D.4 Contractor Rules of Behavior 36C24426R0047.pdf

This is a Contractor Rules of Behavior agreement that establishes information security and access controls for contractors performing services under Department of Veterans Affairs (VA) contracts. The document outlines the contractual terms governing contractor access to and use of VA information systems, data, and resources.

The agreement establishes comprehensive security and behavior standards requiring contractors to comply with VA security and data privacy directives, complete required information security and privacy training, and maintain strict limitations on system access to contract performance only. Contractors must follow established procedures for user account requests and closures, use only authorized systems and software, protect passwords and sensitive information, create passwords in accordance with VA Handbook 6500, use FIPS 140-2 validated encryption for VA sensitive information, report security incidents to the Contracting Officer's Technical Representative (COTR), obtain COTR approval for any public dissemination of VA information, prohibit hosting or operating internet servers related to VA access without authorization, and refrain from attempting to override security controls except as expressly permitted. Additional requirements include protecting government property from theft or misuse, using only VA-authorized anti-virus and firewall software, maintaining awareness of system restoration concerns, limiting remote access to VA networks through approved methods only, and prohibiting dual network connections unless explicitly authorized. Contractors and their subcontractors are subject to criminal, civil, and administrative penalties for unauthorized access or misuse of federal systems under 18 U.S.C. §1030 and §2701. The document requires contractors to sign and return the original agreement to the COTR within the timeframe specified in the contract terms.