National Government Services Virtual Data Center

The NGS VDC collects and maintains the system support user credentials, which are the name, user ID and password. The system support staff are CMS employees and direct contractors.

The NGS VDC does not directly collect, maintain, or share any other information but provides the infrastructure hosting environment for several CMS MAs.

The NGS VDC is an information technology infrastructure system that supports several CMS MAs. The system is comprised of operating systems, network devices (routers, servers, firewalls, and intrusion detection/prevention systems) and computer systems backup.

The MAs are communication platforms and websites that CMS uses to communicate or provide services externally or internally. These MAs collect, maintain, and share a broad scope of information, which may include PII. As such, each of these MAs is responsible for maintaining the security of the information within their boundaries. Each CMS MA maintains their own PIA to address the security and privacy controls in place to protect the information. 

The following CMS MAs are supported by the NGS VDC: Next Generation Desktop (NGD), Training, Quality and Content (TQC) System; , Centers for Medicare and Medicaid Innovation- Innovation Payment Contractor (CMMI-IPC), Common Electronic Data Interchange (CEDI) (MA), and Supplemental Medical Review Contractor (SMRC) (MA) 

The NGS VDC system support staff, who are CMS employees and direct contractors, must log into the system with user credentials to operate system. The user credentials consist of name, user ID and password. The credentials are stored for as long as necessary for the individual to access the system. If/when user credentials are no longer required, then the user credentials are deleted. 

• Name
• Other - User IDs and passwords

• In-person
• Online

• Within the OPDIV

If a user believes their PII has been inappropriately obtained, used, or disclosed, the user must contact the NGS Service Desk who will assign an incident ticket to the NGS Computer Security Incident Response Team, who will investigate and determine any additional steps.

The individual may also contact the CMS IT Service Desk by email or telephone. Details of the incident are logged and investigated to determine if further action is required to resolve the concern. 

The NGS VDC maintains the data integrity and availability of PII by employing security technologies such as firewalls, and encryption of workstations and communication protocols; and maintaining, monitoring, and reviewing system access logs. 

The system users maintain data accuracy and relevancy by correcting/updating their own PII data and administrators perform account review procedures. User account data is not validated but is monitored for activity and audited for usage. Accounts can be disabled for non-activity and accounts that have not been used at least once every 366 days are deleted.

• Administrators: Administrators have access to PII as part of the system logs that monitor the access of the NGS VDC.
• Contractors: Direct contractors, in their role as an IT system administrator, would have access to PII to perform those job functions.
• Other: To access the NGS VDC information technology system, an authorized user must provide their PII, user credentials. Therefore, there is not a method for an individual to opt-out.

The administrative controls in place to secure the PII include role-based access and permissions, periodic review of users and deletion of non-active accounts. 

The technical controls in place are firewalls that prevent unauthorized access, encrypted access at log on, security scans, penetration testing, and intrusion detection and prevention systems (IDS/IPS). 

The physical controls in place are as follows: the use of security cards and pass codes, video monitoring, security guards and a separately located backup system.