S02 Atch F VA6500 Appendix C 1-5 - 2 pages.pdf
PDF 101 KB Posted
- Attached to
- Replace Operating Room 5 Flooring
- Solicitation number
- 36C26327Q0019
About this file
This is an appendix containing VA information and information system security/privacy language for inclusion in federal contracts. Section 5 establishes security incident investigation and reporting requirements that apply to all acquisitions requiring information security and privacy language.
Contractors, subcontractors, and their employees must immediately report suspected security or privacy incidents to the VA OIT's Enterprise Service Desk (ESD) by calling (855) 673-4357 within one hour, then provide the incident number to the Contracting Officer Representative (COR) or Contracting Officer (CO) within one hour of initial report. Incident notices must identify information involved and circumstances including the date, time, individuals involved, physical and logical location, catalyst for failure, amount of data compromised, and remediation measures. Contractors must provide written updates on new findings and fully cooperate with VA or third-party independent risk analysis, with failure to cooperate deemed material breach and grounds for termination. For criminal activities including theft, break-in, or other violations, contractors must concurrently report to appropriate law enforcement, VA OIG, and VA Office of Security and Law Enforcement. Contractors must comply with VA Handbook 6500.2 regarding breach management of sensitive personal information. For unsecured Protected Health Information (PHI), breach discovery occurs when contractor knew or should have known of the breach, with notification to covered entities following executed Business Associate Agreements (BAA). Contractors failing to protect VA sensitive personal information or engaging in conduct resulting in data breaches involving VA sensitive information must pay liquidated damages per clause 852.211-76, Liquidated Damages—Reimbursement for Data Breach Costs.
View the file
Other files
Show all 11
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
VA HANDBOOK 6500.6
APPENDIX C - VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY
LANGUAGE FOR INCLUSION INTO CONTRACTS
1. GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.
5. SECURITY INCIDENT INVESTIGATION. This entire section applies to all acquisitions requiring any Information Security and Privacy language.
a. The contractor, subcontractor, their employees, or business associates shall immediately (within one hour) report suspected security / privacy incidents to the VA OIT’s Enterprise Service Desk (ESD) by calling (855) 673-4357 (TTY: 711). The ESD is OIT’s 24/7/365 single point of contact for IT-related issues. After reporting to the ESD, the contractor, subcontractor, their employees, or business associates shall, within one hour, provide the COR/CO the incident number received from the ESD.
b. To the extent known by the contractor/subcontractor, the contractor/ subcontractor's notice to VA shall identify the information involved and the circumstances surrounding the incident, including the following:
(1) The date and time (or approximation of) the Security Incident occurred.
(2) The names of individuals involved (when applicable).
(3) The physical and logical (if applicable) location of the incident.
(4) Why the Security Incident took place (i.e., catalyst for the failure).
(5) The amount of data belonging to VA believed to have been compromised.
(6) The remediation measures the contractor is taking to ensure no future incidents of a similar nature.
c. After the contractor has provided the initial detailed incident summary to VA, they will continue to provide written updates on any new and relevant circumstances or facts they discover. The contractor, subcontractor, and their employes shall fully cooperate with VA or third-party entity performing an independent risk analysis on behalf of VA. Failure to cooperate may be deemed a material breach and grounds for contract termination.
d. VA IT contractors shall follow VA Handbook 6500, Risk Management Framework for VA Information Systems VA Information Security Program, and VA Information Security Knowledge Service guidance for implementing an Incident Response Plan or integrating with an existing VA implementation.
e. In instances of theft or break-in or other criminal activity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement entity (or entities) of jurisdiction, including the VA OIG, and the VA Office of Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the investigation and prosecution of any possible criminal law violation(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil litigation to recover VA information, obtain monetary or other compensation from a third party for damages arising from any incident, or obtain injunctive relief against any third party arising from, or related to, the incident.
f. The contractor shall comply with VA Handbook 6500.2, Management of Breaches Involving Sensitive Personal Information, which establishes the breach management policies and assigns responsibilities for the oversight, management and reporting procedures associated with managing of breaches.
g. With respect to unsecured Protected Health Information (PHI), the contractor is deemed to have discovered a data breach when the contractor knew or should have known of breach of such information. When a business associate is part of VHA contract, notification to the covered entity (VHA) shall be made in accordance with the executed BAA.
h. If the contractor or any of its agents fails to protect VA sensitive personal information or otherwise engages in conduct which results in a data breach involving any VA sensitive personal information the contractor/subcontractor processes or maintains under the contract;
the contractor shall pay liquidated damages to the VA as set forth in clause 852.211-76, Liquidated Damages—Reimbursement for Data Breach Costs.
File details come from the government source that posted it. Updated .