6500 Rules of Behavior FY26.pdf

This document is an Appendix containing the Department of Veterans Affairs (VA) Information Security Rules of Behavior (ROB) for Organizational Users for Fiscal Year 2025.

The ROB establishes mandatory security and compliance requirements for all organizational users of VA information and information systems, including VA employees, contractors, researchers, students, trainees, volunteers, and representatives of Federal, state, local, or tribal agencies authorized to access VA resources. Organizational users must sign the ROB annually before gaining access to VA systems, with refusal to sign resulting in denied access and potential disciplinary action. The document outlines specific behavioral requirements across multiple categories: access and use of VA information systems (including compliance with federal statutes, use of only VA-approved devices, proper system access requests, and logout procedures); protection of VA-issued devices (securing devices, protecting from theft or loss, and prohibiting unauthorized hard drive transfers); data protection (using authorized antivirus software, safeguarding mobile devices, encrypting sensitive data, using VA email accounts, and prohibiting unauthorized cloud-based software or AI tools); teleworking and remote access (keeping government-furnished equipment secure, obtaining approval for remote access, obtaining international travel approvals, and prohibiting access from security-risk countries); user accountability (completing mandatory security training and permitting authorized personnel to review conduct); sensitive information handling (accessing only with need-to-know authorization, securing printed materials, restricting dissemination, encrypting emails containing sensitive data, and obtaining supervisor approval for remote use); identification and authentication (using VA-compliant passwords, protecting credentials, and maintaining required VA credentials); incident reporting (reporting security incidents to supervisors and the Enterprise Service Desk); and social media use (using VA intranet for business, obtaining public affairs approval, complying with VA directives, and using only VA-approved instant messaging services). Violations may result in civil or criminal penalties, suspension of access privileges, and disciplinary or adverse actions up to removal.