20 RLP 36C10F26R0024 VA Handbook 6500 6 SPB County FL OPC 7_17_ 2026.pdf

This is VA Handbook 6500.6 on Contract Security, issued March 12, 2010, which establishes security requirements, procedures, responsibilities, and departmental framework for ensuring security is included in appropriate Department of Veterans Affairs (VA) contracts and acquisitions.

The handbook applies to all VA contracts involving VA sensitive information storage, generation, transmission, or exchange by contractors, subcontractors, or third parties regardless of format or system location. It does not apply to Business Associate Agreements, Data User Agreements, Data Transfer Agreements, Memoranda of Understanding, or sharing agreements with other federal agencies subject to FISMA. The handbook mandates that information security requirements be considered in all acquisition phases, with Program Managers, Information System Owners, and Information Owners responsible for ensuring solicitations include appropriate security and privacy requirements. Contractors must implement VA security and privacy requirements as defined in contracts, with specific security clauses (Appendix B) required when VA sensitive information is involved. Key procedural requirements include completing the Checklist for Information Security in the Initiation Phase of Acquisitions (Appendix A), ensuring contractors sign the Contractor Rules of Behavior (Appendix D), completing Contractor Security Control Assessments within 30 days of contract approval and annually, conducting background investigations per VA Directive 0710, and ensuring annual security and privacy awareness training. The handbook designates the Chief Information Officer as the senior agency official responsible for FISMA enforcement and outlines specific responsibilities for multiple organizational entities including the Assistant Secretary for Office of Information and Technology, Information Security Officers, Local Privacy Officers, Contracting Officers, and Program/Project Managers. Appendices provide detailed security and privacy language for inclusion in contracts, addressing system design, incident investigation, data breach protocols, liquidated damages, training requirements, and contractor rules governing access to VA data and systems.