20 - VA Handbook 6500.6 - 3.12.10 FOR RLP.pdf

This is VA Handbook 6500.6, a Department of Veterans Affairs contract security handbook dated March 12, 2010, establishing security requirements, procedures, responsibilities, and departmental framework for ensuring information security is included in appropriate VA contracts and acquisitions.

The handbook applies to all VA contracts involving VA-sensitive information storage, generation, transmission, or exchange by contractors, subcontractors, or third parties, regardless of format or system location. It establishes that information security must be considered throughout all phases of the procurement process and that contractors must employ adequate security controls in accordance with VA directives, handbooks, regulations, and established service level agreements. The handbook mandates completion of Appendix A (Checklist for Information Security in the Initiation Phase of Acquisitions) for all IT service acquisitions, statements of work, and third-party service agreements to determine necessary security and privacy controls. Appendix B provides the VA Acquisition Regulation (VAAR) solicitation provision and contract clause addressing information and information technology security requirements, incorporating security standards referenced at 852.273-75. Appendix C contains comprehensive VA information and information system security/privacy language for inclusion in contracts, covering access requirements, custodial language, system design and development, hosting and operation, security incident investigation, data breach protocols with liquidated damages provisions, and mandatory employee training. Appendix D establishes Contractor Rules of Behavior governing contractor access to and use of VA information assets and resources, requiring compliance with federal laws, regulations, VA directives, password protection, encryption standards (FIPS 140-2), media sanitization, and prohibition of personally-owned equipment on VA networks without CIO approval. The handbook assigns clear responsibilities across multiple organizational levels, from the Secretary of Veterans Affairs and Chief Information Officer at the highest level through field-level Information Security Officers, Contracting Officers, Program Managers, and Privacy Officers.