Appendix E - CUI Requirements Table.pdf
PDF 595 KB Posted
- Solicitation number
- HTC711-21-R-R009
About this file
This document contains a modified NIST SP 800-171 requirements table and related federal contract opportunity. The requirements table modifies NIST SP 800-171 security requirements for controlled unclassified information to address Department of Defense information safeguarding for contractors. The related federal contract opportunity is a solicitation from the Department of Defense United States Transportation Command for non-temporary storage services of retrograde containerized household goods and unaccompanied baggage belonging to military, civilian, and Coast Guard members. The solicitation seeks an indefinite delivery indefinite quantity contract for operating storage facilities, handling shipments in and out of storage, and resolving loss or damage claims. The North American Industry Classification System code is 493110 for general warehousing and storage, with a small business size standard of $30 million. The requirement is anticipated to be a 100% small business set-aside.
View the file
Other files
Show all 20
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Appendix E
E-1
Appendix E: CUI Requirements Table
Modified NIST SP 800-171 Requirements Req # NIST SP 800-171 Requirement USTRANSCOM Modified Requirement
3.1.3 Control the flow of CUI in accordance with
approved authorizations.
Limit the flow of DoD information to organizations or individuals necessary for the performance of the operationally critical requirements of this contract.
3.1.9 Provide privacy and security notices
consistent with applicable CUI rules.
Provide privacy and security notices consistent with U.S. Government and/or local governmental regulations.
3.1.19 Encrypt CUI on mobile devices and mobile
computing platforms.
Provide adequate technical protections on mobile devices and computing platforms that process and/or store contractual information.
3.1.22 Control CUI posted or processed on publicly
accessible systems.
Control DoD information posted or processed on publically accessible systems.
3.7.3 Ensure equipment removed for off-site
maintenance is sanitized of any CUI.
Ensure equipment removed for off-site maintenance is sanitized of DoD information.
3.8.1 Protect (i.e., physically control and securely
store) system media containing CUI, both paper and digital.
Protect (i.e., physically control and securely store) system media containing DoD information, both paper and digital.
3.8.2 Limit access to CUI on system media to
authorized users.
Limit access to DoD information on system media to authorized users.
3.8.3 Sanitize or destroy system media containing
CUI before disposal or release for reuse.
Sanitize or destroy system media containing DoD information before disposal or release for reuse.
3.8.4 Mark media with necessary CUI markings
and distribution limitations.
Mark media with privacy and security notices consistent with U.S. Government and/or local government regulations.
3.8.5 Control access to media containing CUI and
maintain accountability for media during transport outside of controlled areas.
Control access to and maintain accountability for media containing DoD information.
3.8.9 Protect the confidentiality of backup CUI at
storage locations.
Provide information backup procedures (frequency, timeframe for storage, etc.) for DoD data located on contractor systems. Protect the confidentiality of backup materials containing DoD information.
3.9.1 Screen individuals prior to authorizing access
to organizational systems containing CUI.
Screen individuals prior to authorizing access to organizational systems containing DoD information.
3.9.2 Ensure that CUI and organizational systems
containing CUI are protected during and after personnel actions such as terminations and transfers.
Ensure that DoD information and organizational systems containing DoD information are protected during and after personnel actions such as terminations and transfers.
3.10.6 Enforce safeguarding measures for CUI at
alternate work sites (e.g., telework sites).
Enforce safeguarding measures for DoD Information at alternate work sites (e.g., telework sites).
3.11.1 Periodically assess the risk to organizational
operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of DoD information.
Appendix E
E-2
3.13.8 Implement cryptographic mechanisms to
prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
Implement cryptographic mechanisms to prevent unauthorized disclosure of DoD information during transmission when possible unless otherwise protected by alternate physical safeguards.
3.13.11 Employ FIPS-validated cryptography when
used to protect the confidentiality of CUI.
Employ FIPS-validated cryptography when used to protect the confidentiality of DoD information within the organization’s systems and when possible when transmitting to external entities.
3.13.16 Protect the confidentiality of CUI at rest. Protect the confidentiality of DoD information at rest.
File details come from the government source that posted it. Updated .