20 RLP 36C10F26R0024 VA Handbook 6500 6 SPB County FL OPC 7_17_ 2026.pdf

This is VA Handbook 6500.6, Contract Security, a procedural guidance document dated March 12, 2010, establishing security requirements, procedures, and responsibilities for Department of Veterans Affairs contracts and acquisitions involving VA sensitive information.

The handbook applies to all VA contracts where VA sensitive information is stored, generated, transmitted, or exchanged by contractors, subcontractors, or third parties, regardless of whether the information resides on VA or contractor systems. It establishes that VA remains responsible for ensuring protection of sensitive information even when relying on contractors. Information security requirements must be considered in all phases of procurement, with Program Managers, Information System Owners, and Information Owners responsible for ensuring solicitation documents include appropriate security and privacy requirements. The handbook mandates completion of Appendix A (Information Security Initiation Phase Checklist) for all service acquisitions and contracts, inclusion of the approved security clause from Appendix B when required, incorporation of security/privacy language from Appendix C into solicitations, and contractor signature of the Contractor Rules of Behavior (Appendix D). Key responsibilities are distributed among multiple organizational entities including the Chief Information Officer, Assistant Secretary for Office of Information and Technology, Assistant Secretary for Operations/Security/Preparedness, Information Security Officers, Privacy Officers, Program Directors, Contracting Officers, and COTRs. Contractors must complete annual Contractor Security Control Assessments, implement required security training, undergo background investigations per VA Directive 0710, maintain systems certified and accredited per VA Handbook 6500.3, comply with Federal Desktop Core Configuration standards, and report security incidents immediately to designated VA personnel.