ATTACHMENT C VA HANDBOOK 6500.6 CONTRACT SECURITY.pdf

This document is an appendix to VA Handbook 6500.6, specifically Appendix C, which provides comprehensive information and security language for inclusion in VA contracts. The appendix covers 14 distinct sections detailing information security and privacy requirements for contractors, including guidelines for VA information custodial language, access to VA information systems, training, security incident investigation, information system hosting, product integrity, virus and malware prevention, cryptographic requirements, and specialized device security.

Key requirements include contractors must comply with federal laws and VA directives regarding information security, protect VA sensitive information, undergo security training, report security incidents immediately, ensure cryptographic system integrity, prevent malware introduction, and submit to periodic assessments and audits. The document emphasizes protecting VA data confidentiality, integrity, and availability across all stages of contract performance, from initial system design and development to maintenance, operation, and eventual data destruction. Contractors must use VA-approved encryption methods, secure network connections, patch systems promptly, and maintain strict controls over VA information accessed during contract work.