Cybersecurity rules in this supplement
The SSA Acquisition Regulation (SSAR) addresses information security and Social Security data:
SSAR clause 2352.204-2 — Federal Information Security Management Act (FISMA) and Agency Privacy Management. Requires contractors that handle SSA information or systems to meet FISMA security requirements and SSA privacy management rules.
SSAR clause 2352.204-1 — Security and Suitability Requirements. Governs personnel security and suitability for contractor staff.
SSAR clause 2352.204-3 — Records Management Mandatory Annual Training. Requires annual records-management training.
In plain terms
Because SSA holds Social Security records on nearly everyone, its rules require FISMA-level security on any system you use for SSA, suitability screening for your people, and annual records-management training.
Who it applies to
Contractors and subcontractors that access SSA information or systems.
What it requires
Follow the FAR baseline, then: meet FISMA security and SSA privacy-management requirements, satisfy personnel security/suitability screening, and complete required records-management training.
Why it matters
SSA data is among the most sensitive personal information the government holds, so its FISMA and suitability requirements are core conditions of performance.
Citation
Social Security Administration Acquisition Regulation (SSAR), codified at 48 C.F.R. Chapter 23.