VA Information System Security Privacy Language.pdf

VA INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY language FOR Inclusion into

CONTRACTS

1. GENERAL

Contractors, contractor personnel, subcontractors, and subcontractor personnel shall be subject to the same Federal laws, regula ons, standards, and VA Direc ves and Handbooks as VA and VA personnel regarding informa on and informa on system security.

1. ACCESS to VA INFORMATION AND VA INFORMATION SYSTEMS

a. A contractor/subcontractor shall request logical (technical) or physical access to VA informa on and VA informa on systems for their employees, subcontractors, and affiliates only to the extent necessary to perform the services specified in the contract, agreement, or task order.

b. The contractor or subcontractor must no fy the Contrac ng Officer immediately when an employee working on a VA system or with access to VA informa on is reassigned or leaves the contractor or subcontractor’s employ. The Contrac ng Officer must also be no fied immediately by the contractor or subcontractor prior to an unfriendly termina on.

2. VA INFORMATION CUSTODIAL Language

a. Informa on made available to the contractor or subcontractor by VA for the performance or administra on of this contract or informa on developed by the contractor/subcontractor in performance or administra on of the contract shall be used only for those purposes and shall not be used in any other way without the prior wri en agreement of the VA. This clause expressly limits the contractor/subcontractor's rights to use data as described in Rights in Data - General, FAR 52.227-14(d) (1).

b. If VA determines that the contractor has violated any of the informa on confiden ality, privacy, security, and other provisions of the contract, it shall be sufficient grounds for VA to withhold payment to the contractor or third party or terminate the contract for default or terminate for cause under Federal Acquisi on Regula on (FAR) part 12.

3. SECURITY INCIDENT INVESTIGATION

a. The term “security incident” means an event that has, or could have, resulted in unauthorized access to, loss or damage to VA assets, or sensi ve informa on, or an ac on that breaches VA security procedures. The contractor/subcontractor shall immediately no fy the COTR and simultaneously, the designated ISO and Privacy Officer for the contract of any known or suspected security/privacy incidents, or any unauthorized disclosure of sensi ve informa on, including that contained in system(s) to which the contractor/subcontractor has access.

c. To the extent known by the contractor/subcontractor, the contractor/subcontractor’s no ce to VA shall iden fy the informa on involved, the circumstances surrounding the incident (including to whom, how, when, and where the VA informa on or assets were placed at risk or compromised), and any other informa on that the contractor/subcontractor considers relevant.

d. With respect to unsecured protected health informa on, the business associate is deemed to have discovered a data breach when the business associate knew or should have known of a breach of such informa on. Upon discovery, the business associate must no fy the covered en ty of the breach.

No fica ons need to be made in accordance with the executed business associate agreement.

e. In instances of the or break-in or other criminal ac vity, the contractor/subcontractor must concurrently report the incident to the appropriate law enforcement en ty (or en es) of jurisdic on, including the VA OIG and Security and Law Enforcement. The contractor, its employees, and its subcontractors and their employees shall cooperate with VA and any law enforcement authority responsible for the inves ga on and prosecu on of any possible criminal law viola on(s) associated with any incident. The contractor/subcontractor shall cooperate with VA in any civil li ga on to recover VA informa on, obtain monetary or other compensa on from a third party for damages arising from any incident, or obtain injunc ve relief against any third party arising from, or related to, the incident.

4. LIQUIDATED DAMAGES FOR DATA BREACH

a. Consistent with the requirements of 38 U.S.C. §5725, a contract may require access to sensi ve personal informa on. If so, the contractor is liable to VA for liquidated damages in the event of a data breach or privacy incident involving any SPI the contractor/subcontractor processes or maintains under this contract.

b. The contractor/subcontractor shall provide no ce to VA of a “security incident” as set forth in the Security Incident Inves ga on sec on above. Upon such no fica on, VA must secure from a non- Department en ty or the VA Office of Inspector General an independent risk analysis of the data breach to determine the level of risk associated with the data breach for the poten al misuse of any sensi ve personal informa on involved in the data breach. The term 'data breach' means the loss, the , or other unauthorized access, or any access other than that incidental to the scope of employment, to data containing sensi ve personal informa on, in electronic or printed form, that results in the poten al compromise of the confiden ality or integrity of the data. Contractor shall fully cooperate with the en ty performing the risk analysis. Failure to cooperate may be deemed a material breach and grounds for contract termina on.

c. Each risk analysis shall address all relevant informa on concerning the data breach, including the following:

(1) Nature of the event (loss, the , unauthorized access);

(2) Descrip on of the event, including:

(a) date of occurrence;

(b) data elements involved, including any PII, such as full name, social security number, date of birth, home address, account number, disability code;

(3) Number of individuals affected or poten ally affected;

(4) Names of individuals or groups affected or poten ally affected;

(5) Ease of logical data access to the lost, stolen or improperly accessed data in light of the degree of protec on for the data, e.g., unencrypted, plain text;

(6) Amount of me the data has been out of VA control;

(7) The likelihood that the sensi ve personal informa on will or has been compromised (made accessible to and usable by unauthorized persons);

(8) Known misuses of data containing sensi ve personal informa on, if any;

(9) Assessment of the poten al harm to the affected individuals;

(10) Data breach analysis as outlined in 6500.2 Handbook, Management of Security and Privacy Incidents, as appropriate; and

(11) Whether credit protec on services may assist record subjects in avoiding or mi ga ng the results of iden ty the based on the sensi ve personal informa on that may have been compromised.

f. Based on the determina ons of the independent risk analysis, the contractor shall be responsible for paying to the VA liquidated damages in the amount of $__37.50__ per affected individual to cover the cost of providing credit protec on services to affected individuals consis ng of the following:

(1) No fica on;

(2) One year of credit monitoring services consis ng of automa c daily monitoring of at least 3 relevant credit bureau reports;

(3) Data breach analysis;

(4) Fraud resolu on services, including wri ng dispute le ers, ini a ng fraud alerts and credit freezes, to assist affected individuals to bring ma ers to resolu on;

(5) One year of iden ty the insurance with $20,000.00 coverage at $0 deduc ble; and

(6) Necessary legal expenses the subjects may incur to repair falsified or damaged credit records, histories, or financial affairs.

5. TRAINING

a. All contractor employees and subcontractor employees requiring access to VA informa on and VA informa on systems shall complete the following before being granted access to VA informa on and its systems:

(1) Successfully complete the appropriate VA privacy training and annually complete required privacy training (See below training); and

(2) Successfully complete any addi onal cyber security or privacy training, as required for VA personnel with equivalent informa on system access

g. The contractor shall provide to the contrac ng officer and/or the COTR a copy of the training cer ficates for each applicable employee within 1 week of the ini a on of the contract and annually therea er, as required.

h. Failure to complete the mandatory annual training, within the meframe required, is grounds for suspension or termina on of all physical or electronic access privileges and removal from work on the contract un l such me as the training and documents are complete.

7. ADDITIONAL Requirements

a. The COR is responsible for coordina ng with the Police prior to contractor arrival to iden fy the names of contractor personnel so that Police can ensure sufficient number of contractor badges are available for issuance prior to beginning work. COR is also responsible for signing out and signing in temporary contractor badges.

b. The COR is also responsible for maintaining copies of signed Privacy training for all contractors according to RCS 10-1.

c. Any work performed outside of official VA business hours a er hours will require escorts.

d. Escort du es for un-cleared contractors are strictly limited to government officials, specifically VA employees. At no me are contractors allowed to escort other contractors.