1. Purpose and Relationship to Governing Documents
This Safeguard Policy ("Policy") is published by VA WORKS, LLC ("Consultant") and forms part of the Governing Policies referenced in the Master Service Agreement (MSA), the MSA Terms and Conditions (https://vaworks.com/MasterServiceAgreement), and any applicable Scope of Work Terms and Conditions (https://vaworks.com/SOWSelection). In the event of conflict, priority shall be determined in accordance with the MSA.
The purpose of this Policy is to establish the administrative, technical, and physical safeguards implemented by Consultant to protect Non-Public Personal Information (NPI) and to ensure compliance with the Federal Trade Commission (FTC) Safeguards Rule under the Gramm-Leach-Bliley Act (GLBA), as well as any other applicable privacy and data protection laws.
2. Scope
This Policy applies to all employees, independent contractors, and third-party vendors engaged by Consultant who may have access to NPI processed in the course of client services.
3. Definitions
- Non-Public Personal Information (NPI): Personally identifiable financial information that is not publicly available, including but not limited to Social Security numbers, account information, income data, and credit reports.
- Qualified Individual: The person designated by Consultant to oversee, enforce, and maintain this Policy and its safeguards.
4. Program Oversight
Consultant has designated a Qualified Individual to administer the Safeguards Program, oversee risk assessments, ensure compliance, and serve as the point of contact for clients on matters related to NPI security.
5. Risk Assessment
Consultant conducts annual assessments to identify foreseeable risks to NPI. This review evaluates threats related to collection, access, storage, transmission, and disposal. Controls are updated to address emerging risks and evolving regulatory requirements.
6. Safeguards & Controls
Consultant maintains safeguards reasonably designed to protect NPI, including but not limited to:
- Access Controls: Limiting access to NPI strictly to authorized personnel.
- Encryption: Encrypting NPI both in transit and at rest where technically feasible and as supported by client-controlled systems.
- Authentication Protocols: Requiring multi-factor authentication (MFA) for systems where NPI is accessed.
- Workforce Security Measures: Ensuring personnel devices are configured with secure access protocols and endpoint protection.
7. Employee Training
All personnel with potential access to NPI receive training on security awareness, phishing prevention, proper data handling, and their responsibilities under this Policy. Training is updated annually and records of participation are retained.
8. Vendor Oversight
Where third-party vendors engaged by Consultant may access NPI, Consultant requires such vendors to contractually commit to implementing reasonable safeguards and undergoes periodic due diligence to ensure compliance.
9. Incident Response Plan
In the event of a suspected or confirmed breach involving NPI:
- The incident must be reported immediately to the Qualified Individual.
- Consultant initiates an internal investigation and, where applicable, notifies the affected client within 72 hours.
- Consultant documents the incident, implements corrective measures, and maintains a breach log for audit purposes.
10. Client Systems and Data Security Disclaimer
Where Consultant's personnel access Company-provided systems (including virtual desktops, licensed platforms, or third-party applications), Consultant does not own, manage, or control such environments. In accordance with the Data Security and Breach Disclaimer, Company remains solely responsible for implementing and maintaining adequate protections, malware defenses, access controls, and insurance coverage for its own systems. Consultant's safeguards under this Policy apply only to Consultant's personnel, processes, and devices.
11. Monitoring and Evaluation
Consultant reviews and updates this Policy at least annually, or sooner as required by regulatory changes, client requirements, or identified risks.
12. Enforcement
Violations of this Policy by employees, contractors, or vendors may result in disciplinary action, termination of engagement, and/or legal action. Consultant enforces this Policy uniformly and maintains records of enforcement actions.