VA HANDBOOK 6500.6 CONTRACT SECURITY

This document is the VA Handbook for Contract Security dated March 12, 2010, establishing security requirements, procedures, responsibilities, and departmental framework for ensuring security is included in appropriate Department of Veterans Affairs contracts and acquisitions.

The handbook applies to all VA contracts involving VA sensitive information storage, generation, transmission, or exchange by VA contractors, subcontractors, or third parties, regardless of format or system location. It excludes certain agreements outside its scope, including Business Associate Agreements, Data User Agreements, Data Transfer Agreements, Memoranda of Understanding, and FISMA-subject federal agency sharing agreements. The handbook establishes the Federal Information Security Management Act (FISMA) compliance framework, requiring VA to protect sensitive information and information technology assets through security controls in contracts. Key responsibilities are assigned across organizational levels: the Chief Information Officer oversees the department-wide information security program; the Assistant Secretary for Office of Information and Technology approves security policies; the Assistant Secretary for Operations, Security, and Preparedness manages personnel security programs; and the Deputy Assistant Secretary for Information Protection serves as the Chief Information Security Officer, establishing policies and monitoring compliance. Information Security Officers at facility and program levels ensure compliance with federal security legislation and VA directives, manage local security programs, and serve as principal advisors to contracting officers, program managers, and facility directors. Contractors must employ adequate security controls per VA directives, complete required background investigations consistent with VA Directive 0710, sign Contractor Rules of Behavior, and complete mandatory security and privacy training. The handbook includes appendices providing a Checklist for Information Security in the Initiation Phase of Acquisitions, VA Acquisition Regulation Solicitation Provision and Contract Clause, VA Information and Information System Security/Privacy Language for Inclusion into Contracts, and Contractor Rules of Behavior governing contractor access to and use of VA data, systems, and sites.