View Rule

This Homeland Security Acquisition Regulation (HSAR) rule will propose to establish security standards that government contracts must contain in order to mitigate and manage potential breaches of sensitive information such as Personally Identifiable Information (PII).  Specifically, the rule will define key terms, outline security requirements and inspection provisions for contractor information technology (IT) systems that store or process sensitive information, institute incident notification and response procedures, identify post-incident credit monitoring requirements, and identify IT security awareness training requirements for contractor employees with access to DHS information systems as well as privacy training requirements for contractor employees with access to PII.