47PE0721Q00080003 SBU Building Information Instructions.pdf

SENSITIVE BUT UNCLASSIFIED (SBU) BUILDING INFORMATION

(7) Sensitive But Unclassified (SBU) Building Information. The following requirements apply to information contained in this Contract that has been designated as Sensitive But Unclassified (SBU) building information:

(a) The Contractor shall submit to GSA all Contractor-generated documents that may contain SBU building information before the original or any copies are disseminated to any other parties. If GSA identifies SBU content in such documents, the Contracting Officer may direct the Contractor to imprint or affix SBU document markings to the original documents and all copies prior to dissemination.

(b) The Contractor shall protect SBU building information by strictly limiting access to those individuals having a need to know such information acting on behalf of Federal, State, and local government entities, nongovernment entities engaged in the conduct of business on behalf of or with GSA, and firms currently registered as "active" in the System for Award Management (SAM) database via https://www.sam.gov. If a subcontractor is not registered in the SAM and has a need to possess SBU building information, the subcontractor shall provide to the Contractor its DUNS number or its tax ID number and a copy of its business license. This clause shall not be construed to encumber the dissemination of SBU building information to public safety entities.

(c) The Contractor shall use session or file encryption when transmitting SBU building information electronically outside of the GSA firewall and network. The Contractor shall encrypt sessions or files with an approved NIST algorithm, such as Advanced Encryption Standard (AES) or Triple Data Encryption Standard (3DES), in accordance with Federal Information Processing Standards Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules. Encryption tools that meet FIPS 140-2 are referenced on the NIST web page found at the following URL:

http://csrc. nist.00v/oroups/STM/cmvp/documents/140-1/1401vend.htm

All encryption products used to satisfy the FIPS 140-2 requirement should have a validation certificate that can be verified at the following URL:

http://csrc. nist. qov/q roups/STM/cmvp/validation. html#02

(Note that not all vendors of security products that claim conformance with FIPS 140-2 have validation certificates.)

(d) When transmitting SBU building information contained in any physical media, including hardcopy and portable electronic data storage devices, the Contractor shall only use methods of shipping that provide services for monitoring receipt such as track and confirm, proof of delivery, signature confirmation, or return receipt. Portable electronic data storage devices include but are not limited to CDs, DVDs, and USB drives.

(e) The Contractor shall maintain a list of the entities and the firms to which it has disseminated SBU building information. This list must include at a minimum (1) the name of the entity or firm; (2) the name and contact information of the individual at the entity or firm who is responsible for protecting the SBU building information; and (3) a description of the SBU building information provided. Upon completion of the Work, the Contractor shall collect all lists maintained in accordance with this clause, including those maintained by any subcontractors and/or suppliers, and submit them to the Contracting Officer. The Contracting Officer may withhold final payment until the lists are received.

SENSITIVE BUT UNCLASSIFIED (SBU) BUILDING INFORMATION

(f) This Contract requires that the Contractor retain beyond the period of performance certain records that may contain SBU building information. With the exception of such records, upon completion of the Work, the Contractor shall either destroy all records containing SBU building information or return them to the Contracting Officer, as directed by the Contracting Officer. The Contractor shall destroy electronically stored SBU building information by deleting it or otherwise rendering it unreadable and incapable of being restored, in accordance with guidelines provided for media sanitization within Appendix A of NIST Special Publication 80088, Guidelines for Media Sanitization, available at http://csrc.nistoov/publicationsinistpubs/800-88/NISTSP800-88 revl .pdf. Examples of acceptable destruction methods for SBU building information are: burning or shredding hardcopies; physically destroying portable electronic storage devices; deleting and removing files from electronic recycling bins; and removing material from computer and hard drives using a permanent-erase utility such as bit-wiping software or disk crushers.

(g) The Contractor shall verify to the Contracting Officer in writing that SBU building information has been disposed of as required in Paragraph (7)(f) of this clause. The Contracting Officer may withhold final payment until written verification is received.

(h) The Contractor shall immediately report to the Contracting Officer all improper disclosures of SBU building information. If the Contractor fails to comply with any provision of this clause, the Contracting Officer may withhold approval of progress payments until the Contractor provides a corrective action plan explaining how it will rectify any noncompliance and prevent future improper disclosures of SBU building information.

(i) The Contractor shall insert the substance of this clause in all subcontracts.