Appendix B.pdf

This document is VA Handbook Appendix B containing a solicitation provision and contract clause regarding information and information technology security requirements, effective March 12, 2010.

The clause establishes mandatory information security standards for VA contracts involving sensitive information or information technology resources. Under SUBPART 839.2, contracting officers must insert a security requirements clause in all solicitations and contracts where VA Sensitive Information or Information Technology will be accessed or utilized. The specific clause cited is 852.273-75, Security Requirements for Unclassified Information Technology Resources (Interim—October 2008). The clause stipulates that contractors, their personnel, and subcontractors must comply with all applicable Federal laws, regulations, standards, and VA Directives and Handbooks pertaining to information and information system security as delineated in the contract. This is intended to mitigate risks of data breach, compromise, or loss of information residing on VA-owned or contractor-owned systems. The document notes that the clause language was under official rulemaking and was submitted for public review through the Federal Register, with final approved language available through the Office of Acquisitions and Logistics Programs and Policy.