VA Acquisition Regulation (VAAR) Contract Clause - Information Security

FR: Veterans Affairs Department

Published March 19th, 2026

Detected March 19th, 2026

Summary

The Department of Veterans Affairs (VA) has issued a notice announcing its submission of an information collection activity related to the VA Acquisition Regulation (VAAR) contract clause on Information and Information Systems Security to the Office of Management and Budget (OMB) for review. This action is in response to the Federal Information Security Modernization Act of 2014 and requires contractors with access to VA information to report security incidents and breaches.

View original document View source feed page

What changed

The Department of Veterans Affairs (VA), through its Office of Acquisition and Logistics (OAL), has published a notice regarding a revision to an existing information collection activity concerning the VA Acquisition Regulation (VAAR) contract clause for Information and Information Systems Security. This revision is being submitted to the Office of Management and Budget (OMB) for review under the Paperwork Reduction Act (PRA). The VAAR clause, 852.204-71, and related section 804.1970, mandate that contractors with access to VA information or systems report known or suspected security/privacy incidents or data breaches. It also requires notification to the VA upon reassignment or termination of contractor employees who no longer require system access.

This notice initiates a public comment period ending on April 20, 2026, during which interested parties can submit comments and recommendations to OMB. Regulated entities, specifically contractors who handle VA information or systems, should review the proposed collection and submit comments if they have concerns or suggestions regarding the reporting requirements for security incidents and employee access changes. Failure to comply with these requirements, once finalized, could lead to contractual penalties or other enforcement actions by the VA.

What to do next

Review the VAAR contract clause revision for Information and Information Systems Security.
Submit comments to OMB by April 20, 2026, if applicable.
Ensure contractor personnel are aware of and comply with reporting requirements for security incidents and system access changes.

Source document (simplified)

Notice

You may be interested in this older document that published on 01/05/2026 with action 'Notice.' View Document

Agency Information Collection Activity: Department of Veterans Affairs Acquisition Regulation (VAAR) Contract Clause-Information and Information Systems Security

A Notice by the Veterans Affairs Department on 03/19/2026

This document has a comment period that ends in 32 days.
(04/20/2026) View Comment Instructions
PDF
Document Details
Document Dates
Table of Contents

- Related Documents

Public Comments
Regulations.gov Data

- Sharing

Print
Other Formats
Public Inspection Published Document: 2026-05400 (91 FR 13407) Document Headings ###### Department of Veterans Affairs

[OMB Control No. 2900-0900]

AGENCY:

Office of Acquisition and Logistics, Department of Veterans Affairs.

ACTION:

Notice.

SUMMARY:

In compliance with the Paperwork Reduction Act (PRA) of 1995, this notice announces that the Office of Acquisition and Logistics (OAL), Department of Veterans Affairs (VA), will submit the collection of information abstracted below to the Office of Management and Budget (OMB) for review and comment. The PRA submission describes the nature of the information and its expected cost and burden, and it includes the actual data collection instrument.

DATES:

Comments and recommendations on the proposed information collection should be sent by April 20, 2026.

ADDRESSES:

To submit comments and recommendations for the proposed information collection, please type the following link into your browser: www.reginfo.gov/public/do/PRAMain, select “Currently under Review—Open ( printed page 13408) for Public Comments”, then search the list for the information collection by Title or “OMB Control No. 2900-0900.”

FOR FURTHER INFORMATION CONTACT:

VA PRA information: Dorothy Glasgow, 202-461-1084, VAPRA@va.gov.

SUPPLEMENTARY INFORMATION:

Title: Department of Veterans Affairs Acquisition Regulation (VAAR) Contract Clause—Information and Information Systems Security.

OMB Control Number: 2900-0900 https://www.reginfo.gov/public/do/PRASearch.

Type of Review: Revision of a currently approved collection.

Abstract: Under Public Law 113-283, Federal Information Security Modernization Act of 2014, each agency of the Federal Government must provide security for the information and information systems that support the operations and assets of the agency. To comply with Public Law 113-283, VA developed VAAR clause, 852.204-71, Information and Information System Security, and section 804.1970, Information security policy—contractor general responsibilities. The clause and the section apply to contractors with access to VA information or information systems. Among other things, the clause and section require a contractor to report a known or suspected security/privacy incident or data breach related to VA information or information systems. The clause also requires a contractor to notify VA when a contractor employee has been reassigned or terminated and no longer needs access to a VA information system.

An agency may not conduct or sponsor, and a person is not required to respond to a collection of information unless it displays a currently valid OMB control number. The Federal Register Notice with a 60-day comment period soliciting comments on this collection of information was published at 91 FR 330, January 5, 2026.

Affected Public: Business or other for-profit.

Estimated Annual Burden: 4,069 hours.

Estimated Average Burden per Respondent: 30 minutes.

Frequency of Response: Less than quarterly.

Estimated Number of Respondents: 8,223.

Authority: 44 U.S.C. 3501 et seq.

Lanea Haynes,

Alternate, VA PRA Clearance Officer, Office of Information Technology, Data Governance Analytics, Department of Veterans Affairs.

[FR Doc. 2026-05400 Filed 3-18-26; 8:45 am]

BILLING CODE 8320-01-P

Published Document: 2026-05400 (91 FR 13407)