These plans should show how the agency will verify that the acquired equipment, software, or services meet user needs and satisfy security requirements.
The report states that the agency is not qualified to handle swcurity information.