D.5 - Contractor Rules of Behavior.pdf

This is Attachment D.5, titled "Contractor Rules of Behavior," from VA Handbook 6500.6 Appendix D, which establishes a user agreement governing contractor access to and use of Department of Veterans Affairs (VA) information assets, systems, and resources.

The document outlines mandatory behavioral standards and security requirements for all VA contractors. Contractors must acknowledge they have no expectation of privacy when accessing VA systems and consent to monitoring, recording, and disclosure of their activities by VA Office of Information & Technology (OI&T) staff and authorized personnel. Key prohibitions include: unauthorized access to or modification of federal systems; use of systems beyond authorized scope; bypassing security controls without express permission; personal use of systems; and disclosure of VA sensitive information without Contracting Officer's Technical Representative (COTR) approval. Contractors must comply with VA Handbook 6500 security directives, use only VA-approved encryption (FIPS 140-2 validated), protect passwords, create strong credentials, follow electronic media sanitization procedures, complete required security and privacy training, use only authorized anti-virus and security software, report security incidents to the COTR, and obtain written approval before using non-VA equipment for storing or processing VA information. Additional restrictions prohibit dual network connections unless authorized and prohibit remote access to non-public VA information technology resources from publicly-available computers. The agreement includes a statement that it does not create enforceable litigation rights and requires contractor signature and acknowledgment within the timeframe specified in the solicitation.