Attachment A - VA SECURITY LANGUAGE

Department of Veterans Affairs
Washington, DC 20420

VA NOTICE 24-12

April 22, 2024

UPDATE TO VA HANDBOOK 6500.6, CONTRACT SECURITY, APPENDIX C VA

INFORMATION AND INFORMATION SYSTEM SECURITY/PRIVACY LANGUAGE

FOR INCLUSION INTO CONTRACTS, AS APPROPRIATE

1. PURPOSE: The purpose of this notice is to amend the Department of Veterans Affairs (VA) Handbook 6500.6, Contract Security, to include updated security language for Appendix C.

2. POLICY:

a. The Office of Information Security published VA Handbook 6500.6, Contract Security on March 12, 2010. This handbook is currently under revision and will incorporate many updates and changes but must go through departmental concurrence prior to publication.
b. This notice replaces VA Handbook 6500.6, Appendix C, VA Information and Information System Security/Privacy Language for Inclusion into Contracts, as appropriate, to incorporate updated security language.
c.

This change will take place immediately and should be applied to the current version of VA Handbook 6500.6 Appendix C.

3. RESPONSIBLE OFFICE: Office of Information and Technology (OIT) (005); Office of Information Security (005R).
4. RELATED HANDBOOK: VA Handbook 6500.6, Contract Security, dated March 12, 2010.
5. RESCISSION: This notice will be rescinded and guidance incorporated into the appropriate directive/handbook no later than one year after the date of publication.

CERTIFIED BY:

BY DIRECTION OF THE SECRETARY

OF VETERANS AFFAIRS:

/s/
Guy T. Kiyokawa
Assistant Secretary for
Enterprise Integration

/s/
Kurt D. DelBene
Assistant Secretary for
Information and Technology and
Chief Information Officer

DISTRIBUTION: Electronic Only

VA Handbook 6500.6

APPENDIX C

April 22, 2024

APPENDIX C — VA INFORMATION AND INFORMATION SYSTEM SECURITY AND

PRIVACY LANGUAGE FOR INCLUSION IN CONTRACTS, AS APPROPRIATE

NOTE: Any sections (1-14) which DO NOT apply should not be included in the Statement of Work (SOW), Performance Work Statement (PWS), Product Description (PD) or contract.
1. GENERAL. This entire section applies to all acquisitions requiring any Information Security and Privacy language. Contractors, contractor personnel, subcontractors and subcontractor personnel will be subject to the same federal laws, regulations, standards, VA directives and handbooks, as VA personnel regarding information and information system security and privacy.
2. VA INFORMATION CUSTODIAL LANGUAGE. This entire section applies to all acquisitions requiring any Information Security and Privacy language.