▪ Support business requirements gathering, documentation, and ATO maintenance for the DMC application portfolio under the active VA-wide umbrella ATO (FIPS 199 Moderate)
▪ Serve as a bridge between business users, developers, and information security stakeholders
▪ Obtain individual VA system access authorization within one month of contract start; this is an individual onboarding expectation only, as system-level ATO decisions are made solely by Government authorization officials
▪ Collect and document business and functional requirements
▪ Create, update, and maintain all ATO artifacts, including SSP updates, control narratives, software scan evidence, POA&M remediation tracking, system descriptions, site maps, wireframes, database diagrams, code documentation, and data flow documentation
▪ Coordinate with developers and data staff to document system changes
▪ Track and support remediation actions resulting from security scans
▪ Support audits, reviews, and compliance requests related to DMC systems