As prescribed in 839.106-70(d), insert the following clause:

Security Controls Compliance Testing (FEB 2023)

On a periodic basis, VA, including the Office of Inspector General, reserves the right to evaluate any or all of the security and privacy controls implemented by the Contractor under the clauses contained within the contract. With 10 working-days' notice, at the request of the government, the Contractor must fully cooperate and assist in a government-sponsored security controls assessment at each location wherein VA information is processed or stored, or information systems are developed, operated, maintained, or used on behalf of VA, including those initiated by the Office of Inspector General. The government may conduct a security control assessment on shorter notice, to include unannounced assessments, as determined by VA in the event of a security incident or at any other time.

(End of clause)