QualityNet Jira will be unavailable on Tuesday, September 03, 2024, between 8:00 PM ET and 11:00 PM ET while the team performs a system upgrade. QualityNet Confluence will also be briefly unavailable between 8:00 PM ET and 8:30 PM ET.  If you have questions or concerns, please reach out to us in Slack at #help-atlassian.

QualityNet Security

Versions Compared

Old Version 2

changes.mady.by.user Angel Tucker

Saved on

compared with

New Version Current

changes.mady.by.user Brandon Tennessee

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Anchor
top
top
  

Image Added



Section

HCQIS Security Awareness Training (SAT) & Certification Administration Instructions

Section

General Information

HHS and CMS in accordance to Federal Information Security Management Act (FISMA) of 2002 and other policies requires that all Federal CMS and Contractor users of Federal Information Systems to be exposed to security and privacy awareness training materials at least annually. This is to inform federal employees, contractors and other users of information systems that support the operations and assets of the agency, of:


Column
width2



Column
width5

Security Policy


Column
width5

Awareness & Training


Column
width5

Security Point Of Contact


Column
width5

Incident Response





Section


Column
width4



Column
width65

Introduction

During onboarding, and before accessing any QualitNet system or application, each user must sign Rules of Behavior, complete the appropriate training, and provide evidence of training completion to their

  • Information Security risks associated with technologies and their activities while utilizing those technologies.
  • Responsibilities in complying with agency policies and procedures designed to reduce risks.
  • Overview of protecting Personally Identifying Information (PII) or Personal Health Information (PHI) of any individual as directed in the Privacy Act of 1974.
  • Records Management and Retention.
During onboarding and before access to any HCQIS system or application each user must complete proper training requirements on an annual basis and must provide evidence of completion to his/her respective

Security Point of Contact (SPOC)

who

; the SPOC will track all required training within

the organization.

their organization. In many cases, an annual attestation is also provided to the organization’s CMS Contracting Officer’s Representative (COR) as a deliverable.  

If you have questions about policy or need more information regarding contract requirements, please contact your COR.



Column
width4








Section


Column
width2



Column
width5

Required Training



Column
width5

User Instructions


Column
width5

SPOC Certifications/Attestation


Column
width5

Record Keeping for SPOCs



HTML
<hr style="border: 1px dashed #1e3d59;" />

Background Color
color#e1e3e6


Section



Column
width4




Section

Previous HCQIS Contractors Vs. New Users

Section

Newly on-boarded HCQIS Services users who have taken all three training modules within the last 90 days of the organization's certification period are EXEMPT from taking SAT training for the current annual certification period. This group of users will take security awareness training as normal during the following annual certification period.
Note: Any deviations from either training module will require the user to take any missed training during the current certification period.

Background Color
color#e1e3e6
Section

SAT Record Keeping and Maintenance for SPOCs:

Section
  • SAT Records are not required for submission unless requested by the COR or ISSO. SAT Records must always be updated and maintained. (SAT record templates are available within HCQIS Security Resources on QNP or may be obtained by the CMS COR/ISSO.


    • Column
    width4



    Column
    width25

    Image Added


    Column
    width65


    Anchor
    Training
    Training



    Section


    Column
    width10



    Column
    width80


    Security Awareness Training (SAT) - The QualityNet program utilizes the DoD Cyber Exchange, a publicly accessible training library with course offerings, to allow contractors to meet part of the CMS SAT requirements. SAT Training is broken into two (2) separate trainings:  

    Records Management Training - Additional to Security Awareness training, the HHS Records Management Training is a mandatory requirement outlined in the HHS Policy for Records Management and the Office of Management and Budget (OMB)/National Archives and Records Administration (NARA) joint Directive M-19-21, Transition to Electronic Records.  The records management training is to provide an overview of user responsibilities for records handling, help users tell the difference between records and non-records, and assist them in learning how to manage the federal records lifecycle.  

    Note: The HHS Office of Human Capital manages records management training and requirements for CMS. Therefore, updated instructions may be issued by HHS to include new training requirements, content or links. Please check with your COR for any changes to the information provided by HHS.


    Back to Top




    Column
    width10







    HTML
    <hr style="border: 1px dashed #1e3d59;" />



    Section

    Anchor
    User Instructions
    User Instructions

    Section


    Column
    width4



    Column
    width25

    Image Added


    Column
    width65




    Section


    Column
    width10



    Column
    width80


    Step 1 - Complete the required online training by selecting the corresponding modules listed below.

    Section


    Column
    width10



    Column
    width20


    Image Added


    Column
    width20


    Image Added



    Column
    width20


    Image Added


    Column
    width10



    Step 2 - Enter your name in the Certification of Completion’s online display, which is provided at the successful conclusion of the training.

    Step 3 - Take a screen capture (shot) or save a copy of the certificate locally then provide a copy of your completed certification to your organization’s assigned Security Point of Contact (SPOC) who will maintain a copy for record retention.


    Recently transitioned from a previous contract?

    New users take training during onboarding and before initial access then annually thereafter. Some contracts and organizations require all users to complete training by a specific time each year. There also may be times where a user has transferred from another contract and has taken required training.  Therefore, if a user has started or transferred from a previous QualityNet contract and has taken all required trainings within the last 90 days, that user is except from taking any training again until the following calendar year or deliverable period; whichever schedule is followed. Please contact your COR for any questions regarding requirements. 


    Back to Top




    Column
    width4








    HTML
    <hr style="border: 1px dashed #1e3d59;" />


    Anchor
    Certification
    Certification

    Background Color
    color#e1e3e6


    Section



    Section


    Column
    width4



    Column
    width30


    Image Added



    Column
    width60




    Section


    Column
    width10



    Column
    width70


    The SPOC should adhere to the following guidelines related to certification and attestation of training results:

    1. Only one memo is required for all sites under each prime contract region/area/site.
    2. The Certification Memo must be signed (digitally if preferred) by any designated SPOC and the organization’s designated Program Lead. 
    3. You may apply a naming convention that best suits your organization, Contract or deliverable, but that is easy to understand by other readers.
    4. Submit the completed certification memo electronically to you’re COR using the specified vehicle outlined in the contract as directed by the CMS COR.


    Organizational SPOCs may leverage the provided template to fulfill the requirement. 

    QNet Security Awareness Certification Template.docx


    Back to Top


    Column
    width4




    Section






    HTML
    <hr style="border: 1px dashed #1e3d59;" />




    Section


    Anchor
    Record
    Record

    Section


    Column
    width4



    Column
    width25

    Image Added


    Column
    width65




    Section


    Column
    width10



    Column
    width70


    Records must be updated and maintained at all times, but they are only to be submitted to CMS if requested by the COR or the Information Systems Security Officer (ISSO). Record templates are available within the Security page on the QualityNet Communications Hub or may be obtained through your CMS COR.

    Contracts operating across

    Contracts acting under

    multiple sites (prime/sub) may exercise the option of having multiple

    SAT

    records or a single

    SAT

    record that reflects

    ALL

    all individual sites and each user

    respectfully

    respectively.

    At the top of each page insert the Contract name and specify the site if applicable.

    For multiple sites in a single area, you may use a different table that identifies each

    state

    State/region for each site.


    Organizational SPOCs may leverage the provided template to fulfill the requirement. 

    Security Awareness Training Record template



    Back to Top


    Column
    width4



    Section







    HTML
    <hr style="border: 1px dashed #1e3d59;" />