Agency Information Collection Activities; Proposals, Submissions, and Approvals: Department of Veterans Affairs Acquisition Regulation—Information Security and Privacy Contract[...]

Agency Information Collection Activity: Department of Veterans Affairs Acquisition Regulation (VAAR)-Information Security and Privacy Contract Clauses

DATES:

Comments must be received on or before March 17, 2026.

SUPPLEMENTARY INFORMATION:

Under the PRA of 1995, Federal agencies must obtain approval from the Office of Management and Budget (OMB) for each collection of information they conduct or sponsor. This request for comment is being made pursuant to Section 3506(c)(2)(A) of the PRA.

With respect to the following collection of information, OAL invites comments on: (1) whether the proposed collection of information is necessary for the proper performance of OAL's functions, including whether the information will have practical utility; (2) the accuracy of OAL's estimate of the burden of the proposed collection of information; (3) ways to enhance the quality, utility, and clarity of the information to be collected; and (4) ways to minimize the burden of the collection of information on respondents, including through the use of automated collection techniques or the use of other forms of information technology.

Title: Department of Veterans Affairs Acquisition Regulation (VAAR)-Information Security and Privacy Contract Clauses.

OMB Control Number: 2900-0895. https://www.reginfo.gov/public/do/PRASearch (Once at this link, you can enter the OMB Control Number to find the historical versions of this Information Collection).

Type of Review: Revision of a currently approved collection.

Abstract: VA uses three Department of Veterans Affairs Acquisition Regulation (VAAR) contract clauses to ensure security when a contractor has access to VA information or information systems, as follows:

• Clause 852.239-70, Security Requirements for Information Technology Resources, is required in all solicitations, contracts and orders exceeding the micro-purchase threshold that include information technology services. This clause requires the contractor to be responsible for information technology security for all systems connected to a VA network or operated by the contractor for VA, regardless of location.
• Clause 852.239-72, Information System Design and Development, is required in all solicitations, contracts, orders and agreements where services to perform information system design and development are required.
• Clause 852.239-73, Information System Hosting, Operation, Maintenance, or Use, is required in all solicitations, contracts, orders and agreements where services to perform information system hosting, operation, or maintenance are required.

Clauses 852.239-72 and 852.239-73 are intended to protect VA sensitive information and information technology by requiring contractor and subcontractor personnel to be subject to the same Federal laws, regulations, standards, and VA directives and handbooks as VA and VA personnel regarding information and information system security.

This revision changes the title from "Department of Veterans Affairs Acquisition Regulation Clause 852.239-70, VA Information and Information System Security and Privacy" to "Department of Veterans Affairs Acquisition Regulation (VAAR)-Information Security and Privacy Contract Clauses". The previous title implied that this OMB Control Number covered a single clause instead of multiple clauses. The title change is the only revision to the currently approved collection.

Affected Public: Business or other for-profit.

Estimated Annual Burden: 4,815 hours.

Estimated Average Burden per Respondent: 19 minutes.

Frequency of Response: Less than quarterly.

Estimated Number of Respondents: 15,384.

Authority: 44 U.S.C. 3501 et seq.