20 VA Handbook 6500.6 Contract Security Franklin County OH 36C10F25R0057.pdf

This is VA Handbook 6500.6 on Contract Security, dated March 12, 2010, establishing security requirements, procedures, responsibilities, and departmental framework for ensuring information security is included in Department of Veterans Affairs contracts and acquisitions.

The handbook applies to all VA contracts involving VA sensitive information storage, generation, transmission, or exchange by contractors, subcontractors, or third parties, regardless of format or system location. It implements requirements of the Federal Information Security Management Act (FISMA) and establishes procedures for compliance with federal and VA security directives. Key procedures include: completing a Checklist for Information Security in the Initiation Phase of Acquisitions (Appendix A) to determine security requirements; including the VA Acquisition Regulation security clause (Appendix B) in applicable contracts; incorporating VA Information and Information System Security/Privacy language (Appendix C) into contracts; and requiring contractor signature of Contractor Rules of Behavior (Appendix D). The handbook mandates that contractors implement adequate security controls, obtain Certification and Accreditation (C&A) authorization where required, complete Contractor Security Control Assessments (CSCA) within 30 days of contract approval and annually thereafter, sign Contractor Rules of Behavior annually, receive appropriate risk-level designations through the Position Designation System and Automated Tool (PDAT), and complete required security and privacy training. Contracting Officers, in coordination with Information Security Officers, Program Managers, Privacy Officers, and Compliance/Records Management Officers, are responsible for ensuring these requirements are implemented and monitored throughout the contract lifecycle. Additional requirements address information system design and development, hosting and operation, media sanitization, security incident investigation, data breach liquidated damages, and security controls compliance testing.