans Memorial Drive,, Temple, TX 76504-5129, USA

Zip Code: 76504-5129

Country: USA
 

Record

SN06458384-F 20220910/220908230133 (samdaily.us)
 

Source

SAM.gov Link to This Notice
(may not be valid after Archive Date)

---

| FSG Index  |  This Issue's Index  |  Today's SAM Daily Index Page |