Va Fillable Contract Form – Fill Out and Use This PDF

Reference: ____________________	HANDBOOK 6500.6
	APPENDIX A

CHECKLIST FOR INFORMATION SECURITY IN THE INITIATION PHASE OF

ACQUISITIONS

1. BACKGROUND

In accordance with VA policy, contractors’ storage, generation, transmission or exchanging of VA sensitive information requires appropriate security controls to be in place. The VA Information Security Program policy – VA Directive and Handbook 6500 and additional 6500 series directives and handbooks - provide the framework for security within VA.

2. INSTRUCTIONS

This checklist must be completed at the initiation of all IT service acquisitions, statements of work, third-party service agreements and any other legally binding agreement in order to determine what, if any, security and privacy controls are necessary specifically as it relates to the VAAR security clause. OGC guidance should be sought on data ownership issues, as necessary. The checklist can also be used for other types of contracts, if appropriate or needed. In order to successfully complete this checklist, each question below must be addressed in coordination with all members of the local Acquisition Team including: the Procurement Requestor or Program Manager from the program office or facility, the Contracting Officer Representative (COR), the Information Security Officer (ISO), the Contracting Officer (CO) from the program office or facility’s servicing Acquisition office, and the Privacy Officer (PO). The ISO is the arbitrator if there are questions or disagreements on the appropriate answers.

Reference: ____________________			HANDBOOK 6500.6
				APPENDIX A
1.	Is this an acquisition or purchase of only commodities or
	goods (e.g. equipment or software)?	Yes		No
	If yes, then the security clause is not required as long as
	VA sensitive information is not involved.
	If no, then proceed to the next question.
2.	Does the contract involve “VA sensitive information?”
	(See 3. PROCEDURES a.)	Yes		No
	If yes, proceed to next question.
	If no, then the security clause is not required.
3.	Will this acquisition require services of contractor
	personnel?	Yes		No
	If no, proceed to question 5.
	If yes, proceed to next question.
4.	Will the personnel perform a function that requires
	access to a VA system or VA sensitive information (e.g.,	Yes		No
	system administrator privileged access to a VA system,
	or contractor systems or processes that utilize VA
	sensitive information)?
	NOTE: See 3.a. under PROCEDURES regarding
	contracts and agreements concerning medical
	treatment for Veterans.
	If the answer above is no, then proceed to the next
	question.
	If yes, then VA security policies apply. Contracting
	Officials need to work with the Program Manager or
	(procurement requestor), COTR, PO, and ISO to:
	i. Include the appropriate risk designation of the
	contractors based on the PDAT determination.
	ii. Incorporate the security clause (Appendix B) into the
	contract involved and the appropriate security/privacy
	language outlined in Appendix C into the solicitation.
	iii. Determine if protected health information is
	disclosed or accessed and if a BAA is required.

Reference: ____________________		HANDBOOK 6500.6
			APPENDIX A
requirements).
• Ensure yearly FISMA assessments are completed
and uploaded into SMART.
6. Will this acquisition require services that involve
connection of one or more contractor-owned IT devices	Yes		No
(such as a laptop computer or remote connection from a
contractor system) to a VA internal trusted (i.e., non-
public) network?
If no, then include a statement in the SOW that “The
C&A requirements do not apply, and that a Security
Accreditation Package is not required: and proceed to
the next question.
If yes, then incorporate the security clause from
Appendix B and the appropriate security/privacy
language from Appendix C respectively into the
solicitation and contract. Contracting Officials need to
work with the COR and the ISO to:

•Ensure contractor understands and implements the IT security requirements for system interconnection documents required per the Memorandum of Understanding or Interconnection Agreement (MOU- ISA). The standard operating procedure (SOP) and a template for a MOU-ISA are located on the Information Protection Risk Management (IPRM) Portal and can be provided to the contractor.

•Ensure contractor understands their participation in IT security requirements for C&A of the VA system to which they connect.

•Enforce contractor performance (timely submission of deliverables, compliance with personnel screening requirements, and appropriate termination activity as appropriate).

7.Is the acquisition a service that involves the storage,

generating, transmitting, or exchanging of VA sensitive	Yes		No
information but does not require C&A or a MOU-ISA for
system interconnection?
If no, then specify the mechanism/documentation used
to ensure the VA sensitive information is protected.

Reference: ____________________	HANDBOOK 6500.6
	APPENDIX A

If yes, then incorporate the security clause and the appropriate security language from Appendices B and C into the solicitation and contract. The COTR needs to:

•Ensure that a Contractor Security Control Assessment (CSCA) is completed within 30 days of contract approval and yearly on the renewal date of the contract.

•Ensure that the CSCA is sent to the ISO and the OCS Certification Program Office for review to ensure that appropriate security controls are being implemented in service contracts.

•Ensure a copy of the CSCA is maintained in the Security Management and Reporting Tool (SMART) database. COTR will provide a copy of the completed CSCA to ISO for uploading into SMART database.

Reference: ____________________	HANDBOOK 6500.6
	APPENDIX A

3. SIGNATURES

Please provide the name and telephone number of each Acquisition Team member who participated in completing this checklist. By signing this checklist, the Contracting Officer is representing that Security was considered for this requirement through coordination with members of the Acquisition Team including the program or requesting office's IT Security point of contact.

(1)Contracting Officer Representative:

Name:Phone:

Signature:Date:

(2)Information Security Officer:

Name:Phone:

Signature:Date:

(3)Contracting Officer:

Name:Phone:

Signature:Date:

(4)Procurement Requestor/Program Manager:

Name:Phone:

Title:

Signature:Date:

(5)Privacy Officer:

Name:Phone:

Signature:Date:

(6)Other Team Members participating in the acquisition (e.g., Records Management Officer/Compliance Officer):

Name:Phone:

Title:

Signature:Date: