SBU Clause and Form.pdf

SAFEGUARDING AND DISSEMINATION OF SENSITIVE BUT UNCLASSIFIED (SBU)

BUILDING INFORMATION

This clause applies to all recipients of SBU building information, including offerors, bidders, awardees, contractors, subcontractors, lessors, suppliers, and manufacturers.

(a) Marking SBU. Contractor-generated documents that contain building information must be reviewed by GSA to identify any SBU content, before the original or any copies are disseminated to any other parties. If SBU content is identified, the contracting officer may direct the contractor, as specified elsewhere in this contract, to imprint or affix SBU document markings to the original documents and all copies, before any dissemination.

(b) Authorized recipients. Building information considered SBU must be protected with access strictly controlled and limited to those individuals having a need to know such information. Those with a need to know may include Federal, State, and local government entities, and nongovernmental entities engaged in the conduct of business on behalf of or with GSA.

Nongovernmental entities may include architects, engineers, consultants, contractors, subcontractors, suppliers, and others submitting an offer or bid to GSA or performing work under a GSA contract or subcontract. Contractors must provide SBU building information when needed for the performance of official Federal, State, and local government functions, such as for code compliance reviews and for the issuance of building permits. Public safety entities such as fire and utility departments may require access to SBU building information on a need to know basis. This clause must not prevent or encumber the dissemination of SBU building information to public safety entities.

(c) Dissemination of SBU building information:

(1) By electronic transmission. Electronic transmission of SBU information outside of the GSA firewall and network must use session (or alternatively file encryption). Sessions (or files) must be encrypted with an approved NIST algorithm, such as Advanced Encryption Standard (AES) or Triple Data Encryption Standard (3DES), in accordance with the Federal Information Processing Standards Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules. Encryption tools that meet FIPS 140-2 are referenced on the NIST web page found at the following URL: http://csrc.nist.gov/groups/STM/cmvp/documents/140- 1/1401vend.htm. All encryption products used to satisfy the FIPS 140-2 requirement should have a validation certificate that can be verified at the following URL:

http://csrc.nist.gov/groups/STM/cmvp/validation.html#02. (Not all vendors of security products that claim conformance with FIPS 140-2 have validation certificates.) Contractors must provide SBU building information only to authorized representatives of State, Federal, and local government entities and firms currently registered as “active” in the Central Contractor Registration (CCR) database at www.ccr.gov that have a need to know such information. If a subcontractor is not registered in the CCR and has a need to possess SBU building information, the subcontractor shall provide to the contractor its DUNS number or its tax ID number and a copy of its business license.

(2) By nonelectronic form or on portable electronic data storage devices. Portable electronic data storage devices include but are not limited to CDs, DVDs, and USB drives.

Nonelectronic forms of SBU building information include paper documents.

(i) By mail. Utilize only methods of shipping that provide services for monitoring receipt such as track and confirm, proof of delivery, signature confirmation, or return receipt.

(ii) In person. Contractors must provide SBU building information only to authorized representatives of State, Federal, and local government entities and firms currently registered as “active” in the CCR database that have a need to know such information.

(3) Record Keeping. Contractors must maintain a list of State, Federal, and local government entities and the firms to which SBU is disseminated under sections (c) (1), and

(c) (2) of this clause. The list must include at a minimum (1) the name of the State, Federal, or local government entity or firm to which SBU has been disseminated; (2) the name of the individual at the entity or firm who is responsible for protecting the SBU building information, with access strictly controlled and limited to those individuals having a need to know such information; (3) contact information for the named individual; and (4) a description of the SBU building information provided. Once work is completed, or for leased space with the submission of the “as built” drawings, the contractor must collect all lists maintained in accordance with this clause, including those maintained by any subcontractors and/or suppliers, and submit them to the contracting officer. For federal buildings, final payment may be withheld until the lists are received.

(d) Retaining SBU documents. SBU building information (both electronic and paper formats) must be protected, with access strictly controlled and limited to those individuals having a need to know such information.

(e) Destroying SBU building information. SBU building information must be destroyed such that the marked information is rendered unreadable and incapable of being restored, or returned to the contracting officer, when no longer needed, in accordance with guidelines provided for media sanitization within Appendix A of NIST Special Publication 800-88, Guidelines for Media Sanitization, available at http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.pdf. If SBU building information is not returned to the contracting officer, examples of acceptable destruction methods for SBU building information are burning or shredding hardcopy; physically destroying portable electronic storage devices such as CDs, DVDs, and USB drives; deleting and removing files form electronic recycling bins; and removing material from computer hard drives using a permanent-erase utility such as bit wiping software or disk crushers.

(f) Notice of disposal. The contractor must notify the contracting officer that all SBU building information has been destroyed, or returned to the contracting officer, by the contractor and its subcontractors or suppliers in accordance with section (e) of this clause, with the exception of the contractor’s record copy. This notice must be submitted to the contracting officer at the completion of the contract in order to receive final payment. For leases, this notice must be submitted to the contracting officer at the completion of the lease term.

(g) Incidents. All improper disclosures of SBU building information must be immediately reported to the contracting officer at 303-236-1111. If the contract provides for progress payments, the contracting officer may withhold approval of progress payments until the contractor provides a corrective action plan explaining how the contractor will prevent future improper disclosures of SBU building information. Progress payments may also be withheld for failure to comply with any provision of this clause until the contractor provides a written corrective action plan explaining how the contractor will rectify any noncompliance and comply with the clause in the future.

(h) Subcontracts. The Contractor must insert the substance of this clause in all subcontracts.

The requester shall complete the information below and return the entire Request for Sensitive but Unclassified Building (SBU) Information document to the Contracting Officer or Contract Specialist.

By signature below, the requestor of SBU building information acknowledges the requirement to maintain controls, as stated herein, to safeguard the information, and shall return or destroy the SBU building information as required by this Agreement. The undersigned acknowledges that the requester shall abide by this Agreement and shall only disseminate SBU building information to other authorized users under the conditions set forth herein.

Company Name: ______________________________________________

Name of Individual: ____________________________________________

Signature: ___________________________________________________

Title: _______________________________________________________

Date: _________________

(Attach copy of business license or formation document)

DUNS Number:_________________________________________

DUNS Number Verified by Government Representative at: http://www.fpdc.gov/fpdc/duns-query-v2_fpdc.htm or http://www.ccr.gov Yes: ___ No: ___

Employer ID Number/Federal Tax ID Number ___________________________________

Offeror/bidder/contractor information and DUNS number has been verified and release of SBU building information is approved by:

Contracting Officer's Name Date

Signature

DISPOSAL STATEMENT

(return upon completion of project and proper disposal of drawings)

Solicitation/Contract No. : 47PC0221R0011

I hereby certify that all Sensitive but Unclassified (SBU) building information relative to the referenced solicitation/contract not previously returned to the Government has been destroyed or disposed of by burning or shredding paper copies, physically destroying computer diskettes or permanently deleting/removing/erasing electronic files from computers.

I also certify the no unauthorized physical or electronic copies of such SBU building information were made or are being retained.

Company Name: ______________________________________________

Name of Individual: ____________________________________________

Signature: ___________________________________________________

Title: _______________________________________________________

Date: _________________