# Agency Information Collection Activity: Department of Veterans Affairs Acquisition Regulation (VAAR)—Information Security and Privacy Contract Clauses
**AGENCY:**
Office of Acquisition and Logistics, Department of Veterans Affairs.
**ACTION:**
Notice.
**SUMMARY:**
In compliance with the Paperwork Reduction Act (PRA) of 1995, this notice announces that the Office of Acquisition and Logistics (OAL), Department of Veterans Affairs (VA), will submit the collection of information abstracted below to the Office of Management and Budget (OMB) for review and comment. The PRA submission describes the nature of the information and its expected cost and burden, and it includes the actual data collection instrument.
**DATES:**
Comments and recommendations on the proposed information collection should be sent by April 24, 2026.
**ADDRESSES:**
To submit comments and recommendations for the proposed information collection, please type the following link into your browser: *www.reginfo.gov/public/do/PRAMain,* select “Currently under Review—Open for Public Comments”, then search the list for the information collection by Title or “OMB Control No. 2900-0895.”
**FOR FURTHER INFORMATION CONTACT:**
*VA PRA information:* Dorothy Glasgow, 202-461-1084, *[email protected].*
**SUPPLEMENTARY INFORMATION:**
*Title:* Department of Veterans Affairs Acquisition Regulation (VAAR)—Information Security and Privacy Contract Clauses.
*OMB Control Number:* 2900-0895. *https://www.reginfo.gov/public/do/PRASearch.*
*Type of Review:* Revision of a currently approved collection.
*Abstract:* VA uses three Department of Veterans Affairs Acquisition Regulation (VAAR) contract clauses to ensure security when a contractor has access to VA information or information systems, as follows:
• Clause 852.239-70, Security Requirements for Information Technology Resources, is required in all solicitations, contracts and orders exceeding the micro-purchase threshold that include information technology services. This clause requires the contractor to be responsible for information technology security for all systems connected to a VA network or operated by the contractor for VA, regardless of location.
• Clause 852.239-72, Information System Design and Development, is required in all solicitations, contracts, orders and agreements where services to perform information system design and development are required.
• Clause 852.239-73, Information System Hosting, Operation, Maintenance, or Use, is required in all solicitations, contracts, orders and agreements where services to perform information system hosting, operation, or maintenance are required.
Clauses 852.239-72 and 852.239-73 are intended to protect VA sensitive information and information technology by requiring contractor and subcontractor personnel to be subject to the same Federal laws, regulations, standards, and VA directives and handbooks as VA and VA personnel regarding information and information system security.
This revision changes the title from “Department of Veterans Affairs Acquisition Regulation Clause 852.239-70, VA Information and Information System Security and Privacy” to “Department of Veterans Affairs Acquisition Regulation (VAAR)—Information Security and Privacy Contract Clauses”. The previous title implied that this OMB Control Number covered a single clause instead of multiple clauses. The title change is the only revision to the currently approved collection.
An agency may not conduct or sponsor, and a person is not required to respond to a collection of information unless it displays a currently valid OMB control number. The *Federal Register* Notice with a 60-day comment period soliciting comments on this collection of information was published at 91 FR 2276, January 16, 2026.
*Affected Public:* Business or other for-profit.
*Estimated Annual Burden:* 4,815 hours.
*Estimated Average Burden per Respondent:* 19 minutes.
*Frequency of Response:* Less than quarterly.
*Estimated Number of Respondents:* 15,384.
*Authority:* 44 U.S.C. 3501 *et seq.*
Lanea Haynes,
Alternate, VA PRA Clearance Officer, Office of Information Technology, Data Governance Analytics, Department of Veterans Affairs.