8.x |
Approved w/Constraints [1, 2, 4, 5] |
Approved w/Constraints [1, 2, 4, 6] |
Approved w/Constraints [1, 2, 4, 6] |
Approved w/Constraints [1, 2, 4, 6] |
Approved w/Constraints [1, 2, 4, 6] |
Approved w/Constraints [1, 2, 4, 6] |
Approved w/Constraints [1, 2, 4, 6] |
Approved w/Constraints [1, 2, 4, 6] |
Approved w/Constraints [1, 2, 4, 6] |
Approved w/Constraints [1, 2, 4, 6] |
Approved w/Constraints [1, 2, 4, 6] |
Approved w/Constraints [1, 2, 4, 6] |
| | [1] | Per the Initial Product Review (IPR), users must abide by the following constraints:
- The product should use a validated FIPS 140-2 cryptographic module for use
with any data containing PHI/PII or VA sensitive information.
- Due to potential information security risks, SaaS/PaaS solutions must complete
the Veterans-Focused Integration Process Request (VIPR) process where a
collaborative effort between Demand Management (DM), Enterprise Program
Management Office Information Assurance (EPMO IA), Project Special Forces
(PSF), Enterprise Cloud Solutions Office (ECSO), Chief Technology Officer
(CTO), and stakeholders determines the SaaS/PaaS category during the
Discovery Phase. All SaaS and Non-AWS/Azure (VAEC) PaaS assets are routed to EPMO IA for Analysis and Approval to Operate (ATO) with technical
oversight, acquisition, production, and sustainment provided by PSF.
- The connection between VA and Avaya SBCE requires network modification,
system owners should clearly define the required security controls and
document them in a VA approved Memorandum of Understanding and
Interconnection Security Agreements (MOU/ISA), contractor and other VA
approved agreement (e.g., Data Use Agreement) as stated in VA Handbook
6500 and VA Directive 6513 - Secure External Connections. In addition, all
external network connections must traverse through VA Trusted Internet
Connection (TIC) gateway to comply with critical Office of Management and
Budget mandate.
| | [2] | Technology must remain patched and operated in accordance with Federal and Department security policies and guidelines in order to mitigate known and future security vulnerabilities. | | [3] | Due to potential information security risks for cloud-based technologies, users should coordinate closely with their facility ISSO for guidance and assistance on cloud products. If further guidance is needed contact the Enterprise Cloud Solution Office (ECSO), which is the body responsible for new software development in and migration of existing systems to the VA Enterprise Cloud (VAEC) and ensuring organizational information, Personally Identifiable Information (PII), Protected Health Information (PHI), and VA sensitive data are not compromised within the VAEC. For information about Software as a Service (SaaS) products or to submit a SaaS product request with the Project Special Forces (SPF) team, please use their online form.
(Ref: VA Directive 6004, VA Directive 6517, VA Directive 6513 and VA Directive 6102). | | [4] | New installations or major expansions of this technology that transmit data over the VA Wide Area Network (WAN) must complete a WAN impact review (yourIT Service Portal:[SNOW Service Requests]) prior to implementation to ensure proper compliance to VA network design and usage requirements. | | [5] | Due to potential information security risks for cloud-based technologies, users should coordinate closely with their facility ISSO for guidance and assistance on cloud products. If further guidance is needed contact the Enterprise Cloud Solution Office (ECSO), which is the body responsible for new software development in and migration of existing systems to the VA Enterprise Cloud (VAEC) and ensuring organizational information, Personally Identifiable Information (PII), Protected Health Information (PHI), and VA sensitive data are not compromised within the VAEC. For information about Software as a Service (SaaS) products or to submit a SaaS product request with the Project Special Forces (PSF) team, please use their online form.
(Ref: VA Directive 6004, VA Directive 6517, VA Directive 6513 and VA Directive 6102). | | [6] | Due to potential information security risks for cloud-based technologies, users should coordinate closely with their facility ISSO for guidance and assistance on cloud products. If further guidance is needed contact the Enterprise Cloud Solution Office (ECSO), which is the body responsible for new software development in and migration of existing systems to the VA Enterprise Cloud (VAEC) and ensuring organizational information, Personally Identifiable Information (PII), Protected Health Information (PHI), and VA sensitive data are not compromised within the VAEC. For information about Software as a Service (SaaS) products or to submit a SaaS product request with the VA OIT Product Engineering team, please use their online form.
(Ref: VA Directive 6004, VA Directive 6517, VA Directive 6513 and VA Directive 6102). |
|