Attachment 2-Contractors Rules of Behavior.pdf

This document is Appendix D to VA Handbook 6500.6, establishing Contractor Rules of Behavior for contractors performing services under Department of Veterans Affairs (VA) contracts.

The User Agreement covers contractor access to and use of VA data, information systems, and sites. Contractors acknowledge no reasonable expectation of privacy when accessing VA or Federal Government information systems and consent to monitoring, recording, copying, inspecting, and disclosure of their activities by authorized VA personnel, the Office of Information & Technology (OI&T), the VA Chief Information Officer (CIO), and law enforcement. Unauthorized attempts to access, upload, change, or delete information on Federal Government systems are prohibited and subject to criminal, civil, or administrative penalties under 18 U.S.C. §1030 and §2701. Contractors must comply with 14 specific behavioral rules including: following established procedures for account access; using only authorized systems and software; prohibiting use of non-contractor-owned equipment for VA sensitive information without approved waivers; refraining from exploiting system controls; not overriding security controls except as explicitly permitted; limiting system use to contract performance; granting access only to those with official need-to-know; protecting passwords; adhering to VA Handbook 6500 password requirements; using only FIPS 140-2 validated encryption for VA sensitive information; following electronic media sanitization procedures; obtaining COTR approval for public information dissemination; prohibiting unauthorized internet servers; protecting government property; using only VA-authorized anti-virus and firewall software; not disabling security software; understanding restoration of service concerns; and completing required information security and system-specific training. Additional restrictions apply to non-VA information technology resources, requiring direct connection to the VA network when possible and prohibiting dual network connections unless explicitly authorized. Contractors must not evade security requirements through subcontracting and must ensure subcontractors are bound by identical requirements. The agreement disclaims creation of litigation rights and requires contractors to sign and return the original agreement to the Contracting Officer's Technical Representative (COTR) within the timeframe specified in the contract terms.