iFederal contractors know all too well the list of annual requirements and obligations can seem overwhelming at times. One that may get overlooked by some is annual training requirements. A fairly new such training went into effect in 2017 – it requires certain federal contractors to do annual data privacy training.
According to the U.S. General Services Administration (“GSA”), for example, its agency-wide and role-based training offerings cover the GSA’s policies on protecting personally identifiable information (“PII”). The GSA requires all employees and contractors to complete privacy and security awareness training upon employment and each year thereafter. Importantly,
GSA account holders must complete this training in order to maintain access to the agency’s IT systems and resources such as email, Google Drive and other IT resources.
The current political landscape (President Biden has announced heighted focus in this area, including plans for $10B of investment in government cyber and IT infrastructure), the COVID-19 pandemic where many federal contractors are receiving large amounts of sensitive information, and recent high-profile data security incidents involving the U.S. government, like SolarWinds, provide further reasons to support a business imperative to bolster the privacy and security awareness of your workforce. Therefore, we recommend following the below steps to ensure your teams are training in this critical area.
Identify if requirements apply, and who needs training
In general, annual privacy training is required for any federal contractor employee who accesses, processes, or handles PII on behalf of a government agency. This includes contractor employees who have access to any system of government records, or who assist in designing, developing, maintaining, or operating a system of records. Prime contractors are required to flow down these privacy training requirements to their subcontractors.
PII is defined in this regulation as “information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual.”
Per the FAR, as noted above, contractor employees may not have access to PII unless they have had the required privacy training.
What must training include
Per the FAR, training must address:
-
The contractors policies and procedures for processing and safeguarding of PII;
-
The provisions of the Privacy Act of 1974, including penalties for violations of the Act;
-
The authorized and official use of a system of records;
-
The restriction on the unauthorized use, handling disclosure, or access of PII or a system of records; and
-
The procedures to follow in the event of a suspected or confirmed breach of a system of records or PII.
Understanding the requirements
A one-size-fits-all training likely will not be sufficient as the FAR requirements are described as “role based” and should be appropriate for different levels of employees. There should also be measures in place to test the knowledge of users. Contractors must also maintain and be able to provide documentation regarding the completion of the privacy training upon the request of their Contracting Officers.
Format of training
Contractors may provide their own training to employees, except in the limited cases where an agency requires that certain training be utilized. Contractors can develop the content internally or use a third-party vendor or firm to do the training. Jackson Lewis provides this type of training to many of our government contractor clients.
Recommended next steps for Government Contractors
-
Determine if your employees have access to PII as part of a government contract.
-
Review privacy procedures and policies to confirm compliance with training requirements.
-
If you are not currently training your employees in compliance with FAR 52.224-3, implement training program for employees handling PII.
-
Review subcontracts, as the privacy training requirements also apply to subcontractors.
