# 86 FR 64132: VA Acquisition Regulation: Acquisition of Information Technology; and Other Contracts for Goods and Services Involving Information, VA Sensitive Information, and Information Security; and Liquidated Damages Requirements for Data Breach

> Federal · Regulations · In force

URL: https://www.frixlaw.com/law-library/statutes/FR_PRORULE_2021-24299

## Section

- **Citation:** 86 FR 64132
- **Heading:** VA Acquisition Regulation: Acquisition of Information Technology; and Other Contracts for Goods and Services Involving Information, VA Sensitive Information, and Information Security; and Liquidated Damages Requirements for Data Breach
- **Jurisdiction:** Federal
- **Kind:** Regulations
- **Status:** In force
- **Text as of:** August 14, 2026
- **Source:** Compiled text
- **Location:** Federal Register / Vol. 86 / 86 FR 64132

## Text

DEPARTMENT OF VETERANS AFFAIRS 48 CFR Parts 802, 804, 811, 812, 824, 839, and 852 RIN 2900-AQ41 VA Acquisition Regulation: Acquisition of Information Technology; and Other Contracts for Goods and Services Involving Information, VA Sensitive Information, and Information Security; and Liquidated Damages Requirements for Data Breach AGENCY:
Department of Veterans Affairs.

ACTION:
Proposed rule.

SUMMARY:
The Department of Veterans Affairs (VA) is proposing to amend and update its VA Acquisition Regulation (VAAR) in phased increments to revise or remove any policy superseded by changes in the Federal Acquisition Regulation (FAR), to remove procedural guidance internal to VA into the VA Acquisition Manual (VAAM), and to incorporate any new agency specific regulations or policies. This rulemaking revises the VAAR by adding a part covering Acquisition of Information

DATES:
Comments must be received on or before January 18, 2022 to be considered in the formulation of the final rule.

ADDRESSES:
Written comments may be submitted through www.Regulations.gov or mailed to Mr. Rafael Taylor, 003A2A, Department of Veterans Affairs, Procurement Policy and Warrant Management Services (PPS), 810 Vermont Avenue NW, Washington, DC 20420. Comments should indicate that they are submitted in response to “RIN 2900-AQ41—VA Acquisition Regulation: Acquisition of Information Technology; and Other Contracts for Goods and Services involving Information, VA Sensitive Personal Information, and Information Security, and Liquidated Damages Requirements for Data Breach.” Comments received will be available at regulations.gov for public viewing, inspection or copies.
FOR FURTHER INFORMATION CONTACT:
Mr. Rafael N. Taylor, Senior Procurement Analyst, Procurement Policy and Warrant Management Services, 003A2A, 810 Vermont Avenue NW, Washington, DC 20420, (202) 714-8560
nal Information, and Information Security, and Liquidated Damages Requirements for Data Breach.” Comments received will be available at regulations.gov for public viewing, inspection or copies.
FOR FURTHER INFORMATION CONTACT:
Mr. Rafael N. Taylor, Senior Procurement Analyst, Procurement Policy and Warrant Management Services, 003A2A, 810 Vermont Avenue NW, Washington, DC 20420, (202) 714-8560. (This is not a toll-free number.)

SUPPLEMENTARY INFORMATION:
Background
This rulemaking is issued under the authority of the Office of Federal Procurement Policy (OFPP) Act which provides the authority for an agency head to issue agency acquisition regulations that implement or supplement the FAR.
VA is proposing to revise the VAAR to add new policy or regulatory requirements, to update existing policy, and to remove any redundant guidance where it may exist in affected parts, and to place guidance that is applicable only to VA's internal operating processes or procedures in the VAAM. Codified acquisition regulations may be amended and revised only through rulemaking. All amendments, revisions, and removals have been reviewed and concurred with by VA's Integrated Product Team of agency stakeholders.
The VAAR uses the regulatory structure and arrangement of the FAR and headings and subject areas are consistent with the FAR content. The VAAR is divided into subchapters, parts (each of which covers a separate aspect of acquisition), subparts, sections, and subsections.
The Office of Federal Procurement Policy Act, as codified in 41 U.S.C. 1707, provides the authority for the Federal Acquisition Regulation and for the issuance of agency acquisition regulations consistent with the FAR.
When Federal agencies acquire supplies and services using appropriated funds, the purchase is governed by the FAR, set forth at title 48 Code of Federal Regulations (CFR), chapter 1, parts 1 through 53, and the agency regulations that implement and supplement the FAR
e authority for the Federal Acquisition Regulation and for the issuance of agency acquisition regulations consistent with the FAR.
When Federal agencies acquire supplies and services using appropriated funds, the purchase is governed by the FAR, set forth at title 48 Code of Federal Regulations (CFR), chapter 1, parts 1 through 53, and the agency regulations that implement and supplement the FAR. The VAAR is set forth at title 48 CFR, chapter 8, parts 801 through 873.
Discussion and Analysis
VA proposes to make the following changes to the VAAR in this phase of its revision and streamlining initiative. This rule adds a new VAAR part 839 along with proposed revisions to other parts as described below. Where necessary, procedural guidance has been considered for inclusion in VA's internal agency operating procedures in accordance with FAR 1.301(a)(2). Similarly, delegations of authorities will be included in the VA Acquisition Manual (VAAM) as internal agency guidance. These changes seek to streamline and align the VAAR with the FAR and remove outdated and duplicative requirements and reduce burden on contractors. The VAAM incorporates portions of the removed VAAR as well as other internal agency acquisition procedures. VA will rewrite certain parts of the VAAR and VAAM, and as VAAR parts are rewritten, will publish them in the Federal Register . VA will combine related topics, as appropriate. The VAAM is being created in parallel with these revisions to the VAAR and is not subject to the rulemaking process as the VAAM contains internal VA procedures and guidance. Therefore, the VAAM will not be finalized and available online for any new parts until corresponding VAAR parts are finalized
written, will publish them in the Federal Register . VA will combine related topics, as appropriate. The VAAM is being created in parallel with these revisions to the VAAR and is not subject to the rulemaking process as the VAAM contains internal VA procedures and guidance. Therefore, the VAAM will not be finalized and available online for any new parts until corresponding VAAR parts are finalized.
VAAR Part 802—Definitions of Words and Terms
VA proposes to add the following 11 definitions in section 802.101 to reflect terms VA uses in more than one part as related to the amendatory text, parts and clauses and provisions outlined in this VAAR case: Business Associate, Business Associate Agreement (BAA), Gray market items, Information system, Information technology, Information technology-related contracts, Privacy officer, Security plan, Sensitive personal information, VA Information Security Rules of Behavior for Organizational Users, and VA sensitive information.
VAAR Part 804—Administrative and Information Matters
We propose to add the following authorities to part 804:
• 38 U.S.C. 5723, which requires all users of VA information and information systems to (1) Comply with all VA security policies, procedures, and practices; (2) Take security awareness training on at least an annual basis; (3) Report all actual or suspected security and privacy incidents immediately to the Information System Security Officer (ISSO) or Privacy Officer of the facility and to their immediate supervisor (in VA contracts contractors will be required to report security incidents to the contracting officer and the contractor officer's representative (COR), as identified or directed in the contract, within one hour of discovery or suspicion); and (4) Sign and acknowledge VA's Information Security Rules of Behavior for Organizational Users ( i.e., “VA National Rules of Behavior”) on an annual basis;
• 38 U.S.C
racts contractors will be required to report security incidents to the contracting officer and the contractor officer's representative (COR), as identified or directed in the contract, within one hour of discovery or suspicion); and (4) Sign and acknowledge VA's Information Security Rules of Behavior for Organizational Users ( i.e., “VA National Rules of Behavior”) on an annual basis;
• 38 U.S.C. 5724, which requires VA, in the event the Secretary determines there exists a reasonable risk for the potential misuse of sensitive personal information involved in a data breach, to provide credit protection services, as well as notification to the affected individual; and
• 38 U.S.C. 5725(a)-(c), which requires the Secretary to ensure that if a contract is entered into for the performance of any Department function that requires access to sensitive personal information include, as a condition of the contract, that a contractor shall not, directly or through an affiliate of the contractor, disclose such information to any other person unless the disclosure is lawful and is expressly permitted under the contract. This statute also requires the contractor, or any subcontractors under the contract, to promptly notify VA (within one hour of discovery or suspicion) of any actual or suspected data breach that occurs with respect to sensitive personal information. It further requires that each such contract is subject to liquidated damages to be paid by the contractor to VA in the event of a data breach of any sensitive personal information
VA proposes to amend part 804 by adding subpart 804.19, Basic Safeguarding of Covered Contractor Information Systems, and sections 804.1900-70, Scope of subpart; 804.1902, Applicability; 804.1970, Information security policy—contractor general responsibilities; and 804.1903, Contract clause
ges to be paid by the contractor to VA in the event of a data breach of any sensitive personal information
VA proposes to amend part 804 by adding subpart 804.19, Basic Safeguarding of Covered Contractor Information Systems, and sections 804.1900-70, Scope of subpart; 804.1902, Applicability; 804.1970, Information security policy—contractor general responsibilities; and 804.1903, Contract clause.
In section 804.1900-70, Scope of subpart, it would state that the subpart prescribes policies and procedures for information security and protection of VA information, information systems, and VA sensitive information, including sensitive personal information.
In section 804.1902, Applicability, VA stipulates that the subpart would apply to all VA acquisitions, including acquisitions of commercial items other than commercially available off-the-shelf items, when a contractor's information system may contain VA information.
In section 804.1970, Information security policy—contractor general responsibilities, VA provides policy requiring contractors, subcontractors, business associates and their employees who are users of VA information or information systems, or have access to VA information and VA sensitive information to—
• Comply with all VA information security program policies, procedures, practices and related contract requirements, specifications and clauses;
• Complete VA security awareness training on an annual basis;
• Complete VHA's Privacy and Health Insurance Portability and Accountability Act of 1996 (HIPAA) Training on an annual basis when access to protected health information (PHI) is required;
• Report all actual or suspected security/privacy incidents and reporting information to the contracting officer, and COR as identified or as directed in the contract, within one hour of discovery or suspicion;
• Comply with VA policy as it relates to personnel security and suitability program requirements for background screening of both employees and non-employees who have access to VA informati
Report all actual or suspected security/privacy incidents and reporting information to the contracting officer, and COR as identified or as directed in the contract, within one hour of discovery or suspicion;
• Comply with VA policy as it relates to personnel security and suitability program requirements for background screening of both employees and non-employees who have access to VA information systems and data;
• Comply with directions that may be issued by the contracting officer or COR, or from the VA Assistant Secretary for Information and Technology or a designated representative through the contracting officer or COR, directing specific activities when a security/privacy incident occurs;
• Sign an acknowledgment that they have read, understand, and agree to abide by the VA Information Security Rules of Behavior for Organizational Users (VA National Rules of Behavior) as required by 38 U.S.C. 5723, FAR 39.105, Privacy, and clause 852.204-71, Information and Information Systems Security, on an annual basis. The VA Information Security Rules of Behavior describe the responsibilities and expected behavior of contractors, subcontractors, business associates and their employees who are users of VA information or information systems, information assets and resources, or have access to VA information;
• Maintain records and compliance reports regarding HIPAA Security and Privacy Rule compliance in order to provide such information to VA upon request to ascertain whether the business associate is complying with all applicable provisions under both rules' regulatory requirements; and
• Flow down requirements in all subcontracts and Business Associate Agreements (BAAs), at any level, as provided in the clause at 852.204-71, Information and Information Systems Security
vacy Rule compliance in order to provide such information to VA upon request to ascertain whether the business associate is complying with all applicable provisions under both rules' regulatory requirements; and
• Flow down requirements in all subcontracts and Business Associate Agreements (BAAs), at any level, as provided in the clause at 852.204-71, Information and Information Systems Security.
Section 804.1903, Contract clause, would require contracting officers to insert clause 852.204-71, Information and Information Systems Security, as further described in VAAR part 852 below in the preamble, when FAR clause 52.204-1, Basic Safeguarding of Covered Contractor Information Systems is required to be included in accordance with FAR 4.1903.
VAAR Part 811—Describing Agency Needs
We propose to add the following authorities to supplement the existing authorities for the proposed policies and procedures under part 811 as follows:
• 38 U.S.C. 5723, which requires all users of VA information and information systems to (1) Comply with all VA security policies, procedures, and practices; (2) Take security awareness training on at least an annual basis; (3) Report all actual or suspected security and privacy incidents and report the information to the appropriate Information System Security Officer (ISSO) or Privacy Officer of the facility and to their immediate supervisor (in VA contracts contractors will be required to report security incidents to the contracting officer and the contractor officer's representative (COR), as identified or directed in the contract, within one hour of discovery or suspicion); and (4) Sign and acknowledge VA's Information Security Rules of Behavior for Organizational Users ( i.e., VA National Rules of Behavior) on an annual basis.
• 38 U.S.C
ntracts contractors will be required to report security incidents to the contracting officer and the contractor officer's representative (COR), as identified or directed in the contract, within one hour of discovery or suspicion); and (4) Sign and acknowledge VA's Information Security Rules of Behavior for Organizational Users ( i.e., VA National Rules of Behavior) on an annual basis.
• 38 U.S.C. 5724, which requires VA, in the event the Secretary determines there exists a reasonable risk for the potential misuse of sensitive personal information involved in a data breach, to provide credit protection services, as well as notification to the affected individual.
• 38 U.S.C. 5725(a)-(c), which requires the Secretary to ensure that if a contract is entered into for the performance of any Department function that requires access to sensitive personal information include, as a condition of the contract, that a contractor shall not, directly or through an affiliate of the contractor, disclose such information to any other person unless the disclosure is lawful and is expressly permitted under the contract. This statute also requires the contractor, or any subcontractors under the contract, to promptly notify VA (within one hour of discovery or suspicion) of any actual or suspected data breach that occurs with respect to sensitive personal information. It further requires that each such contract is subject to liquidated damages to be paid by the contractor to VA in the event of a data breach of any sensitive personal information processed or maintained by the contractor or any subcontractor under the contract. Such liquidated damages will be used for the purpose of VA providing credit protection services
espect to sensitive personal information. It further requires that each such contract is subject to liquidated damages to be paid by the contractor to VA in the event of a data breach of any sensitive personal information processed or maintained by the contractor or any subcontractor under the contract. Such liquidated damages will be used for the purpose of VA providing credit protection services.
We propose to add a new subpart 811.5, Liquidated damages, including underlying sections as follows:
We propose to add 811.500, Scope, that would provide that the subpart is to prescribe policies and procedures for using a liquidated damages clause in solicitations and contracts that involve sensitive personal information. It also states that it pertains to any solicitations and contracts involving sensitive personal information issued by another agency for or on behalf of VA through an interagency acquisition in accordance with (IAW) FAR subpart 17.5 and VAAR subpart 817.5.
We propose to add 811.501-70, Policy—statutory requirement, that provides that contracting officers are required to include a liquidated damages clause pertaining to the protection of sensitive personal information in accordance with 38 U.S.C. 5725(b), to be paid by the contractor to the VA for the provision of credit protection services to affected individuals pursuant to 38 U.S.C. 5724(b) in the event of a data breach with respect to any sensitive personal
We propose to add 811.503-70, Contract clause, that would prescribe new clause 852.211-76, Liquidated Damages—Reimbursement for Data Breach Costs, as described in the section describing the proposed revisions to part 852 in this preamble
ovision of credit protection services to affected individuals pursuant to 38 U.S.C. 5724(b) in the event of a data breach with respect to any sensitive personal
We propose to add 811.503-70, Contract clause, that would prescribe new clause 852.211-76, Liquidated Damages—Reimbursement for Data Breach Costs, as described in the section describing the proposed revisions to part 852 in this preamble. The proposed clause would be required to be incorporated in VA solicitations, contracts, purchase orders, and other instruments (for both commercial and non-commercial acquisitions, as well as when using the procedures of FAR parts 8 and/or 12, or FAR part 13 as described in the Alternate versions of the clause), when access to sensitive personal information (as defined in 38 U.S.C. 5727 and in part 839) is required whether as a contractor, subcontractor, business associate or an employee of one of these entities. The clause—
• Would prohibit the disclosure of sensitive personal information to any other person or entity unless the disclosure is lawful and is expressly permitted under the contract;
• Would require contractors, subcontractors, business associates or their employees to promptly notify the contracting officer and the contracting officer's representative (COR), of any security incident that occurs involving sensitive personal information; and
• Would require that if the contractor fails to protect sensitive personal information, the contractor shall, in the event of a data breach, in place of actual damages, pay to the Government liquidated damages per affected individual in an amount to be specified and inserted by the contracting officer in accordance with current VA internal policy. The amount to be inserted by the contracting officer would represent an estimate of the cost per affected individual for VA to provide credit protection services ( e.g., notification, credit monitoring and related support) for individuals affected by a data breach
affected individual in an amount to be specified and inserted by the contracting officer in accordance with current VA internal policy. The amount to be inserted by the contracting officer would represent an estimate of the cost per affected individual for VA to provide credit protection services ( e.g., notification, credit monitoring and related support) for individuals affected by a data breach.
VAAR Part 812—Acquisition of Commercial Items
We propose to amend 812.301, Solicitation provisions and contract clauses for the acquisition of commercial items, by removing a prescription for clause 852.212-70. This clause, which required contracting officers to review and check provisions and clauses that apply, has been removed as unnecessary and redundant to the normal selection process for provisions and clauses.
This section will also be amended by removing a prescription for clause 852.212-71, Gray Market Items, and to add prescriptions for two new clauses: 852.212-71, Gray Market and Counterfeit Items, and 852.212-72, Gray Market and Counterfeit Items—Information Technology Maintenance Allowing Other-than-New Parts. The new clauses were originally released as a VAAR Class Deviation and will be codified via this rule.
VAAR Part 824—Protection of Privacy and Freedom of Information
We propose to add the following authorities to part 824:
• 38 U.S.C. 5723, which requires all users of VA information and information systems to (1) Comply with all VA security policies, procedures, and practices; (2) Take security awareness training on at least an annual basis; (3) Report all actual or suspected security and privacy incidents immediately to the Information System Security Officer (ISSO) or Privacy Officer of the facility and to their immediate supervisor (in VA contracts contractors will be required to report security incidents to the contracting officer and the contractor officer's representative (COR)), as identified or directed in the contract, within one hour of discovery or suspicion); and (4) Sign and
incidents immediately to the Information System Security Officer (ISSO) or Privacy Officer of the facility and to their immediate supervisor (in VA contracts contractors will be required to report security incidents to the contracting officer and the contractor officer's representative (COR)), as identified or directed in the contract, within one hour of discovery or suspicion); and (4) Sign and acknowledge VA's Information Security Rules of Behavior for Organizational Users ( i.e., “VA National Rules of Behavior”) on an annual basis.
• 38 U.S.C. 5724, which requires VA, in the event the Secretary determines there exists a reasonable risk for the potential misuse of sensitive personal information involved in a data breach, to provide credit protection services, as well as notification to the affected individual.
• 38 U.S.C. 5725 (a)-(c), which requires the Secretary to ensure that if a contract is entered into for the performance of any Department function that requires access to sensitive personal information include, as a condition of the contract, that a contractor shall not, directly or through an affiliate of the contractor, disclose such information to any other person unless the disclosure is lawful and is expressly permitted under the contract. This statute also requires the contractor, or any subcontractors under the contract, to promptly notify VA (within one hour of discovery or suspicion) of any actual or suspected data breach that occurs with respect to sensitive personal information. It further requires that each such contract is subject to liquidated damages to be paid by the contractor to VA in the event of a data breach of any sensitive personal information processed or maintained by the contractor or any subcontractor under the contract. Such liquidated damages will be used for the purpose of VA providing credit protection services
espect to sensitive personal information. It further requires that each such contract is subject to liquidated damages to be paid by the contractor to VA in the event of a data breach of any sensitive personal information processed or maintained by the contractor or any subcontractor under the contract. Such liquidated damages will be used for the purpose of VA providing credit protection services.
We propose to amend VAAR part 824 under subpart 824.1, Protection of Individual Privacy, by adding sections 824.103-70, Protection of privacy—general requirements and procedures related to Business Associate Agreements, and 824.103-71, Liquidated damages—protection of information.
We propose to add 824.103-70, Protection of privacy—general requirements and procedures related to Business Associate Agreements (BAAs), to establish policy. This would ensure compliance with unique responsibilities to protect protected health information, and require contractors performing under VA contracts subject to unique PHI and Health Insurance Portability and Accountability Act (HIPAA) to comply with requirements in this section. It describes the requirement for a Business Associate Agreement and when that applies. It describes that the Veterans Health Administration (VHA) is a HIPAA Covered Entity. VHA is the only administration of the Department of Veterans Affairs that is a HIPAA Covered Entity under the HIPAA Privacy Rule. It would further require that contractors or entities required to execute BAAs for contracts and other agreements become VHA business associates. It also describes those instances where other components within VA Administrations may also provide certain services and support to VHA and must receive PHI in order to do so
f Veterans Affairs that is a HIPAA Covered Entity under the HIPAA Privacy Rule. It would further require that contractors or entities required to execute BAAs for contracts and other agreements become VHA business associates. It also describes those instances where other components within VA Administrations may also provide certain services and support to VHA and must receive PHI in order to do so. If these components award contracts or enter into other agreements, purchase/delivery orders, modifications and issue governmentwide purchase card transactions to help in the delivery of these services to VHA, they will also fall within the requirement to obtain a satisfactory assurance from these contractors by executing a BAA. Basically, it would require contractors, subcontractors, and their employees, where HIPAA protected health information (PHI) is created, received, maintained, or transmitted, or that will be stored, generated, accessed, exchanged, processed, or utilized in order to perform certain health care operations activities or functions on behalf of the Veterans Health Administration (VHA) as a covered entity, to execute a BAA.
In 824.103-71, Liquidated damages—protection of information, it reinforces the applicability of a liquidated damages clause as prescribed at 811.503-70 when performance under a contract requires a contractor to enter
VAAR Part 839—Acquisition of Information Technology
We propose to add part 839, Acquisition of Information Technology, to implement and supplement FAR part 39, Acquisition of Information Technology, to incorporate, in consonance and together with the FAR, VA policies, procedures, and contract clauses necessary to control the relationship between VA and contractors or prospective contractors concerning unique aspects of the acquisition of information technology or service contracts related to information technology.
We propose to include the following authorities as the authority for the proposed policies and procedures under part 839: 38 U.S.C
R, VA policies, procedures, and contract clauses necessary to control the relationship between VA and contractors or prospective contractors concerning unique aspects of the acquisition of information technology or service contracts related to information technology.
We propose to include the following authorities as the authority for the proposed policies and procedures under part 839: 38 U.S.C. 5723; 5724; 5725(a)-(c); 40 U.S.C. 121(c); 40 U.S.C. 11319(b)(1)(C); 41 U.S.C. 1121(c)(3); 1303 and 1702; and 48 CFR 1.301-1.304. The authorities are described as follows—
• 38 U.S.C. 5723, which requires all users of VA information and information systems to (1) Comply with all VA security policies, procedures, and practices; (2) Take security awareness training on at least an annual basis; (3) Report all actual or suspected security and privacy incidents to the Information System Security Officer (ISSO) or Privacy Officer of the facility and to their immediate supervisor (in VA contracts contractors will be required to report security incidents to the contracting officer and the contractor officer's representative (COR), as identified or directed in the contract, within one hour of discovery or suspicion); and (4) Sign and acknowledge VA's Information Security Rules of Behavior for Organizational Users ( i.e., “VA National Rules of Behavior”) on an annual basis;
• 38 U.S.C. 5724, which requires VA, in the event the Secretary determines there exists a reasonable risk for the potential misuse of sensitive personal information involved in a data breach, to provide credit protection services, as well as notification to the affected individual;
• 38 U.S.C
ules of Behavior for Organizational Users ( i.e., “VA National Rules of Behavior”) on an annual basis;
• 38 U.S.C. 5724, which requires VA, in the event the Secretary determines there exists a reasonable risk for the potential misuse of sensitive personal information involved in a data breach, to provide credit protection services, as well as notification to the affected individual;
• 38 U.S.C. 5725(a)-(c), which requires the Secretary to ensure that if a contract is entered into for the performance of any Department function that requires access to sensitive personal information include, as a condition of the contract, that a contractor shall not, directly or through an affiliate of the contractor, disclose such information to any other person unless the disclosure is lawful and is expressly permitted under the contract. This statute also requires the contractor, or any subcontractors under the contract, to promptly notify VA (within one hour of discovery or suspicion) of any actual or suspected data breach that occurs with respect to sensitive personal information. It further requires that each such contract is subject to liquidated damages to be paid by the contractor to VA in the event of a data breach of any sensitive personal information processed or maintained by the contractor or any subcontractor under the contract. Such liquidated damages will be used for the purpose of VA providing credit protection services;
• 40 U.S.C. 121(c), which authorizes the head of each executive agency to issue orders and directives that the agency head considers necessary to carry out the FAR;
• 40 U.S.C
ch of any sensitive personal information processed or maintained by the contractor or any subcontractor under the contract. Such liquidated damages will be used for the purpose of VA providing credit protection services;
• 40 U.S.C. 121(c), which authorizes the head of each executive agency to issue orders and directives that the agency head considers necessary to carry out the FAR;
• 40 U.S.C. 11319(b)(1)(C), which stipulates that a covered agency other than the Department of Defense may not enter into a contract or other agreement for information technology or information technology services, unless the contract or other agreement has been reviewed and approved by the Chief Information Officer (CIO) of the agency, and that permits VA to use the governance processes of the VA to approve such a contract or other agreement if the VA CIO is included as a full participant in the governance processes. It also further permits that for a contract or agreement for a non-major information technology investment under this authority, the CIO may delegate the approval of the contract or agreement to an individual who reports directly to the CIO;
• 41 U.S.C. 1121(c)(3), which speaks to the authority of an executive agency under another law to prescribe policies, regulations, procedures, and forms for procurement that are subject to the authority conferred to the Administrator of the Office of Federal Procurement Policy, as well as other sections of Title 41, Public contracts, as cited in (c)(3);
• 41 U.S.C. 1303, an updated positive law codification to reflect additional authority of the VA as an executive agency to issue regulations that are essential to implement Governmentwide policies and procedures in the agency, as well as to issue additional policies and procedures required to satisfy the specific needs of the VA;
• 41 U.S.C
ns of Title 41, Public contracts, as cited in (c)(3);
• 41 U.S.C. 1303, an updated positive law codification to reflect additional authority of the VA as an executive agency to issue regulations that are essential to implement Governmentwide policies and procedures in the agency, as well as to issue additional policies and procedures required to satisfy the specific needs of the VA;
• 41 U.S.C. 1702, which addresses the acquisition planning and management responsibilities of Chief Acquisition Officers and Senior Procurement Executives, to include implementation of unique procurement policies, regulations and standards of the executive agency; and
• 48 CFR 1.301 through 1.304, which authorizes agencies to issue acquisition regulations that implement or supplement the FAR.
We propose to add 839.000, Scope of part, stating that the purpose of the part is to prescribe acquisition policies and procedures for use in acquiring information technology supplies, services and systems, and that it applies to both VA procured information technology systems as well as Interagency Acquisitions defined in FAR part 17 and VAAR part 817.
We propose to add subpart 839.1—General, with no text, and with the following sections within the subpart:
We propose to add 839.101, Policy, which identifies directives, security requirements, procedures and guidance that apply to all VA contracts and to VA contractors and subcontractors providing products, and contractors, subcontractors, and third-parties, in the performance of contractual obligations to VA when providing information technology related services.
We propose to add 839.105, Privacy, as a header only with no text
icy, which identifies directives, security requirements, procedures and guidance that apply to all VA contracts and to VA contractors and subcontractors providing products, and contractors, subcontractors, and third-parties, in the performance of contractual obligations to VA when providing information technology related services.
We propose to add 839.105, Privacy, as a header only with no text.
We propose to add 839.105-70, Business Associate Agreements, information technology-related contracts and privacy, to address a key requirement that business associate agreements shall be executed whether for VHA directly as the only VA “Covered Entity” or for other contracts and agreements issued by other VA administrations and staff offices in support of VHA where contractors, subcontractors, business associates and their employees may have to access, receive or create VA sensitive information or sensitive personal information, on behalf of VHA, in order to provide certain health care operation services. (See 802.101 for the definition of information technology-related contracts.)
We propose to add 839.105-71, Liquidated damages—protection of information in information technology related contracts, in contracts for goods and services, to address the statutory requirement to include a liquidated damages clause as prescribed in
We propose to add 839.106-70, Information technology security and privacy contract clauses, to prescribe the use of the following clauses:
In paragraph (a), contracting officers shall insert the clause at 852.239-70, Security Requirements for Information Technology Resources, and the clause 852.239-71, Information Technology Security Plan and Accreditation, in all solicitations, contracts and orders exceeding the micro-purchase threshold that include information technology services
es, to prescribe the use of the following clauses:
In paragraph (a), contracting officers shall insert the clause at 852.239-70, Security Requirements for Information Technology Resources, and the clause 852.239-71, Information Technology Security Plan and Accreditation, in all solicitations, contracts and orders exceeding the micro-purchase threshold that include information technology services.
In paragraph (b), clause 852.239-72, Information System Design and Development, would be required to be inserted in solicitations, contracts, orders and agreements where services to perform information system design and development are required.
In paragraph (c), clause 852.239-73, Information System Hosting, Operation, Maintenance or Use, would be required to be inserted in solicitations, contracts, orders and agreements where services to perform information system hosting, operation, maintenance or use are required.
In paragraph (d), clause 852.239-74, Security Controls Compliance Testing, would be required to be inserted in solicitations, contracts, orders and agreements when the clauses at 852.239-72 or 852.239-73 are inserted.
We propose to add subpart 839.2—Information and Communication Technology, with no text, and the following sections within the subpart.
We propose to add 839.201, Scope of subpart, to state that the subpart applies to all procurement of information and communication technology (ICT) supplies, services, and information and to require compliance with Section 508 standards. Section 508 standards now refer to ICT in lieu of electronic and information technology, so VA is adopting the same terminology.
We propose to add 839.203, Applicability, to require submission of a VA Section 508 Checklist when required in VA solicitations, and to provide a website to help businesses ensure compliance with VA Section 508 Standards
o require compliance with Section 508 standards. Section 508 standards now refer to ICT in lieu of electronic and information technology, so VA is adopting the same terminology.
We propose to add 839.203, Applicability, to require submission of a VA Section 508 Checklist when required in VA solicitations, and to provide a website to help businesses ensure compliance with VA Section 508 Standards. This would assist VA in the evaluation of offeror's proposals when an acquisition involves the acquisition of information technology or the furnishing of services related to acquisition of information technology as defined in this part. The form will be available either in solicitations or via the website link identified.
We propose to add 839.203-70, Information and communication technology accessibility standards—contract clause and provisions, to prescribe new solicitation provision 852.239-75, Information and Communication Technology Accessibility Notice, and new contract clause 852.239-76, Information and Communication Technology Accessibility, which requires the use of the VA Section 508 Checklists.
VAAR Part 852—Solicitation Provisions and Contract Clauses
We propose to add clause 852.204-71, Information and Information Systems Security, that would require contractors, subcontractors, their employees, third-parties, and business associates with access to VA information, information systems, or information technology (IT) or providing and accessing IT-related contracts (see 802.101), shall adhere to VA Directive 6500, VA Cybersecurity Program, and the directives and handbooks in the VA 6500 series related to VA information (including VA sensitive information and sensitive personal information and information systems security and privacy), as well as those set forth in the contract specifications, statement of work, or performance work statement
related contracts (see 802.101), shall adhere to VA Directive 6500, VA Cybersecurity Program, and the directives and handbooks in the VA 6500 series related to VA information (including VA sensitive information and sensitive personal information and information systems security and privacy), as well as those set forth in the contract specifications, statement of work, or performance work statement. These include, but are not limited to, VA Handbook 6500.6, Contract Security; and VA Directive and Handbook 0710, Personnel Security and Suitability Program, which establishes VA's procedures, responsibilities, and processes for complying with current Federal law, Executive Orders, policies, regulations, standards and guidance for protecting VA information, information systems (see 802.101, Definitions) security and privacy, and adhering to personnel security requirements when accessing VA information or information systems. It would describe in detail requirements for access to VA information and VA information systems and appropriate security and protection requirements; information on requirement for contractor operations in the United States; Contractor/subcontractor employee reassignment and termination notification requirements; VA information custodial requirements to include release, publication, and use of data, as well as media sanitization requirements; data retention, destruction and contractor self-certification requirements and use and copying of VA data and information; information with respect to violation of information custodial requirements, encryption, firewall and web services security controls, and disclosure of VA data and information. The clause also would cover compliance with privacy statutes and applicable regulations, as well as the requirement to report known or suspected security or privacy incidents. It further describes security incident investigation requirements and data breach notification requirements
al requirements, encryption, firewall and web services security controls, and disclosure of VA data and information. The clause also would cover compliance with privacy statutes and applicable regulations, as well as the requirement to report known or suspected security or privacy incidents. It further describes security incident investigation requirements and data breach notification requirements. It goes on to detail specific annual training requirements and the requirement to complete and such mandatory training requirements and complete acknowledgement of the VA Information Security Rules of Behavior for Organizational Users. A specific subcontract flow down requirement is also included.
We propose to add clause 852.211-76, Liquidated Damages—Reimbursement for Data Breach Costs, that provides that if the contractor fails to protect VA sensitive personal information which results in a data breach, the contractor shall, in place of actual damages, pay to the Government liquidated damages in an amount per affected individual, inserted by the contracting officer based on internal VA policy, in order to cover costs related to notification, data breach analysis and credit monitoring for such individuals. In the event the contractor provides payment of actual damages in an amount determined to be adequate by the contracting officer, the contracting officer may forgo collection of liquidated damages. The contracting officer would insert Alternate I in all solicitations or contracts, in commercial items acquisitions awarded under the procedures of FAR part 8 or FAR part 12, and would insert Alternate II in all solicitations, contracts, or orders, in simplified acquisitions exceeding the micro-purchase threshold that are for other than commercial items awarded under the procedures of FAR part 13 (see FAR 13.302-5(d)(1) and the clause at FAR 52.213-4).
We propose to remove clause 852.212-70, Provisions and Clauses Applicable to VA Acquisition of Commercial Items, as redundant to other FAR clauses
in all solicitations, contracts, or orders, in simplified acquisitions exceeding the micro-purchase threshold that are for other than commercial items awarded under the procedures of FAR part 13 (see FAR 13.302-5(d)(1) and the clause at FAR 52.213-4).
We propose to remove clause 852.212-70, Provisions and Clauses Applicable to VA Acquisition of Commercial Items, as redundant to other FAR clauses.
We propose to remove clause 852.212-71, Gray Market Items, and to add a new clause in its place, 852.212-71, Gray Market and Counterfeit Items. This new clause would require that no used, refurbished, or remanufactured supplies or equipment/parts shall be provided. It would state that any procurement where the clause is inserted is for new Original Equipment Manufacturer (OEM) items only. No gray market items shall be permitted to be provided. The clause would also specify that no counterfeit supplies or equipment/parts shall be provided. Unlawful or unauthorized substitutions are set forth in the clause and include used items represented as new, or the
We propose to add 852.212-72, Gray Market and Counterfeit Items—Information Technology Maintenance Allowing Other-than-New Parts. This new clause would permit used, refurbished, or remanufactured parts to be provided. However, no gray market supplies or equipment shall be permitted to be provided. The clause would also require that no counterfeit supplies or equipment shall be provided. The clause would also require that all vendors shall be an OEM, authorized dealer, authorized distributor or authorized reseller for the proposed equipment/system and would be required to be verified by an authorization letter or other documents from the OEM. Both proposed clauses are VA clauses that were originally released via a Class Deviation that we propose for codification as a part of this rulemaking
would also require that all vendors shall be an OEM, authorized dealer, authorized distributor or authorized reseller for the proposed equipment/system and would be required to be verified by an authorization letter or other documents from the OEM. Both proposed clauses are VA clauses that were originally released via a Class Deviation that we propose for codification as a part of this rulemaking.
We propose to add clause 852.239-70, Security Requirements for Information Technology Resources, to specify that contractors shall be responsible for information technology security for all systems connected to a Department of Veterans Affairs (VA) network or operated by the contractor for VA, regardless of location. This clause is applicable to all or any part of the contract that includes information technology resources or services in which the contractor has physical or electronic access to VA information that directly supports the mission of VA. Examples of tasks that require security provisions include—
(1) Hosting of VA e-Government sites or other information technology operations;
(2) Acquisition, transmission, or analysis of data owned by VA with significant replacement cost should the contractor's copy be corrupted; and
(3) Access to VA general support systems/major applications at a level beyond that granted the general public, e.g., bypassing a firewall.
The clause would also require the contractor to develop, provide, implement, and maintain an Information Technology Security Plan. This plan shall describe the processes and procedures that the contractor will follow to ensure appropriate security of information technology resources developed, processed, or used under this contract. The clause would require that within 30 days after contract award, the contractor shall submit the Information Technology Security Plan to the contracting officer for review. This plan shall detail the approach contained in the offeror's proposal, sealed bid or quotation
ill follow to ensure appropriate security of information technology resources developed, processed, or used under this contract. The clause would require that within 30 days after contract award, the contractor shall submit the Information Technology Security Plan to the contracting officer for review. This plan shall detail the approach contained in the offeror's proposal, sealed bid or quotation. Upon acceptance by the contracting officer, the Plan will be incorporated into the contract by contract modification. As required by current VA policy, the contractor shall submit written proof of information technology security accreditation to the contracting officer. It also specifies specifically as pertains to information technology related contracts that its employees performing services under this contract complete VA security awareness training on an annual basis. This includes signing an acknowledgment that they have read, understand, and agree to abide by the VA Information Security Rules of Behavior for Organizational Users (VA National Rules of Behavior) as required by 38 U.S.C. 5723; FAR 39.105, Privacy; clause 852.204-71, Information and Information Systems Security, and this clause on an annual basis.
We propose to add provision 852.239-71, Information Technology Security Plan and Accreditation, that would require that all offers submitted in response to this solicitation or request for quotation shall address the approach for completing the security plan and accreditation requirements in clause 852.239-70, Security Requirements for Information Technology Resources.
We propose to add clause 852.239-72, Information System Design and Development, which would be required in all solicitations, contracts, purchase orders and agreements where services to perform information system design and development are required
ach for completing the security plan and accreditation requirements in clause 852.239-70, Security Requirements for Information Technology Resources.
We propose to add clause 852.239-72, Information System Design and Development, which would be required in all solicitations, contracts, purchase orders and agreements where services to perform information system design and development are required. The contractor/subcontractor shall comply with the Privacy Act of 1974 (the Act)) and VA rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies— (1) the Systems of Records (SOR); and (2) the design, development, or operational work that the contractor/subcontractor is to perform. During the development cycle a Privacy Impact Assessment (PIA) must be completed, provided to the COR, and approved by the VA Privacy Service in accordance with VA Directive 6508, Implementation of Privacy Threshold Analysis and Privacy Impact Assessment.
We propose to add clause 852.239-73, Information System Hosting, Operation, Maintenance, or Use, which would be required in all solicitations, contracts, purchase orders and agreements where services to perform information system hosting, operation, maintenance or used are required. For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, contractors/subcontractors are fully responsible and accountable for ensuring compliance with all applicable Health Insurance Portability and Accountability Act of 1996 (HIPAA) regulations, the Privacy Act and other required VA confidentiality statutes included in VA's mandatory yearly training and privacy handbooks, Federal Information Security Management Act (FISMA), National Institute of Standards and Technology (NIST), Federal Information Processing Standards (FIPS), and VA security and privacy directives and handbooks
rtability and Accountability Act of 1996 (HIPAA) regulations, the Privacy Act and other required VA confidentiality statutes included in VA's mandatory yearly training and privacy handbooks, Federal Information Security Management Act (FISMA), National Institute of Standards and Technology (NIST), Federal Information Processing Standards (FIPS), and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerability scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The contractor's security control procedures must be equivalent to or exceed, to those procedures used to secure VA systems. A Privacy Impact Assessment (PIA) must also be provided to the contracting officer's representative (COR) and approved by VA Privacy Service prior to approval to operate. Adequate security controls for collecting, processing, transmitting, and storing of Personally Identifiable Information (PII), as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls are to be assessed and stated within the Privacy Impact Assessment and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII. The contractor/subcontractor must conduct an annual self-assessment on all systems and outsourced services as required. Electronic copies of the assessment must be provided to the COR. Media ( e.g., hard drives, optical disks, CDs, back-up tapes) used by the contractor/subcontractor that contain VA information must be returned to the VA for sanitization or destruction or the contractor/subcontractor must self-certify that the media has been disposed of per VA Directive 6500 requirements and as required by current VA policy
ic copies of the assessment must be provided to the COR. Media ( e.g., hard drives, optical disks, CDs, back-up tapes) used by the contractor/subcontractor that contain VA information must be returned to the VA for sanitization or destruction or the contractor/subcontractor must self-certify that the media has been disposed of per VA Directive 6500 requirements and as required by current VA policy.
We propose to add clause 852.239-74, Security Controls Compliance Testing, which would be required in solicitations, contracts, orders and agreements, when the clauses at 852.239-72 or 852.239-73 are inserted. Clause 852.239-73 would provide notice that VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security controls and privacy practices implemented by a contractor under the clauses contained within the contract. Clause 852.239-73 provides that with 10 working-days' notice, at the request of VA, the contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of the Inspector General. VA may conduct a security control assessment on shorter notice, to include unannounced assessments, as determined by VA in the event of a security incident or at any other time.
We propose to add solicitation provision 852.239-75, Information Communication and Technology Accessibility Notice, and clause 852.239-76, Information and Communication Technology Accessibility, that require the use of the VA Section 508 Checklists to be submitted under solicitations and contracts, and that provide additional information regarding the VA Section 508 website
or at any other time.
We propose to add solicitation provision 852.239-75, Information Communication and Technology Accessibility Notice, and clause 852.239-76, Information and Communication Technology Accessibility, that require the use of the VA Section 508 Checklists to be submitted under solicitations and contracts, and that provide additional information regarding the VA Section 508 website.
Executive Orders 12866 and 13563
Executive Orders (E.O.s) 12866 and 13563 direct agencies to assess the costs and benefits of available regulatory alternatives and, when regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, and other advantages; distributive impacts; and equity). E.O. 13563 (Improving Regulation and Regulatory Review) emphasizes the importance of quantifying both costs and benefits, reducing costs, harmonizing rules, and promoting flexibility. The Office of Information and Regulatory Affairs has determined that this rule is not a significant regulatory action under Executive Order 12866.
The Regulatory Impact Analysis associated with this rulemaking can be found as a supporting document at www.regulations.gov.
Paperwork Reduction Act
This proposed rule includes provisions constituting collections of information under the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-3521) that require approval by the Office of Management and Budget (OMB). Accordingly, under 44 U.S.C. 3507(d), VA has submitted a copy of this rulemaking action to OMB for its review.
OMB assigns control numbers to collections of information it approves. VA may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number
re approval by the Office of Management and Budget (OMB). Accordingly, under 44 U.S.C. 3507(d), VA has submitted a copy of this rulemaking action to OMB for its review.
OMB assigns control numbers to collections of information it approves. VA may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number. VA is describing four groups of new collections of information in this rule under the Paperwork Reduction Act of 1995 for four separate OMB Control Numbers related to—
VAAR Part 804 related information collection:
1. Proposed clause, 852.204-71, Information and Information Systems Security, and section 804.1970, Information security policy—contractor general responsibilities.
VAAR Part 811 related information collection:
2. Proposed section 811.503-70, Contract clause, and proposed clause 852.211-70, Liquidated Damages—Reimbursement for Data Breach Costs.
VAAR Part 812 related information collection:
3. Proposed section 812.301(f), Solicitation provisions and contract clauses for the acquisition of commercial items, and proposed clauses 852.212-71, Gray Market and Counterfeit Items, and 852.212-72, Gray Market and Counterfeit Items—Information Technology Maintenance Allowing Other-than-New Parts.
VAAR Part 839 related information collection:
4. Proposed section 839.106-70, Information technology security and privacy clauses, and proposed clauses 852.239-70, Security Requirements for Information Technology Resources; 852.239-72, Information System Design and Development; and 852.239-73, Information System Hosting, Operation, Maintenance or Use. If OMB does not approve the collections of information as requested, VA will immediately remove the provisions containing a collection of information or take such other action as is directed by OMB
852.239-70, Security Requirements for Information Technology Resources; 852.239-72, Information System Design and Development; and 852.239-73, Information System Hosting, Operation, Maintenance or Use. If OMB does not approve the collections of information as requested, VA will immediately remove the provisions containing a collection of information or take such other action as is directed by OMB.
Written comments and recommendations for the proposed collections of information should be sent within 60 days of publication of this proposed rule through Federal Docket Management System (FDMS) at www.Regulations.gov or to Rafael Taylor, Office of Acquisition & Logistics, Procurement Policy & Warrant Management Services (003A2A), Department of Veterans Affairs, 810 Vermont Avenue NW, Washington, DC 20420 or email to rafael.taylor@va.gov.
OMB is required to make a decision concerning the collections of information contained in this proposed rule between 30 and 60 days after publication of this document in the Federal Register . Therefore, a comment to OMB is best assured of having its full effect if OMB receives it within 30 days of publication. This does not affect the deadline for the public to comment on the proposed rule.
The Department considers comments by the public on proposed collections of information in—
• Evaluating whether the proposed collections of information are necessary for the proper performance of the functions of the Department, including whether the information will have practical utility;
• Evaluating the accuracy of the Department's estimate of the burden of the proposed collections of information, including the validity of the methodology and assumptions used;
• Enhancing the quality, usefulness, and clarity of the information to be collected; and
• Minimizing the burden of the collections of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of informati
mation, including the validity of the methodology and assumptions used;
• Enhancing the quality, usefulness, and clarity of the information to be collected; and
• Minimizing the burden of the collections of information on those who are to respond, including through the use of appropriate automated, electronic, mechanical, or other technological collection techniques or other forms of information technology, e.g., permitting electronic submission of responses.
The collections of information contained in this proposed rule at 48 CFR chapter 8 are described specifically and immediately following this paragraph, under their respective titles.
VAAR Part 804 related collections of information:
The collection of information contained in proposed clause, 852.204-71, Information and Information Systems Security and new section 804.1970, Information security policy—contractor general responsibilities, is described immediately following this paragraph.
Summary of collection of information:
We propose the use of clause 852.204-71, Information and Information Systems Security, as prescribed at 804.1903; and propose section 804.1970, Information security policy—contractor general responsibilities.
New proposed section 804.1970 and VAAR clause 852.204-71, Information
Description of need for information and proposed use of information:
This information collection requirement is needed to protect the safety and health of the nation's Veterans and to protect the security and integrity of VA information and VA sensitive information.
Clause 852.204-71 and section 804.1970 contain the following information collection requirements from the public:
Information collection requirement Clause/section Contractor/subcontractor employee reassignment and termination notification 852.204-71. Report of known or suspected security/privacy incident and data breach 852.204-71, 804.1970. Provide an annual training certificate 852.204-71
.
Clause 852.204-71 and section 804.1970 contain the following information collection requirements from the public:
Information collection requirement Clause/section Contractor/subcontractor employee reassignment and termination notification 852.204-71. Report of known or suspected security/privacy incident and data breach 852.204-71, 804.1970. Provide an annual training certificate 852.204-71. Submission of data retention, destruction plan and contractor self-certification 852.204-71. Maintain records and compliance reports regarding HIPAA security and privacy rule compliance 804.1970. Submission of a detailed security plan 852.204-71. Report of all requests for, demands for production of, or inquiries, including court orders, about VA information and information systems 852.204-71. Total Burden Hours: 4,069.
Total Number of Respondents: 8,223.
Average Number of Respondents: 1,175.
Total Annual Responses: 8,223.
Average Annual Responses: 1,175.
Total estimated annual cost to all respondents: $189,371 (4,069 hours at $46.54 per hour). This is based on the Bureau of Labor Statistics May 2020 Occupational Employment and Wages code “15-1231 Computer Network Support Specialists” mean hourly wage of $34.16 plus 36.25% fringe benefits per OMB Memo M-08-13 dated March 11, 2008.
VA gathered data for FY 2018, 2019 and 2020 across 11 North American Industry Classification System (NAICS) where such information collection requirements may be inserted into solicitations and contracts. Then VA looked at the types of information collection requirements or burden may be required by the clause. Of the potential pool of previously awarded contracts (to both large and small businesses) during the three fiscal years where the proposed clause would be required to be included in solicitations and resulting contracts, VA calculated the average number of contracts awarded during the three fiscal years
d at the types of information collection requirements or burden may be required by the clause. Of the potential pool of previously awarded contracts (to both large and small businesses) during the three fiscal years where the proposed clause would be required to be included in solicitations and resulting contracts, VA calculated the average number of contracts awarded during the three fiscal years. We then used the average number of awards and estimated that for the purpose of identifying any potential information collection burden for contractor/subcontractor employee reassignment and termination notification of information collection requirements, only 45% would contain potential information collection requirements. The remaining information collection requirement categories are estimated as follows:
• VA estimates that 30% of the average number of contracts awarded during the three fiscal years in the identified 6 of 11 NAICS codes would require the clause and potential information collection requirement for report of known or suspected security/privacy incident and data breach.
• VA estimates that 100% of the average number of contracts awarded during the three fiscal years in the identified NAICS codes would require the clause and potential information collection requirement for the contractor/subcontractor employee training and certificates, and would be applicable when employees are onboarded by contractors.
• VA estimates no more than 15% of the average number of contracts awarded during the three fiscal years in the identified NAICS codes would require the clause and potential information collection requirement for the submission of data retention, destruction plan and contractor self-certification
oyee training and certificates, and would be applicable when employees are onboarded by contractors.
• VA estimates no more than 15% of the average number of contracts awarded during the three fiscal years in the identified NAICS codes would require the clause and potential information collection requirement for the submission of data retention, destruction plan and contractor self-certification.
• VA estimates that 100% of the average number of contracts awarded during the three fiscal years in the identified eight of 11 NAICS codes would require the clause and potential information collection requirement for maintain records and compliance reports regarding HIPAA security and Privacy Rule compliance.
• VA estimates that 100% of the average number of contracts awarded during the three fiscal years in the identified NAICS codes would require the clause and potential information collection requirement for the submission of a detailed security plan.
• VA estimates no more than 5% of the average number of contracts awarded during the three fiscal years in the identified NAICS codes that would require the clause and potential information collection requirement for the report of all requests for, demands for, production of, or inquiries, including court orders, about VA information and information systems, would be applicable.
Contractor/subcontractor employee reassignment and termination notification.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 1,357 1 5 113 Report of known or suspected security/privacy incident and data breach.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 807 1 180 2,421 Submission of contractor/subcontractor employee annual training certificate.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 3,016 1 2 101 Submission of data retention, destruction plan and contractor self-certification
respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 807 1 180 2,421 Submission of contractor/subcontractor employee annual training certificate.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 3,016 1 2 101 Submission of data retention, destruction plan and contractor self-certification.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 452 1 5 38 Maintain records and compliance reports regarding HIPAA security and privacy rule compliance.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 2,138 1 30 1,069 Detailed security plan submission.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 302 1 60 302 Report of all requests for, demands for, production of, or inquiries, including court orders, about VA information and information systems.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 151 1 10 25 VAAR Part 811 related collections of information:
The collections of information contained in section 811.503-70, Contract clause and proposed clause 852.211-70, Liquidated Damages-Reimbursement for Data Breach Costs is described immediately following this paragraph.
Summary of collection of information:
We propose the use of clause 852.211-70, Liquidated Damages-Reimbursement for Data Breach Costs, as prescribed at 811.503-70, Contract clause, for sensitive personal information that will be created, received, maintained, or transmitted, or that will be stored, generated, accessed, exchanged, processed, or utilized by a contractor, subcontractor, business associate, or an employee of one of these entities
se the use of clause 852.211-70, Liquidated Damages-Reimbursement for Data Breach Costs, as prescribed at 811.503-70, Contract clause, for sensitive personal information that will be created, received, maintained, or transmitted, or that will be stored, generated, accessed, exchanged, processed, or utilized by a contractor, subcontractor, business associate, or an employee of one of these entities. This new proposed VAAR clause 852.211-70 requires the
Description of need for information and proposed use of information:
This information collection requirement is needed to protect the safety and health of the nation's Veterans and to protect the security and integrity of VA information and VA sensitive information.
Total Burden Hours: 6.5.
Average Number of Respondents: 13.
Average Annual Responses: 13.
Total estimated annual cost to all respondents: $308 (6.5 hours at $47.42 per hour). This is based on the Bureau of Labor Statistics May 2020 Occupational Employment and Wages code “13-1020 Buyers and Purchasing Agents” mean hourly wage of $34.80 plus 36.25% fringe benefits per OMB Memo M-08-13 dated March 11, 2008.
VA gathered data for FY 2018, 2019 and 2020 across six North American Industry Classification System (NAICS) where such information collection requirements may be inserted into solicitations and contracts. Then VA looked at the types of information collection requirements or burden ( i.e., notify the VA through the contracting officer and the contracting officer's representative of any security incident that occurs involving sensitive personal information.) Of the potential pool of previously awarded contracts during the average of the three fiscal years, VA calculated a rough estimate that 20% of six NAICS codes of past contract awards could be reasonably calculated as a rough estimate of a potential information collection requirement for any such contracts awarded to both large and small businesses
occurs involving sensitive personal information.) Of the potential pool of previously awarded contracts during the average of the three fiscal years, VA calculated a rough estimate that 20% of six NAICS codes of past contract awards could be reasonably calculated as a rough estimate of a potential information collection requirement for any such contracts awarded to both large and small businesses.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 13 1 30 6.5 VAAR Part 812 related collections of information:
The collections of information contained in section 812.301(f), Solicitation provisions and contract clauses for the acquisition of commercial items, and proposed clauses 852.212-71, Gray Market and Counterfeit Items, and 852.212-72, Gray Market and Counterfeit Items—Information Technology Maintenance Allowing Other-than-New Parts, are described immediately following this paragraph, under their respective titles.
Summary of collection of information:
We propose the use of clauses 852.212-71, Gray Market and Counterfeit Items, and 852.212-72, Gray Market and Counterfeit Items—Information Technology Maintenance Allowing Other-than-New Parts, as prescribed at 812.301(f), Solicitation provisions and contract clauses for the acquisition of commercial items.
New proposed VAAR clause 852.212-71, Gray Market and Counterfeit Items, require that no used, refurbished, or remanufactured supplies or equipment/parts shall be provided. It would state that any procurement where the clause is inserted is for new Original Equipment Manufacturer (OEM) items only. No gray market items shall be permitted to be provided. The clause would also specify that no counterfeit supplies or equipment/parts shall be provided. Unlawful or unauthorized substitutions are set forth in the clause and include used items represented as new, or the false identification of grade, serial number, lot number, date code, or performance characteristics
Manufacturer (OEM) items only. No gray market items shall be permitted to be provided. The clause would also specify that no counterfeit supplies or equipment/parts shall be provided. Unlawful or unauthorized substitutions are set forth in the clause and include used items represented as new, or the false identification of grade, serial number, lot number, date code, or performance characteristics. The clause would also require that all vendors shall be an OEM, authorized dealer, authorized distributor or authorized reseller for the proposed equipment/system and would be required to be verified by an authorization letter or other documents from the OEM.
New proposed VAAR clause 852.212-72, Gray Market and Counterfeit Items—Information Technology Maintenance Allowing Other-than-New Parts, would permit used, refurbished, or remanufactured parts to be provided under the solicitation and contract. However, no gray market supplies or equipment shall be permitted to be provided. The clause would also require that no counterfeit supplies or equipment shall be provided. The clause would also require that all vendors shall be an OEM, authorized dealer, authorized distributor or authorized reseller for the proposed equipment/system and would be required to be verified by an authorization letter or other documents from the OEM.
Description of need for information and proposed use of information:
To prevent the inadvertent acquisition of gray market and counterfeit medical equipment, medical supplies, and IT equipment and to protect the VA supply chain
ed distributor or authorized reseller for the proposed equipment/system and would be required to be verified by an authorization letter or other documents from the OEM.
Description of need for information and proposed use of information:
To prevent the inadvertent acquisition of gray market and counterfeit medical equipment, medical supplies, and IT equipment and to protect the VA supply chain.
The two clauses containing collections of information are described below:
Clause 852.212-71, Gray Market and Counterfeit Items, is required in solicitations and contracts for new medical supplies, new medical equipment, new information technology equipment, and maintenance of medical or information technology equipment that includes replacement parts if used, refurbished, or remanufactured parts are unacceptable, when the associated solicitation includes FAR provisions 52.212-1, Instruction to Offerors-Commercial Items, and 52.212-2, Evaluation-Commercial Items.
Clause 852.212-72, Gray Market and Counterfeit Items—Information Technology Maintenance Allowing Other-than-New Parts, is required in solicitations and contracts for the maintenance of information technology equipment that includes replacement parts, if used, refurbished, or remanufactured parts are acceptable, when the associated solicitation includes FAR provisions 52.212-1, Instruction to Offerors-Commercial Items, and 52.212-2, Evaluation-Commercial Items.
Total estimated burden hours: 2,170.
Estimated average number of respondents: 4,342.
Total estimated annual responses: 13,026.
Total estimated annual cost to all respondents: $102,902 (2,170 hours at $47.42 per hour). This is based on the Bureau of Labor Statistics May 2020 Occupational Employment and Wages code “13-1020 Buyers and Purchasing Agents” mean hourly wage of $34.80 plus 36.25% fringe benefits per OMB Memo M-08-13 dated March 11, 2008
e number of respondents: 4,342.
Total estimated annual responses: 13,026.
Total estimated annual cost to all respondents: $102,902 (2,170 hours at $47.42 per hour). This is based on the Bureau of Labor Statistics May 2020 Occupational Employment and Wages code “13-1020 Buyers and Purchasing Agents” mean hourly wage of $34.80 plus 36.25% fringe benefits per OMB Memo M-08-13 dated March 11, 2008.
VA gathered data for FY 2017, 2018 and 2019 across seven North American Industry Classification System (NAICS) where such information collection requirements may be inserted into solicitations and contracts. Then VA looked at the types of information collection requirements or burden ( i.e., submitting an authorization letter or other documents from the Original Equipment Manufacturer.) Of the
Because both clauses require the same information collection, one if for new OEM items and the other for other-than-new-parts and assumes both clauses will not be included in one acquisition. Therefore, the number of respondents for each clause is 50% the total of all NAICS estimated respondents.
Clause 852.212-71, Gray Market and Counterfeit Items.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 2,171 3 10 1,085 Clause 852.212-72, Gray Market, and Counterfeit Items—Information Technology Maintenance Allowing Other-than-New Parts.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 2,171 3 10 1,085 VAAR Part 839 related collections of information:
The collections of information contained in section 839.106-70 and part 852 at proposed clauses 852.239-70, 852.239-72, and 852.239-73, are described immediately following this paragraph, under their respective titles
.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 2,171 3 10 1,085 VAAR Part 839 related collections of information:
The collections of information contained in section 839.106-70 and part 852 at proposed clauses 852.239-70, 852.239-72, and 852.239-73, are described immediately following this paragraph, under their respective titles.
Summary of collection of information:
We propose the use of 852.239-70, Security Requirements for Information Technology Resources; 852.239-72, Information System Design and Development, and 852.239-73, Information System Hosting, Operation, Maintenance, or Use, as prescribed at 839.106-70, Information technology security and privacy clauses.
New proposed clause 852.239-70, Security Requirements for Information Technology Resources, would require contractors, subcontractors, business associates and their personnel, when accessing VA information and or information systems in order to perform under a contract, to be subject to the same Federal laws, regulations, standards, and VA Directives and Handbooks as VA and VA personnel regarding information and information system security. The clause and information collection requirement would be inserted in solicitations, contracts, purchase orders and agreements where VA information, VA sensitive information (including sensitive personal information or protected health information (PHI))—
(1) Is created, received, maintained, or transmitted, or that will be stored, generated, accessed, exchanged, processed, or utilized by a VA contractor, subcontractor or third-party servicers or associates, or on behalf of any of these entities, in the performance of their contractual obligations to VA;
(2) By or on behalf of any of the entities identified in this section, regardless of—
I))—
(1) Is created, received, maintained, or transmitted, or that will be stored, generated, accessed, exchanged, processed, or utilized by a VA contractor, subcontractor or third-party servicers or associates, or on behalf of any of these entities, in the performance of their contractual obligations to VA;
(2) By or on behalf of any of the entities identified in this section, regardless of—
(i) Format; or
(ii) Whether it resides on a VA or a non-VA system, or with a contractor, subcontractor, or third-party system or electronic information system(s), including cloud services, operating for or on the VA's behalf or as required by contract.
New proposed clause 852.239-72, Information System Design and Development, is required in all solicitations, contracts, orders and agreements where services to perform information system design and development are required.
New proposed clause 852.239-73, Information System Hosting, Operation, Maintenance, or Use, is required in all solicitations, contracts, orders and agreements for contracts where information systems are hosted, operated, maintained, or used on behalf of VA at non-VA facilities.
Description of need for information and proposed use of information:
Under the Federal Information Security Management Act (FISMA) (2002), section 3544(a)(1)(A)(ii), and the Federal Information Security Modernization Act of 2014, each agency of the Federal Government must provide security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. VA requires, based on Federal security requirements, that contractors and subcontractors, including business associates, and employees, that require access to VA information or information systems shall be subject to the same Federal laws, regulations, standards, policies and procedures as VA and VA personnel
ency, including those provided or managed by another agency, contractor, or other source. VA requires, based on Federal security requirements, that contractors and subcontractors, including business associates, and employees, that require access to VA information or information systems shall be subject to the same Federal laws, regulations, standards, policies and procedures as VA and VA personnel. This includes whenever it is accessed, maintained, processed, or utilized; or when VA information systems will be designed or developed at non-VA facilities. These three clauses would enable VA to comply with its responsibilities under the Federal Information Security Modernization Act of 2014. The three clauses containing collections of information are described below:
Clause 852.239-70, Security Requirements for Information Technology Resources, is required in all solicitations, contracts, purchase orders, and agreements where VA sensitive information, including sensitive personal information is accessed, maintained, processed, or utilized as set forth in VAAR part 839. Contractors (including subcontractors, employees, and business associates) would be required to adhere to VA Directive 6500, VA Cybersecurity Program, and the directives and handbooks in the VA 6500 series related to VA information (including VA sensitive information and sensitive personal information and information systems security and privacy), as well as those set forth in the contract specifications, statement of
Clause 852.239-72, Information System Design and Development, is required in all solicitations, contracts, purchase orders and agreements where services to perform information system design and development are required. The contractor/subcontractor shall comply with the Privacy Act of 1974 (the Act) and VA rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies—
urchase orders and agreements where services to perform information system design and development are required. The contractor/subcontractor shall comply with the Privacy Act of 1974 (the Act) and VA rules and regulations issued under the Act in the design, development, or operation of any system of records on individuals to accomplish an agency function when the contract specifically identifies—
(1) The applicable and existing VA Privacy Act systems of records (SOR); and (2) the design, development, or operational work that the contractor/subcontractor is to perform. During the development cycle a Privacy Impact Assessment (PIA) must be completed, provided to the COR, and approved by the VA Privacy Service in accordance with VA Directive 6508, Implementation of Privacy Threshold Analysis and Privacy Impact Assessment.
Clause 852.239-73, Information System Hosting, Operation, Maintenance, or Use, is required in all solicitations, contracts, purchase orders and agreements where services to perform information system hosting, operation, or maintenance are required. For information systems that are hosted, operated, maintained, or used on behalf of VA at non-VA facilities, contractors/subcontractors are fully responsible and accountable for ensuring compliance with all applicable HIPAA regulations, the Privacy Act and other required VA confidentiality statutes included in VA's mandatory yearly training and privacy handbooks, FISMA, NIST, FIPS, and VA security and privacy directives and handbooks. This includes conducting compliant risk assessments, routine vulnerability scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The contractor's security control procedures must be equivalent to or exceed those procedures used to secure VA systems. A Privacy Impact Assessment (PIA) must also be provided to the COR and approved by VA Privacy Service prior to approval to operate
tine vulnerability scanning, system patching and change management procedures, and the completion of an acceptable contingency plan for each system. The contractor's security control procedures must be equivalent to or exceed those procedures used to secure VA systems. A Privacy Impact Assessment (PIA) must also be provided to the COR and approved by VA Privacy Service prior to approval to operate. Adequate security controls for collecting, processing, transmitting, and storing of Personally Identifiable Information (PII), as determined by the VA Privacy Service, must be in place, tested, and approved by VA prior to hosting, operation, maintenance, or use of the information system, or systems by or on behalf of VA. These security controls are to be assessed and stated within the Privacy Impact Assessment and if these controls are determined not to be in place, or inadequate, a Plan of Action and Milestones (POA&M) must be submitted and approved prior to the collection of PII.
The contractor/subcontractor must conduct an annual self-assessment on all systems and outsourced services as required. Both hard copy and electronic copies of the assessment must be provided to the COR. Media ( e.g., hard drives, optical disks, CDs, back-up tapes) used by the contractors/subcontractors that contain VA information must be returned to the VA for sanitization or destruction or the contractor/subcontractor must self-certify that the media has been disposed of per VA Handbook 6500.1 requirements. This must be completed within 30 days of termination of the contract.
Section 839.101-70 and these three clauses require the contractor/subcontractor to submit the following information collections:
Information collection requirement Clause/section Contractor/subcontractor employee reassignment and termination notification 852.239-70. Privacy Impact Assessment Report & Plan of Action and Milestones 852.239-72, 852.239-73. Maintain and provide information technology security plan 852.239-70
se three clauses require the contractor/subcontractor to submit the following information collections:
Information collection requirement Clause/section Contractor/subcontractor employee reassignment and termination notification 852.239-70. Privacy Impact Assessment Report & Plan of Action and Milestones 852.239-72, 852.239-73. Maintain and provide information technology security plan 852.239-70. Submission of proof of information technology security accreditation 852.239-70. Verification of annual IT security plan validation 852.239-70. Submission of annual self-assessment 852.239-73. Report of any deficiencies on annual FISMA security controls assessment 852.239-73. Overall Total estimated burden hours: 4,815.
Overall Estimated average number of respondents: 2,198.
Overall Total estimated annual responses: 2,198.
Total estimated annual cost to all respondents: $228,327 (4,815 hours at $47.42 per hour). This is based on the Bureau of Labor Statistics May 2020 Occupational Employment and Wages code “13-1020 Buyers and Purchasing Agents” mean hourly wage of $34.80 plus 36.25% fringe benefits per OMB Memo M-08-13 dated March 11, 2008.
VA gathered data for FY 2018, 2019 and 2020 across 11 North American Industry Classification System (NAICS) where such information collection requirements may be inserted into solicitations and contracts. Then VA looked at the types of information collection requirements or burden that may be required across the three VAAR part 839 clauses. Of the potential pool of previously awarded contracts (to both large and small businesses) during the three fiscal years where the proposed clauses would be required to be included in solicitations and resulting contracts, VA calculated the average number of contracts awarded during the three fiscal years
ollection requirements or burden that may be required across the three VAAR part 839 clauses. Of the potential pool of previously awarded contracts (to both large and small businesses) during the three fiscal years where the proposed clauses would be required to be included in solicitations and resulting contracts, VA calculated the average number of contracts awarded during the three fiscal years. We then used the average number of awards and estimated that for the purpose of identifying any potential information collection burden for Contractor/Subcontractor Employee Reassignment and Termination Notification of information collection requirements, only 45% would contain a potential information collection requirements. VA estimates that 100% of the average number of contracts awarded during the three fiscal years in the identified 11 NAICS codes would require the clause and potential information collection requirement for maintain and provide Information Technology Security Plan. Submission of proof of information technology security accreditation, and verification of annual IT security plan validation: VA also estimates 5% of the average number of contracts awarded during the three fiscal years in the identified 11 NAICS codes would require the clause and potential information collection requirement for report of any deficiencies on annual FISMA security controls assessment. Moreover, VA estimates that 100% of the average number of contracts awarded during the three fiscal years in six of the identified 11 NAICS codes would require the clause and potential information collection requirement for
• 852.239-70, Security Requirements for Information Technology Resources.
Total Burden Hours: 2,375.
Average Number of Respondents: 2,601.
Average Annual Responses: 2,601.
Contractor/subcontractor employee reassignment and termination notification
g the three fiscal years in six of the identified 11 NAICS codes would require the clause and potential information collection requirement for
• 852.239-70, Security Requirements for Information Technology Resources.
Total Burden Hours: 2,375.
Average Number of Respondents: 2,601.
Average Annual Responses: 2,601.
Contractor/subcontractor employee reassignment and termination notification.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 1,357 1 5 113 Maintain and provide Information technology security plan.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 3,016 1 30 1,508 Submission of proof of information technology security accreditation.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 3,016 1 10 503 Verification of annual IT Security Plan validation.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 3,016 1 5 251 • 852.239-72, Information System Design and Development:
Privacy Impact Assessment Report & Plan of Action and Milestones.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 1,345 1 30 673 Total Burden Hours: 673.
Average Number of Respondents: 1,345.
Average Annual Responses: 1,345.
• 852.239-73, Information System Hosting, Operation, Maintenance, or Use:
Total Burden Hours: 1,767.
Average Number of Respondents: 1,211.
Average Annual Responses: 1,211.
Privacy Impact Assessment Report & Plan of Action and Milestones.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 1,345 1 30 673 Submission of annual self-assessment
-73, Information System Hosting, Operation, Maintenance, or Use:
Total Burden Hours: 1,767.
Average Number of Respondents: 1,211.
Average Annual Responses: 1,211.
Privacy Impact Assessment Report & Plan of Action and Milestones.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 1,345 1 30 673 Submission of annual self-assessment.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 2,138 1 30 1,069 Report of any deficiencies on annual FISMA security controls assessment.
Number of respondents × Number of responses per respondent × Number of minutes ÷ by 60 Number of burden hours 151 1 10 25 Regulatory Flexibility Act
The Secretary hereby certifies that this proposed rule would not have a significant economic impact on a substantial number of small entities as they are defined in the Regulatory Flexibility Act (5 U.S.C. 601-612). Therefore, pursuant to 5 U.S.C. 605(b), the initial and final regulatory flexibility analysis requirements of 5 U.S.C. 603 and 604 do not apply.
This rulemaking does not change VA's policy regarding small businesses and does not have a significant economic impact to individual businesses. The overall impact of the proposed rule would be of benefit to small businesses owned by Veterans or service-disabled Veterans as the VAAR is being updated to provide needed guidance to ensure VA's contractors properly protect and safeguard VA sensitive information, which includes Veteran's sensitive personal information. This rulemaking adds a new VAAR part concerning Acquisition of Information Technology that codifies information collection burdens. VA's requirement to collect the information is the result of existing requirements to ensure compliance across the Federal government and specifically when VA contractors, subcontractors, business associates and their employees require access to VA information (including VA sensitive information) or information systems
aws, regulations, policies or procedures as VA and VA personnel. While this requirement adds some burden in annual costs and hours to firms already awarded and performing contracts at VA, the overall cost is considered de minimis, for either large or small contractors, in relation to the potential impact and harm to Veterans and VA information and information systems should a contractor not comply. Properly setting forth the requirements will provide clarity to the public and ensure appropriate safeguards are in place to ensure protection of VA's information (in particular VA sensitive personal information) and information systems. In total, this rulemaking does not change VA's policy regarding small businesses, does not have a substantial economic impact to individual businesses, and does not significantly increase or decrease costs small business were already required to bear when performing contracts which required the access, maintenance, process, or utilization of VA sensitive information or information systems.
Unfunded Mandates
The Unfunded Mandates Reform Act of 1995 requires, at 2 U.S.C. 1532, that agencies prepare an assessment of anticipated costs and benefits before issuing any rule that may result in the expenditure by State, local, and tribal Governments, in the aggregate, or by the private sector, of $100 million or more (adjusted annually for inflation) in any one year. This proposed rule would have no such effect on State, local, and tribal Governments or on the private sector.
List of Subjects
48 CFR Part 802, 804, 811, and 812 Government procurement.
48 CFR Part 824 Freedom of information, Government procurement, Privacy.
48 CFR Part 839 Computer technology, Government procurement.
48 CFR Part 852 Government procurement, Reporting and recordkeeping requirements
ed rule would have no such effect on State, local, and tribal Governments or on the private sector.
List of Subjects
48 CFR Part 802, 804, 811, and 812 Government procurement.
48 CFR Part 824 Freedom of information, Government procurement, Privacy.
48 CFR Part 839 Computer technology, Government procurement.
48 CFR Part 852 Government procurement, Reporting and recordkeeping requirements.

Signing Authority
Denis McDonough, Secretary of Veterans Affairs, approved this document on October 12, 2021, and authorized the undersigned to sign and submit the document to the Office of the Federal Register for publication electronically as an official document of the Department of Veterans Affairs.
Consuela Benjamin, Regulations Development Coordinator, Office of Regulation Policy & Management, Office of General Counsel, Department of Veterans Affairs.
For the reasons set forth in the preamble, VA proposes to amend 48 CFR chapter 8 as follows:
PART 802—DEFINITIONS OF WORDS AND TERMS

1. The authority citation for part 802 is revised to read as follows:
Authority:
40 U.S.C. 121(c); 41 U.S.C. 1121; 41 U.S.C. 1303; 41 U.S.C. 1702; and 48 CFR 1.301 through 1.304.
Subpart 802.1—Definitions
2. Section 802.101 is amended by adding definitions for “Business associate”, “Business Associate
802.101 Definitions.
Business associate (or associate) means an entity, including an individual (other than a member of the workforce of a covered entity), company, organization or another covered entity, as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L
2. Section 802.101 is amended by adding definitions for “Business associate”, “Business Associate
802.101 Definitions.
Business associate (or associate) means an entity, including an individual (other than a member of the workforce of a covered entity), company, organization or another covered entity, as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (Pub. L. 104-191) Privacy Rule (45 CFR part 160), that performs or assists in the performance of a function or activity on behalf of the Veterans Health Administration (VHA) that involves the creating, receiving, maintaining, transmitting of, or having access to, protected health information (PHI), or that provides to or for VHA, certain services as specified in the HIPPA Privacy Rule (45 CFR part 160) that involve the disclosure of PHI to a contractor by VHA. The term also includes a subcontractor of a business associate that creates, receives, maintains, or transmits PHI or that stores, generates, accesses, exchanges, processes, or utilizes such PHI on behalf of the business associate.
Business Associate Agreement (BAA) means the agreement, as dictated by the HIPPA Privacy Rule (45 CFR part 160), between VHA and a business associate, which must be entered into in addition to the underlying contract for services and before any release of PHI can be made to the business associate, in order for the business associate to perform certain functions or activities on behalf of VHA.

Gray market items means original equipment manufacturer goods intentionally or unintentionally sold outside an authorized sales territory or sold by non-authorized dealers in an authorized sales territory.

Information system means, pursuant to 38 U.S.C. 5727, a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information whether automated or manual.
Information technology ( see FAR 2.101), also means Information and Communication Technology (ICT)
y non-authorized dealers in an authorized sales territory.

Information system means, pursuant to 38 U.S.C. 5727, a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information whether automated or manual.
Information technology ( see FAR 2.101), also means Information and Communication Technology (ICT).
Information technology-related contracts means those contracts which include services (including support services) and related resources for information technology as defined in this section.

Privacy officer means the VA official with responsibility for implementing and oversight of privacy related policies and practices that impact a given VA acquisition.
Security plan means a formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements.
Sensitive personal information means, with respect to an individual, any information about the individual maintained by VA, including but not limited to the following:
(1) Education, financial transactions, medical history, and criminal or employment history.
(2) Information that can be used to distinguish or trace the individual's identity, including but not limited to name, social security number, date and place of birth, mother's maiden name, or biometric records.

VA Information Security Rules of Behavior for Organizational Users/VA National Rules of Behavior means a set of VA rules that describes the responsibilities and expected behavior of users of VA information or information systems.
VA sensitive information means all VA data, on any storage media or in any form or format, which requires protection due to the risk of harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the information and includes sensitive personal information
at describes the responsibilities and expected behavior of users of VA information or information systems.
VA sensitive information means all VA data, on any storage media or in any form or format, which requires protection due to the risk of harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the information and includes sensitive personal information. The term includes information where improper use or disclosure could adversely affect the ability of VA to accomplish its mission, proprietary information, records about individuals requiring protection under various confidentiality provisions such as the Privacy Act and the HIPAA Privacy Rule, and information that can be withheld under the Freedom of Information Act. Examples of VA sensitive information include the following: individually-identifiable medical, benefits, and personnel information; financial, budgetary, research, quality assurance, confidential commercial, critical infrastructure, investigatory, and law enforcement information; information that is confidential and privileged in litigation such as information protected by the deliberative process privilege, attorney work-product privilege, and the attorney-client privilege; and other information which, if released, could result in violation of law or harm or unfairness to any individual or group, or could adversely affect the national interest or the conduct of Federal programs.

PART 804—ADMINISTRATIVE AND INFORMATION MATTERS

3. The authority citation for part 804 is revised to read as follows:
Authority:
38 U.S.C. 5723-5724; 5725(a)-(c); 40 U.S.C. 121(c); 41 U.S.C. 1702; and 48 CFR 1.301 through 1.304.
4. Subpart 804.19 is added to read as follows:
Subpart 804.19—Basic Safeguarding of Covered Contractor Information Systems
Sec. 804.1900-70 Scope of subpart. 804.1902 Applicability. 804.1970 Information security policy—contractor general responsibilities. 804.1903 Contract clause
Authority:
38 U.S.C. 5723-5724; 5725(a)-(c); 40 U.S.C. 121(c); 41 U.S.C. 1702; and 48 CFR 1.301 through 1.304.
4. Subpart 804.19 is added to read as follows:
Subpart 804.19—Basic Safeguarding of Covered Contractor Information Systems
Sec. 804.1900-70 Scope of subpart. 804.1902 Applicability. 804.1970 Information security policy—contractor general responsibilities. 804.1903 Contract clause. Subpart 804.19—Basic Safeguarding of Covered Contractor Information Systems 804.1900-70 Scope of this subpart.
This subpart prescribes policies and procedures for information security and protection of VA information, information systems, and VA sensitive information, including sensitive personal information.
804.1902 Applicability. This subpart applies to all VA acquisitions, including acquisitions of commercial items other than commercially available off-the-shelf items, when a contractor's information system may contain VA information.

804.1970 Information security policy—contractor general responsibilities. Contractors, subcontractors, business associates and their employees who are users of VA information or information systems, or have access to VA information and VA sensitive information shall—
(a) Comply with all VA information security and privacy program policies, procedures, practices and related contract requirements, specifications and clauses, this includes complying with VA privacy and confidentiality laws and implementing VA and VHA regulations (see 38 U.S.C. 5701, 5705, 5721-5728 and 7332; 38 CFR 1.460 through 1.496, 1.500 through 1.527, and
(b) Complete VA security awareness training on an annual basis;
(c) Complete VHA's Privacy and Health Insurance Portability and Accountability Act of 1996 (HIPAA) Training on an annual basis when access to protected health information (PHI) is required;
s and implementing VA and VHA regulations (see 38 U.S.C. 5701, 5705, 5721-5728 and 7332; 38 CFR 1.460 through 1.496, 1.500 through 1.527, and
(b) Complete VA security awareness training on an annual basis;
(c) Complete VHA's Privacy and Health Insurance Portability and Accountability Act of 1996 (HIPAA) Training on an annual basis when access to protected health information (PHI) is required;
(d) Report all actual or suspected security/privacy incidents and report the information to the contracting officer and contracting officer's representative (COR), as identified in the contract or as directed in the contract, within one hour of discovery or suspicion;
(e) Comply with VA policy as it relates to personnel security and suitability program requirements for background screening of both employees and non-employees who have access to VA information systems and data;
(f) Comply with directions that may be issued by the contracting officer or COR, or from the VA Assistant Secretary for Information and Technology or a designated representative through the contracting officer or COR, directing specific activities when a security/privacy incident occurs;
(g) Sign an acknowledgment that they have read, understand, and agree to abide by the VA Information Security Rules of Behavior (VA National Rules of Behavior) as required by 38 U.S.C. 5723, FAR 39.105, Privacy, and clause 852.204-71, Information and Information Systems Security, on an annual basis. The VA Information Security Rules of Behavior describe the responsibilities and expected behavior of contractors, subcontractors, business associates and their employees who are users of VA information or information systems, information assets and resources, or have access to VA information;
39.105, Privacy, and clause 852.204-71, Information and Information Systems Security, on an annual basis. The VA Information Security Rules of Behavior describe the responsibilities and expected behavior of contractors, subcontractors, business associates and their employees who are users of VA information or information systems, information assets and resources, or have access to VA information;
(h) Maintain records and compliance reports regarding HIPAA Security and Privacy Rule compliance in order to provide such information to VA upon request to ascertain whether the business associate is complying with all applicable provisions under both rules' regulatory requirements; and
(i) Flow down requirements in all subcontracts and Business Associate Agreements (BAAs), at any level, as provided in the clause at 852.204-71, Information and Information Systems Security.

804.1903 Contract clause. When the clause at FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems is required to be included in accordance with FAR 4.1903, the contracting officer shall insert clause 852.204-71, Information and Information Systems Security.

PART 811—DESCRIBING AGENCY NEEDS

5. The authority citation for part 811 is revised to read as follows:
Authority:
38 U.S.C 5723-5724; 5725(a)-(c); 40 U.S.C. 121(c); 41 U.S.C. 1303; 1702 and 48 CFR 1.301 through 1.304.
6. Subpart 811.5 is added to read as follows:
Subpart 811.5—Liquidated Damages
Sec. 811.500 Scope. 811.501-70 Policy—statutory requirement. 811.503-70 Contract clause. Subpart 811.5—Liquidated Damages
811.500 Scope. This subpart prescribes policies and procedures for using a liquidated damages clause in solicitations and contracts that involve VA sensitive personal information. This also pertains to any solicitations and contracts involving VA sensitive personal information issued by another agency for or on behalf of VA through an interagency acquisition in accordance with FAR subpart 17.5 and subpart 817.5
This subpart prescribes policies and procedures for using a liquidated damages clause in solicitations and contracts that involve VA sensitive personal information. This also pertains to any solicitations and contracts involving VA sensitive personal information issued by another agency for or on behalf of VA through an interagency acquisition in accordance with FAR subpart 17.5 and subpart 817.5.

811.501-70 Policy—statutory requirement. (a) Contracting officers are required to include a liquidated damages clause in contracts for the performance of any Department function which requires access to VA sensitive personal information (see the definition in 802.101), in accordance with 38 U.S.C. 5725(b). The liquidated damages are to be paid by the contractor to the Department of Veterans Affairs in the event of a data breach involving sensitive personal information maintained, processed, or utilized by contractors or any subcontractors.
(b) The purpose of the liquidated damages to be paid for by the contractor in the event of a data breach of personal sensitive information is for VA to provide credit protection services to affected individuals pursuant to 38 U.S.C. 5724(a)-(b).

811.503-70 Contract clause. (a) Insert the clause at 852.211-76, Liquidated Damages—Reimbursement for Data Breach Costs, in all solicitations, contracts, or orders, where VA requires access to sensitive personal information for the performance of a Department function where—
(1) Sensitive personal information (see 802.101, Definitions) will be created, received, maintained, or transmitted, or that will be stored, generated, accessed, or exchanged such as protected health information (PHI) or utilized by a contractor, subcontractor, business associate, or an employee of one of these entities; or,
rsonal information for the performance of a Department function where—
(1) Sensitive personal information (see 802.101, Definitions) will be created, received, maintained, or transmitted, or that will be stored, generated, accessed, or exchanged such as protected health information (PHI) or utilized by a contractor, subcontractor, business associate, or an employee of one of these entities; or,
(2) When VA information systems will be designed or developed at non-VA facilities where such sensitive personal information is required to be created, received, maintained, or transmitted, or that will be stored, generated, accessed, exchanged, processed, or utilized.
(b) Insert the clause at 852.211-76 with its Alternate I in all solicitations, contracts, or orders, in commercial items acquisitions awarded under the procedures of FAR part 8 or 12.
(c) Insert the clause at 852.211-76 with its Alternate II, in all solicitations, contracts, or orders, in simplified acquisitions exceeding the micro-purchase threshold that are for other than commercial items awarded under the procedures of FAR part 13 (see FAR 13.302-5(d)(1) and the clause at FAR 52.213-4).

PART 812—ACQUISITION OF COMMERCIAL ITEMS

7. The authority citation for part 812 continues to read as follows:
Authority:
38 U.S.C. 8127-8128; 40 U.S.C. 121(c); 41 U.S.C. 1702 and 48 CFR 1.301 through 1.304.
Subpart 812.3—Solicitation Provisions and Contract Clauses for the Acquisition of Commercial Items
8. Section 812.301 is revised to read as follows:
812.301 Solicitation provisions and contract clauses for the acquisition of commercial items
citation for part 812 continues to read as follows:
Authority:
38 U.S.C. 8127-8128; 40 U.S.C. 121(c); 41 U.S.C. 1702 and 48 CFR 1.301 through 1.304.
Subpart 812.3—Solicitation Provisions and Contract Clauses for the Acquisition of Commercial Items
8. Section 812.301 is revised to read as follows:
812.301 Solicitation provisions and contract clauses for the acquisition of commercial items. (f)(1) Contracting officers shall insert the clause 852.212-71, Gray Market and Counterfeit Items, in solicitations and contracts for new medical supplies, new medical equipment, new information technology equipment, and maintenance of medical or information technology equipment that includes replacement parts if used, refurbished, or remanufactured parts are unacceptable, when the associated solicitation includes FAR provisions 52.212-1 Instruction to Offerors-Commercial Items, and 52.212-2, Evaluation-Commercial Items.
(2) Contracting officers shall insert the clause 852.212-72, Gray Market and Counterfeit Items—Information Technology Maintenance Allowing Other-than-New Parts, in solicitations and contracts for the maintenance of information technology equipment that includes replacement parts, if used, refurbished, or remanufactured parts are acceptable, when the associated solicitation includes FAR provisions 52.212-1, Instruction to Offerors-Commercial Items, and 52.212-2, Evaluation-Commercial Items.

PART 824—PROTECTION OF PRIVACY AND FREEDOM OF INFORMATION

9. The authority citation for part 824 is revised to read as follows:
Authority:
5 U.S.C. 552a; 38 U.S.C. 5723-5724; 5725(a)-(c); 40 U.S.C. 121(c); 41 U.S.C. 1121(c); 41 U.S.C. 1702; 38 CFR 1.550 through 1.562 and 1.575 through 1.584; and 48 CFR 1.301 through 1.304.
Subpart 824.1—Protection of Individual Privacy
10. Sections 824.103-70 and 824.103-71 are added to read as follows:
824.103-70 Protection of privacy—general requirements and procedures related to Business Associate Agreements
U.S.C. 5723-5724; 5725(a)-(c); 40 U.S.C. 121(c); 41 U.S.C. 1121(c); 41 U.S.C. 1702; 38 CFR 1.550 through 1.562 and 1.575 through 1.584; and 48 CFR 1.301 through 1.304.
Subpart 824.1—Protection of Individual Privacy
10. Sections 824.103-70 and 824.103-71 are added to read as follows:
824.103-70 Protection of privacy—general requirements and procedures related to Business Associate Agreements. To ensure compliance with unique responsibilities to protect protected health information, contractors performing under VA contracts subject to unique protected health information (PHI) and Health Insurance Portability and Accountability Act of 1996 (HIPAA) shall comply with requirements and the clause prescribed at 804.1903, 852.204-71, Information and Information Systems Security.
(a) HIPAA Business Associate Agreement requirement. Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules, a Covered Entity (Veterans Health Administration (VHA)) must have a satisfactory assurance that its protected health information will be safeguarded from misuse. To do so, a Covered Entity enters into a Business Associate Agreement (BAA) with a contractor (now the business associate), which obligates the business associate to only use the Covered Entity's protected health information for the purposes for which it was engaged, provide the same protections and safeguards as is required from the Covered Entity, and agree to the same disclosure restrictions to PHI that is required of the Covered Entity in situations where a contractor—
(1) Creates, receives, maintains, or transmits VHA PHI or that will store, generate, access, exchange, process, or utilize such PHI in order to perform certain health care operations activities or functions on behalf of the Covered Entity; or
(2) Provides one or more of the services specified in the HIPPA Privacy Rule to or for the Covered Entity.
ered Entity in situations where a contractor—
(1) Creates, receives, maintains, or transmits V

[Text truncated at 120,000 characters. The full text is on the page linked above.]

## Nearby sections

- [86 FR 47 Federal Motor Vehicle Safety Standards; Child Restraint Systems, Incorporation by Reference](https://www.frixlaw.com/law-library/statutes/FR_PRORULE_2020-29111.md)
- [86 FR 279 International Fisheries; Pacific Tuna Fisheries; 2021 Commercial Fishing Restrictions for Pacific Bluefin Tuna in the Eastern Pacific Ocean](https://www.frixlaw.com/law-library/statutes/FR_PRORULE_2020-28999.md)
- [86 FR 498 Privacy Act of 1974; Implementation](https://www.frixlaw.com/law-library/statutes/FR_PRORULE_2020-28791.md)
- [86 FR 1022 Calculated Maximum Fuel Element Cladding Temperature](https://www.frixlaw.com/law-library/statutes/FR_PRORULE_2020-29151.md)
- [86 FR 1037 American Indian Probate Regulations](https://www.frixlaw.com/law-library/statutes/FR_PRORULE_2020-28306.md)
- [86 FR 1347 Partial Approval and Partial Disapproval of Air Quality Implementation Plans; Arizona; West Pinal County; 1987 PM10 Nonattainment Area Requirements](https://www.frixlaw.com/law-library/statutes/FR_PRORULE_2020-29092.md)
- [86 FR 1362 National Emission Standards for Hazardous Air Pollutants: Mercury Cell Chlor-Alkali Plants Residual Risk and Technology Review](https://www.frixlaw.com/law-library/statutes/FR_PRORULE_2021-00174.md)
- [86 FR 1418 Control of Alcohol and Drug Use: Coverage of Mechanical Employees and Miscellaneous Amendments](https://www.frixlaw.com/law-library/statutes/FR_PRORULE_2020-25868.md)
- [86 FR 2318 Clean Air Plans; 2008 8-Hour Ozone Nonattainment Area Requirements; Western Nevada County, California](https://www.frixlaw.com/law-library/statutes/FR_PRORULE_2020-28885.md)
- [86 FR 2582 Economic Growth Regulatory Relief and Consumer Protection Act: Implementation of National Standards for the Physical Inspection of Real Estate (NSPIRE)](https://www.frixlaw.com/law-library/statutes/FR_PRORULE_2021-00098.md)
- [86 FR 3889 Proposed Amendment of Area Navigation (RNAV) Route Q-34; Northeastern United States](https://www.frixlaw.com/law-library/statutes/FR_PRORULE_2021-00146.md)
- [86 FR 3899 Safety Management Systems for Domestic Passenger Vessels](https://www.frixlaw.com/law-library/statutes/FR_PRORULE_2021-01058.md)
- [86 FR 3935 Defense Federal Acquisition Regulation Supplement: Improved Energy Security for Main Operating Bases in Europe (DFARS Case 2020-D030)](https://www.frixlaw.com/law-library/statutes/FR_PRORULE_2021-00615.md)
- [86 FR 3957 Amendments to Brake System Safety Standards Governing Operations Using an Electronic Air Brake Slip System](https://www.frixlaw.com/law-library/statutes/FR_PRORULE_2020-28870.md)

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/FR_PRORULE_2021-24299. Check the current official text before relying on it. Not legal advice.