---
kind: "section"
citation: "48 C.F.R. § 824.103"
title: "48"
number: "824.103"
heading: "Procedures."
url: "https://uscodex.org/cfr/48/824.103"
---

# §824.103. Procedures.

- (c) The contracting officer shall reference the following documents in solicitations and contracts that require the design, development, or operation of a system of records—
  - (1) VA Handbook 6500.6, Contract Security;
  - (2) VA Handbook 6508.1, Procedures for Privacy Threshold Analysis and Privacy Impact Assessment;
  - (3) **VA Handbook 6510, VA Identity and Access Management—**
    - (i) The contracting officer will ensure that statements of work or performance work statements that require the design, development, or operation of a system of records include procedures to follow in the event of a Personally Identifiable Information (PII) breach; and
    - (ii) The contracting officer shall ensure that Government surveillance plans for contracts that require the design, development, or operation of a system of records include monitoring of the contractor's adherence to Privacy Act/PII regulations. The assessing official should document contractor-caused breaches or other incidents related to PII in past performance reports. Such incidents include instances in which the contractor did not adhere to Privacy Act/PII contractual requirements.

## Notes

### Amendments

[84 FR 45681, Aug. 30, 2019]

### Authority

Authority: 5 U.S.C. 552a; 38 U.S.C. 5723-5724, 5725(a)-(c); 40 U.S.C. 121(c); 41 U.S.C. 1121(c), 1702; 38 CFR 1.550 through 1.562 and 1.575 through 1.584; and 48 CFR 1.301 through 1.304.

### Source

Source: 73 FR 2717, Jan. 15, 2008, unless otherwise noted.

### Amendments

[84 FR 45681, Aug. 30, 2019]