VAAR 852.204-72, Personnel Vetting and Credentialing. MARCH 2026.docx

VAAR 852.204-72, Personnel Vetting and Credentialing. (MARCH 2026)

(a) Definitions. As used in this clause – VA Information system is the same as information system and means, pursuant to 38 U.S.C. 5727, a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information whether automated or manual.

VA sensitive information means all VA data, on any storage media or in any form or format, which requires protection due to the risk of harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the information and includes sensitive personal information. The term includes information where improper use or disclosure could adversely affect the ability of VA to accomplish its mission, proprietary information, records about individuals requiring protection under various confidentiality provisions such as the Privacy Act and the HIPAA Privacy Rule, and information that can be withheld under the Freedom of Information Act. Examples of VA sensitive information include the following: individually-identifiable medical, benefits, and personnel information; financial, budgetary, research, quality assurance, confidential commercial, critical infrastructure, investigatory, and law enforcement information; information that is confidential and privileged in litigation such as information protected by the deliberative process privilege, attorney work-product privilege, and the attorney client privilege; and other information which, if released, could result in violation of law or harm or unfairness to any individual or group, or could adversely affect the national interest or the conduct of Federal programs.

(b) General. Contractor personnel assigned to work for or on behalf of VA must undergo a background investigation commensurate with the risk and sensitivity level designation associated with the work to be performed at the level indicated in the contract. The Contractor and subcontractors shall comply with VA Directive/Handbook 0710, Personnel Security and Suitability Program, which can be accessed at: https://vaww.va.gov/vapubs/index.cfm

(c) Risk and Sensitivity Levels. The following table identifies the risk and sensitivity levels that apply to any personnel providing services under this contract.

*VA Administrations, organizations and staff offices will use the OPM Position Designation Tool.

Positions/Tasks Designated as Non-Sensitive Positions - Tier 1/Low Risk

Workers’ Compensation Recovery Assistance

Positions/Tasks Designated as Non-Sensitive Positions- Tier 2/Mod Risk

Not Applicable

Not Applicable

Not Applicable

Positions/Tasks Designated as Non-Sensitive Positions - Tier 4/High Risk

Not Applicable

Not Applicable

Not Applicable

Security clearances are granted to individuals with a specific requirement for access to classified material (for example, Confidential, Secret and Top Secret). Contractor personnel that are required to obtain a security clearance will be subject to a Tier 3 or Tier 5 investigation. The following sensitivity designations have been assigned for the identified Tier 3 and Tier 5 required by this contract:

Tier 3: Not Applicable Tier 5: Not Applicable

(d) Fitness. The results from a background investigation are used to determine if an individual’s fitness is sufficient for that individual to perform work for or on behalf of VA in the position identified in this contract. Contractor fitness determinations are made in accordance with 5 CFR Part 731.202.

Fitness requirements for employment are separate and distinct from job qualifications. If a Contractor or subcontractor employee is found to be unsuitable or unfit to provide services under this contract, the Contractor shall immediately remove the employee from working on this contract and take those necessary steps that restrict the employee’s logical access to VA data, information, VA sensitive information, or information technology or VA information systems containing such data or information.

The Contractor shall advise the employee that they are not permitted to access any VA controlled building or real property in relation to this contract. The removal of an unfit Contractor or subcontractor employee does not alleviate the Contractor from satisfying the requirements of this contract. The Government will not reimburse the Contractor for any costs associated with the recruitment/replacement of an employee or subcontractor employee who is found to be unfit.

(e) Identification Cards. The Government will provide a Personal Identification Verification (PIV) card or other identification card, as necessary, to fit Contractor personnel who require physical access to VA facilities and/or logical access to VA data, information, VA sensitive information, or information technology or VA information systems containing such data or information. Contractor and subcontractor personnel shall prominently display their PIV/identification card on their persons while working at a VA facility and shall present their PIV/identification card for inspection upon request by a VA official. The Contractor must surrender the employee or subcontractor employee’s PIV/identification card in accordance with the requirements set forth in Directive/Handbook 0735 when any of the following events occur:

1. When no longer needed for contract performance.

2. Upon completion of the Contractor/subcontractor employee’s employment.

3. Upon contract completion or termination.

(f) Lost/stolen. Immediately upon detection, the Contractor shall report a lost or stolen PIV/identification card to the Government authorities as identified in Directive/Handbook 0735. Within 48 hours of reporting the lost/stolen PIV/identification card, the Contractor shall submit to the Program Manager an incident report that describes the relevant facts and circumstances regarding the loss/theft. If the loss/theft was reported by the Contractor to the local police, the Contractor shall further submit a copy of the final police report to the Program Manager within 48 hours of the report being made available by the local police department. The Government will not reimburse the Contractor for any costs that result from lost/stolen PIV/identification card(s).

(g) Regular Reporting. The Contractor shall submit a status report to PIV Sponsor within 5 working days after the end of each calendar quarter and as requested by the Government in order to initiate contract closeout procedures. The report must provide the status of each contractor/subcontractor employee who is required to have a PIV/identification card during the performance of the contract. The report shall identify the Contractor and the contract number, and list the following status for each contractor/subcontractor employee who holds a PIV/identification card under this contract:

1. Contractor/subcontractor employee name.

2. Name of VA facility where Contractor/subcontractor employee works, if applicable.

3. Date background check submitted for Contractor/subcontractor employee.

4. Date PIV/identification card issued to Contractor/subcontractor employee.

5. Contractor/subcontractor employee’s PIV/identification card number, as applicable.

6. Date Contractor/subcontractor employee no longer has need for PIV/identification card.

7. Date Contractor notified VA that PIV/identification card is no longer required.

8. Date Contractor returned PIV/identification card was returned to VA.

(h) Flow down of clause. The Contractor shall include the substance of this clause in subcontracts, third-party agreements, and BAA’s, in which subcontractors, third-party servicers/employees, and business associates will perform functions where they will have physical access to a VA facility or logical access to VA data, information, VA sensitive information, or information technology or VA information system containing such data or information.

(End of clause)