The Federal Acquisition Regulation (FAR) council has issued a final rule that broadly requires specific privacy training and annual re-training for contractor or subcontractor personnel dealing with “personally identifiable information (PII). The provisions have no exception for commercial items, commercially available off-the-shelf items (COTs) or the purchase below the Simplified Acquisition Threshold (SAT). The clauses specify the minimum content required for contractor/subcontractor developed training, while individual government customers may develop trainings, as well. The rule is one of three issued by the Department of Homeland Security (DHS) that build upon other recent efforts to strengthen safeguarding requirements for sensitive government information. Other rules include information technology security awareness training and the safeguarding of controlled unclassified information.

Read more