Attach(7) AUNDA_for_CUI.pdf

AUTHORIZED USE and NON-DISCLOSURE AGREEMENT for

FEDERAL CONTRACT INFORMATION, CONTROLLED UNCLASSIFIED INFORMATION,

COVERED DEFENSE INFORMATION, CONTROLLED TECHNICAL INFORMATION

I, (full name), an individual, official, employee, consultant, contractor, or subcontractor, of , hereinafter referred to as “Recipient”, intending to be legally bound, consent to the terms in this AUTHORIZED USE and NON-DISCLOSURE AGREEMENT (AU&NDA), in consideration of being granted access to United States Government, as represented by the Department of the Navy, Naval Facilities Engineering Systems Command Far East, hereinafter collectively referred to as “Discloser”, contract related information that is and must be kept confidential and protected from unauthorized use, publication, distribution or disclosure. To ensure the protection of such information, hereinafter referred to as “Restricted Use Information”, and to preserve any confidentiality required under federal law, regulation, and/or government-wide policy (LRGWP), it is agreed that:

1. RESTRICTED USE INFORMATION: includes but is not limited to any and all Federal contract information (FCI), controlled unclassified information (CUI), covered defense information (CDI), and controlled technical information (CTI) (hereinafter referred to as “UNCLASSIFIED CONTRACT INFORMATION”), concerning CONTRACT / TASK ORDER No. (“CO/TO”). (initials)

2. The Recipient shall limit disclosure of the UNCLASSIFIED CONTRACT INFORMATION to within its own organization, i.e., to its directors, officers, partners, members, and/or employees, attorney, and subject matter experts (collectively referred to as “affiliates”) having a lawful government purpose, and/or to those who are listed on the Dissemination List (DL) on the last page of this Agreement. UNCLASSIFIED CONTRACT INFORMATION is FCI, CUI, CDI, and/or CTI (see CUI_OPSEC Guide for details), and as such, inappropriate for public release. Do not reveal the UNCLASSIFIED CONTRACT INFORMATION under any circumstances unless Discloser deems it necessary and provides written authorization. Release or disclosure of UNCLASSIFIED CONTRACT INFORMATION to non-U.S.

citizens employed by the Recipient is permitted, provided access is within the scope of assigned duties, and access would not be detrimental to the interests of Department of Defense (DoD), or the U.S. Government, and Discloser approves the same in writing. In such cases, the non-U.S. citizen shall also execute an AU&NDA approved by Discloser. If Recipient wishes to share the UNCLASSIFIED CONTRACT INFORMATION with anyone other than those authorized by this AU&NDA, Recipient shall request written permission to do so in accordance with Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7000, Disclosure of information. Only Discloser has the authority to disclose the UNCLASSIFIED CONTRACT INFORMATION. Recipient shall not disclose the UNCLASSIFIED CONTRACT INFORMATION obtained from Discloser unless required to do so by law. A Recipient who knowingly fails to comply with the requirements of Federal Acquisition Regulation (FAR) 3.104-3 (prohibition on disclosing procurement information) and 32 CFR Part 2002 may be subject to the penalties and administrative action set forth in 41 U.S.C. 2105 and applicable federal regulations, and or other applicable Treaties, etc.

3. AUTHORIZED USE: Recipient shall not make any use of the UNCLASSIFIED CONTRACT INFORMATION except to facilitate the work under the CO/TO referenced above. (initials)

4. Recipient agrees to return or destroy the UNCLASSIFIED CONTRACT INFORMATION at the completion of the purpose for the authorized use which required disclosure or not later than __________, whichever is sooner. Recipient shall identify all derivative works produced using the UNCLASSIFIED CONTRACT INFORMATION to Discloser not later than the above referenced date and request instructions on disposition or retention of such derivative works. A “derivative work,” that is, a work that is based on (or derived from) one or more already existing works, in this case the UNCLASSIFIED CONTRACT INFORMATION referenced herein. Upon request by Discloser, Recipient shall certify in writing he/she has destroyed the UNCLASSIFIED CONTRACT INFORMATION within ten days from such a request.

5. The duties and obligations arising from this Agreement equally applies to derivative works created using the restricted use information provided herein.

I HEREBY CERTIFY THAT:

1. I am a United States citizen ( )/a ____________ citizen ( ) (check all that apply).

2. I sign this form in my capacity as the Title/Position for the Recipient, both recorded herein.

3. I understand and agree that the term “Recipient” and the certifications contained herein refer only to the entity recorded herein.

4. The Recipient (entity) is U.S. owned ( )/a ____________ owned ( )/a Government Agency ( )/a Foreign Government ( ), whose corporate headquarters or principal place of business is recorded herein (check all that apply).

5. I understand and agree that if the Recipient is part of a business partnership (or an employee thereof), or part of a joint venture, or other teaming arrangement; or if the Recipient has a parent or subsidiary corporation, each parent or subsidiary corporation, or each entity comprising the joint venture or other teaming arrangement must submit a an executed “AU&NDA” in order to gain access to the UNCLASSIFIED CONTRACT INFORMATION. Under no circumstances shall the Recipient share the UNCLASSIFIED CONTRACT INFORMATION with another entity, including a parent or Subsidiary Corporation, another Government Agency, another Foreign Government Agency (or an employee thereof), without the express written permission of Discloser in accordance with Defense Acquisition Regulation Supplement (DFARS) 252.204-7000, Disclosure of Information.

6. I am an officer/employee of the Recipient. There exists a relationship between me and the Recipient, which, for purposes of this AU&NDA, means that the certifications contained herein are legally binding on both the Recipient and me.

7. For purposes of this AU&NDA, I understand and agree that the term “foreign national” means an individual who is not a United States citizen.

8. The Recipient [has]( )/[has no]( )(check one) foreign national employees that require access to the UNCLASSIFIED CONTRACT INFORMATION. (If answered in the affirmative, Recipient shall request written permission to disclose the UNCLASSIFIED CONTRACT INFORMATION to said foreign national(s) in accordance with

DFARS 252.204-7000).

9. I understand and acknowledge that Discloser is providing access to the UNCLASSIFIED CONTRACT INFORMATION for the authorized purpose described above. Furthermore, I understand and acknowledge that Recipient employees approved to have access to the UNCLASSIFIED CONTRACT INFORMATION, must execute an “AU&NDA” in order to gain access to the UNCLASSIFIED CONTRACT INFORMATION.

10. The Recipient will limit and control the reproduction and dissemination of the UNCLASSIFIED CONTRACT INFORMATION to the minimum required for the authorized purpose described above.

11. I understand and acknowledge the Recipient has a continuing obligation with respect to the UNCLASSIFIED CONTRACT INFORMATION disclosed.

12. I attest that I am familiar, and will comply, with the standards for accessing, disseminating, handling, and safeguarding the UNCLASSIFIED CONTRACT INFORMATION to which I am granted access as cited in this AU&NDA and in accordance with 32 CFR Part 2002, applicable LRGWP, and with the guidance provided to me by Discloser (see CUI_OPSEC Guide).

I UNDERSTAND AND AGREE TO THE FOLLOWING CONDITIONS

for ACCESS TO FCI, CUI, CDI, and CTI:

1. Non-disclosure: I agree to not disclose any UNCLASSIFIED CONTRACT INFORMATION to which I am granted access to anyone who, or anything that, is not granted such access pursuant to an applicable lawful Government purpose.

I understand my responsibilities to protect and not disclose UNCLASSIFIED CONTRACT INFORMATION except for, and to persons with, an appropriate lawful Government purpose. To ascertain whether someone or something is authorized access, pursuant to an applicable lawful Government purpose, to UNCLASSIFIED CONTRACT INFORMATION that is under my control or in my possession, I will do so in accordance with DFARS 252.204-7000, Disclosure of information.

2. Scope of information: I understand that the UNCLASSIFIED CONTRACT INFORMATION to which I am granted access includes any FCI, CUI, CDI, and/or CTI, I create or use on behalf of or for the Government, FCI, CUI, CDI, and/or CTI I receive from the Government to maintain, handle, transmit, or use (for the authorized purpose described herein, in derivative documents, etc.), or FCI, CUI, CDI, and/or CTI originating from another source (such as FCI, CUI, CDI, and/or CTI generated for the Government by a contractor of Recipient).

3. Training: I acknowledge that I have undergone training concerning the nature and protection of the UNCLASSIFIED CONTRACT INFORMATION to which I have been provided access, including procedures to follow in ascertaining whether other people to whom I contemplate disclosing this information are approved to access it pursuant to an appropriate lawful Government purpose, and that I understand this training and procedures. For training requirements see CUI_OPSEC Guide.

4. Security/control: I am obligated to protect UNCLASSIFIED CONTRACT INFORMATION to which I am granted access from unauthorized disclosure, in accordance with the terms of this agreement, 32 CFR Part 2002, Discloser guidance, and the LRGWP applicable to the specific categories of UNCLASSIFIED CONTRACT INFORMATION to which I am granted access.

5. Reporting breaches: I agree that I shall promptly report to appropriate officials, in accordance with the guidance issued for the applicable category of UNCLASSIFIED CONTRACT INFORMATION, any unauthorized disclosure that I have knowledge of whether or not I am personally involved. I also understand that my anonymity will be preserved to the extent possible when reporting such violations.

6. Time: I understand that all conditions and obligations imposed upon me by this agreement apply during the time I am granted access to UNCLASSIFIED CONTRACT INFORMATION, and at all times thereafter while such information remains controlled. These conditions and obligations may no longer apply if I am explicitly released in writing by an authorized representative of Discloser or the United States Government. After the information is de-controlled requests for public release must undergo a formal security and policy review and obtain official public release authorization in accordance with DoDI 5230.09, Clearance of DoD Information for Public Release, and DoDI 5230.29, Security and Policy Review of DoD Information for Public Release, before the information is released into the public domain.

7. Breach: If I violate the terms and conditions of this agreement, such violation may result in cancellation of my access to UNCLASSIFIED CONTRACT INFORMATION, and, depending upon the LRGWP that governs the UNCLASSIFIED CONTRACT INFORMATION, may result in civil and criminal sanctions, or other penalties and administrative action, as set forth in applicable Treaties, etc. This may also serve as a basis for denying me access to other types of information under Discloser’s control.

8. Assignee: I assign to the United States Government all royalties, remunerations, and emoluments that have resulted, will result, or may result from any disclosure, publication, or revelation of UNCLASSIFIED CONTRACT INFORMATION to which I am granted access that is inconsistent with the terms of this AU&NDA.

9. Remedies: This agreement is made and intended for the benefit of the United States Government and may be enforced by the United States Government or the authorized non-Federal entity. By granting me access to UNCLASSIFIED

CONTRACT INFORMATION in this context, the United States Government may seek any remedy available to it to enforce this agreement, including, but not limited to, application for a court order prohibiting disclosure of UNCLASSIFIED CONTRACT INFORMATION in breach of this agreement.

I understand that if I violate the terms and conditions of this agreement, I could be subjected to administrative, disciplinary, civil, or criminal action, as appropriate, under the LRGWP applicable to the category of UNCLASSIFIED CONTRACT INFORMATION involved, and neither the United States Government nor the non-Federal authorized entity have waived any statutory or common law evidentiary privileges or protections that they may assert in any administrative or court proceeding to protect any UNCLASSIFIED CONTRACT INFORMATION to which I have been given access under the terms of this agreement.

10. Severability: Each provision of this agreement is severable. If a court should find any provision of this agreement to be unenforceable, all other provisions shall remain in full force and effect.

11. Other agreements: My execution of this agreement shall not nullify or affect in any manner any other secrecy or non-disclosure agreement(s) that I have executed or may execute with Discloser, the United States Government, or any of its other departments or agencies.

12. Signing this agreement does not bar disclosures as required by superseding authorities of existing or future LRGWP.

13. I read this agreement carefully and my questions, if any, were answered. I acknowledge that Discloser has made available to me any agency guidance, LRGWP, or other laws, regulations, or directives referenced in this agreement so that I may read them at this time, if I so choose.

14. I understand and acknowledge the Recipient may be contacted to verify the statements made herein and that Discloser may visit the Recipient to ensure that proper information security practices are in place and are being followed. The Recipient agrees to cooperate fully in Discloser’s effort in this regard.

15. My statements in this agreement form are true, complete and correct to the best of my knowledge, information and belief.

They are made in good faith for the purpose of obtaining access to the UNCLASSIFIED CONTRACT INFORMATION disclosed for the authorized purpose indicated above. I understand and acknowledge that a knowing and willful false statement in this form is punishable by fine or imprisonment or both, pursuant to 18 United States Code, Section 1001, or other penalties and administrative action, as set forth in applicable Treaties, etc.

16. The information security requirements of the AU&NDAs executed are hereby incorporated by reference into the CO/TO referenced herein.

17. These provisions are consistent with and do not supersede, conflict with, or otherwise alter the employee obligations, rights, or liabilities created by existing statute or Executive order relating to (1) classified information, (2) communications to Congress, (3) the reporting to an Inspector General or the Office of Special Counsel of a violation of any law, rule, or regulation, or mismanagement, a gross waste of funds, an abuse of authority, or a substantial and specific danger to public health or safety, or (4) any other whistleblower protection. The definitions, requirements, obligations, rights, sanctions, and liabilities created by controlling Executive orders and statutory provisions are incorporated into this agreement and are controlling. 5 USC 2302(b)(13)

AUTHORIZED USE and NON-DISCLOSURE AGREEMENT (AU&NDA) for FCI, CUI, CDI, and CTI

ACKNOWLEDGEMENT

Full Name & Title or Position: Recipient’s Name/Entity/Business Address: Telephone Number & email:

I make this agreement in good faith, without mental reservation or purpose of evasion ( )(Initial).

Signature: Date:

ACCEPTANCE

Full Name of Contracting Officer (KO) (if not KO - Full Name and Title):

Business Address: Telephone Number & email:

Signature: Date:

DISTRIBUTION LIST (DL):

ATTACHMENT 1

CUI_OPSEC GUIDANCE

1.1 INFORMATION SECURITY

Recipient (which includes but is not limited to contractors, subcontractors, and foreign governments, etc.) may be provided federal contract information1or controlled defense information2 which includes but is not limited to controlled unclassified information (CUI)3, controlled technical information4, contractor attributional/proprietary information5, etc. (hereinafter collectively called “Restrictive Use Information”) under a solicitation, contract, task order, or delivery order (hereinafter collectively referred to as “an acquisition”).

According to Federal Acquisition Regulation (FAR) 52.204-21, Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 (DEVIATION 2024-O0013) and DoDI 5200.48 “Controlled Unclassified Information” (CUI) (06 March 2020) the Recipient shall provide adequate security6 for all Restrictive Use Information residing on or passing through non-DoD information systems. The Recipient shall only disseminate Restrictive Use Information within the scope of assigned duties and with a clear expectation that confidentiality is preserved. In accordance with (IAW) SECNAVINST 5510.36B, DON Information Security Program (Jul 12, 2019) all Department of the Navy (DON) employees including contractors shall be personally and individually responsible for properly protecting classified information and CUI under their custody and control and shall ensure classified information and CUI are protected IAW the same and Volumes 1 thru 3 of DoDM 5200.01, DoD Information Security Program of 24 Feb 2012 (Incorporating Change 1, Effective May 9, 2018) and DoDI 5200.48.

1.1.2 Information Safeguarding Requirements

Recipient shall protect/safeguard Restrictive Use Information and shall provide compliance documentation validating they are meeting this requirement in accordance with DFARS 252.204-7012 (DEVIATION 2024- O0013). Certain information provided by the government under an acquisition, requires unique handling, storage, marking, and/or release/dissemination procedures (see Addendum “A” OPSEC GUIDANCE” for specific details which is/are incorporated in full by reference herein). Recipient is cautioned to study Addendum “A” and comply accordingly.

1 In accordance with FAR 4.1901 “Federal contract information” means: information, not intended for public release, that is provide by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on a public Web site) or simple transactional information, such as that necessary to process payments.

2 In accordance with DFARS 252.204-7012 “Covered defense information” means unclassified controlled technical information or other information, as described in the Controlled Unclassified Information (CUI) Registry at https://www.archives.gov/cui/registry/category-list, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies, and is—

(1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the performance of the contract; or

(2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

3 In accordance with 32 CFR Part 2002 “Controlled Unclassified Information” means information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information (see paragraph (e) of this section) or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency.

4 In accordance with DFARS 252.204-7012 “Controlled technical information” means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information would meet the criteria, if disseminated, for distribution statements B through F using the criteria set forth in DoD Instruction 5230.24, Distribution Statements on Technical Documents. The term does not include information that is lawfully publicly available without restrictions.

5 In accordance with DFARS 252.204-7012 “Contractor attributional/proprietary information” means information that identifies the contractor(s), whether directly or indirectly, by the grouping of information that can be traced back to the contractor(s) (e.g., program description, facility locations), personally identifiable information, as well as trade secrets, commercial or financial information, or other commercially sensitive information that is not customarily shared outside of the company.

6 In accordance with DFARS 252.204-7012 “Adequate security” means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

Recipient shall track all “Restrictive Use Information” associated with an acquisition. Recipient shall document, maintain, and provide the Government, a record of subcontractors, vendors, suppliers, and/or all others, who will receive or develop Restrictive Use Information under an acquisition. Recipient shall restrict unnecessary sharing of Restrictive Use Information, and may only share, after receipt of written Government permission, based on a “lawful government purpose.” Recipient shall flow down the requirements specified in this section to its subcontractors, vendors, suppliers, and/or all others, who will receive or develop Restrictive Use Information under an acquisition.

All Recipient personnel assigned to an acquisition, shall complete annually the Center for Development of Security Excellence (CDSE) “DoD CUI Mandatory Controlled Unclassified Information (“CUI) Training” located on the CDSE eLearning website at https://www.dodcui.mil, or similar Contracting Officer approved annual CUI training, no later than 30 September of each year. Recipients will report by 15 October each year the number of their employees assigned to an acquisition, who were trained, the number remaining to be trained, and the completion percentage. Failure to comply with the requirement for annual CUI training may result in termination of an acquisition and may be reported as non-compliant with NAVY CUI requirements. The point of contact (POC) for reporting annual CUI training under this acquisition is the Contracting Officer’s Representative, or the Contracting Officer if the POC is unavailable.

1.1.3 Disclosure of Information Requirements

In accordance with DFARS Clause 252.204-7000, Disclosure of information, Recipient employees shall not discuss or disclose any information provided to them in the performance of their duties to parties other than authorized Government and/or Recipient personnel who have a "lawful government purpose." Recipient shall not use any information or documentation provided by the Government or developed under an acquisition, for other purposes without the consent of the Government Contracting Officer IAW DFARS 252.204-7000. Recipient shall not release to anyone outside the Recipient's organization any Restrictive Use Information, regardless of medium (e.g., film, tape, document, etc.), pertaining to any part of an acquisition, or any program related to the same, unless the Contracting Officer has given prior written approval IAW DFARS 252.204-7000. Markings: All deliverables/submittals generated by the Recipient under an acquisition shall be properly marked in accordance with DoDI 5200.48. Technical information7 and CTI shall also be marked with appropriate Distribution Statements and Export Control warnings in accordance with DoDI 5230.24, Distribution Statements on Technical Documents (Jan 10 2023) and program Security Classification Guidance.

1.1.4. Operations Security (OPSEC) Requirements

Information Security programs are usually oriented towards the protection of classified information and materials.

Operations Security (OPSEC) involves the protection of critical information focusing on unclassified information that may be susceptible to adversary exploitation. Pursuant to DoDD 5205.02E, Department of Defense Operations Security (OPSEC) Program (May 11, 2018), SECNAVINST 3070.2A, OPERATIONS SECURITY (9 May 2019), SECNAVINST 5510.36B, DON INFORMATION SECURITY PROGRAM (Jul 16 2019), and NAVFACINST 3070.2 (06 NOV 2017), NAVFAC's OPSEC program implements requirements in DoD 5205.02, DoD Operations Security (OPSEC) Program Manual (November 3, 2008, Incorporating Change 1, Effective April 26, 2018). OPSEC requirements are applicable when Recipient personnel have access to or generate Restrictive Use Information as defined in DFARS 225.204-7012 (DEVIATION 2024-O0013). As such, OPSEC Measures (i.e., the planned action to conceal or protect identified critical information and indicators from disclosure, observation, or detection and to protect the same from collection) are applicable to an acquisition. Recipient is cautioned to study Addendum “A” OPSEC GUIDANCE and comply accordingly.

7 In accordance with DFARS 252.204-7012 “Technical information” means technical data or computer software, as those terms are defined in the clause at DFARS 252.227-7013 , Rights in Technical Data— Noncommercial Items, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

All Recipient personnel shall comply with NAVFACINST 3070.2 (06 NOV 2017). NAVFACINST 3070.2 is available from the Contracting Office. All Recipient personnel assigned to an acquisition, shall complete annually the Center for Development of Security Excellence (CDSE) “OPSEC Awareness for Military Members, DoD Employees and Contractors” located on the CDSE eLearning website at https://www.cdse.edu/toolkits/deliveruncompromised/index.html, or similar Contracting Officer approved annual OPSEC training, no later than 30 September of each year. Recipients will report by 15 October each year the number of their employees assigned to an acquisition, who were trained, the number remaining to be trained, and the completion percentage. Failure to comply with the requirement for annual OPSEC training may result in termination of an acquisition and may be reported as non-compliant with NAVY OPSEC requirements. The point of contact (POC) for reporting annual OPSEC training under this acquisition is Contracting Officer’s Representative, or the Contracting Officer if the POC is unavailable.

Note: the following clauses have been incorporated, when appropriate, in NAVFAC acquisitions - DFARS

252.204.7000 Disclosure of Information, 252.204-7008 Compliance with Safeguarding Covered Defense Information Controls, 252.204-7009 Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information, and 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting (DEVIATION 2024-O0013). DFARS Clause 252.204-7000 restricts the release of unclassified information outside contractor's organization without prior Contracting Officer permission, with exceptions;

DFARS Clause 252.204-7008 requires contractor compliance with Safeguarding Covered Defense Information Controls; DFARS Clause 252.204-7009 limits the use or disclosure of contractor reported cyber incident information, and DFARS 252.204- 7012 (DEVIATION 2024-O0013) requires contractor to provide adequate security for all covered contractor information systems (including implementation of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” in effect at the acquisition is issued) and to comply with cyber incident reporting requirements.

Note: the following clauses have also been incorporated, when appropriate, in NAVFAC acquisitions - DFARS 252.204-7019 (Notice of NIST SP 800-171 DoD Assessment Requirements) and 252.204-7020 (NIST SP 800- 171 DoD Assessment Requirements) and 252.204-7021 (Cybersecurity Maturity Model Certification Requirement). Compliance with the referenced provisions and clauses is mandatory to be eligible for award.

1. DFARS provision 252.204-7019, provides in relevant part as follows. If the offeror is required to implement NIST SP 800-171, the offeror must have a current (not older than three years unless a lesser time is specified in the solicitation) NIST SP 800-171 DoD Assessment for each covered contractor information system that is relevant to the offer, contract, task order, or delivery order to be considered for award. It also requires the contractor to post summary level scores of their NIST SP 800-171 Assessments in the Supplier Performance Risk System (SPRS) database.

2. DFARS clause 252.204-7020, provides in relevant part as follows. If applicable, requires the contractor to provide Government access to facilities, systems, and personnel necessary for DoD to conduct or renew a higher- level Assessment.

The DFARS 252.204-7020 clause must be flowed down to all subcontractors (except COTS suppliers). The clause further directs that prime contractors are required to ensure that applicable subcontractors (i.e., those that must meet NIST SP 800- 171 requirements) have a current DoD Assessment posted in SPRS.

3. DFARS clause 252.204-7021, provides in relevant part as follows. The Cybersecurity Maturity Model Certification (CMCC) is a framework that measures a contractor’s cybersecurity maturity to include the implementation of cybersecurity practices and institutionalization of processes. The Contractor shall have a current (i.e. not older than 3 years) CMMC certificate at the CMMC level required by this contract and maintain the CMMC certificate at the required level for the duration of the contract, and includes flow-down requirements for subcontractors. (see https://dodcio.defense.gov/CMMC/about/).

1.1.5. Violations of the Information Security Requirement

A knowing, willful, or negligent failure to comply with the above-referenced Information Security requirements may result in criminal penalties under applicable Federal law, as well as administrative remedies including but not limited to termination of an acquisition.

ADDENDUM “A”

OPSEC GUIDANCE

1. Purpose. This document provides Operations Security (OPSEC)* guidance to Offerors/Contractors/Foreign Governments (i.e., corporations and businesses, etc.) who are provided Federal Contract Information (FCI) and process or store the same on a covered contractor information system)(FAR 52.204-21). This OPSEC guidance also applies to covered defense information (CDI), controlled technical information (CTI) or other information (as described in the controlled unclassified information (CUI) Registry at https://www.archives.gov/cui/registry/category-list (DFARS 252.204-7012 (DEVIATION 2024-O0013)); and said information is referred to in a solicitation, contract, task order, or delivery order (hereinafter called “acquisition”). May also include contractor attributional/proprietary information (CPI), personally identifiable information (PII), critical information (CI) or sensitive information (SI)) that is inappropriate for release to the public and that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government wide policies (DoDI 5200.48, Controlled Unclassified Information (CUI)(06 Mar 2020).

*OPSEC involves the protection of critical information focusing on unclassified information that may be susceptible to adversary exploitation. Pursuant to DoDD 5205.02E, Department of Defense Operations Security (OPSEC) Program (May 11, 2018) and NAVFACINST 3070.2 (06 NOV 2017), NAVFAC's OPSEC program implements requirements in the DoD 5205.02-M - OPSEC Program Manual. OPSEC requirements are applicable when contractor personnel have access to or generate CDI as defined in DFARS 225.204-7012 (DEVIATION 2024-O0013). As such, OPSEC Measures (i.e., the planned action to conceal or protect identified critical information and indicators from disclosure, observation, or detection and to protect the same from collection) are applicable to this requirement. Contractor employees shall not discuss or disclose any information provided to them in the performance of their duties to parties other than authorized Government and/or Contractor personnel who have a "need to know." Contractor shall not use any information or documentation provided by the Government or developed under this acquisition for other purposes without the consent of the Government Contracting Officer IAW DFARS 252.204-7000. Contractor shall not release to anyone outside the Contractor's organization any unclassified information, regardless of medium (e.g., film, tape, document, etc.), pertaining to any part of this acquisition or any program related to the same, unless the Contracting Officer has given prior written approval IAW DFARS 252.204-7000. Markings: All deliverables/submittals generated by the Contractor shall be properly marked. For Official Use Only information generated and/or provided under this contract shall be marked in accordance with DoDI 5200.48. Technical information shall also be marked with appropriate Distribution Statements and Export Control warnings in accordance with DoDI 5230.24 and program Security Classification Guidance.

Certain information provided by the government may require unique handling, storage and or release/dissemination procedures. Contractors are cautioned to study the “CONTRACTOR DUTIES & RESPONSIBILITIES" provided herein and comply accordingly.

Note: the following provisions/clauses have been incorporated in this solicitation/contract – FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems, DFARS 252.204-7000 Disclosure of Information, 252.204-7008 Compliance with Safeguarding Covered Defense Information Controls, 252.204-7009 Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information, and 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting (DEVIATION 2024-O0013). DFARS Clause 252.204-7000 restricts the release of unclassified acquisition information outside contractor's organization without prior Contracting Officer permission, with exceptions; DFARS Clause 252.204-7008 requires contractor compliance with Safeguarding Covered Defense Information Controls; DFARS Clause 252.204-7009 limits the use and disclosure of 3rd party cyber incident information; and DFARS 252.204-7012 (DEVIATION 2024-O0013) requires contractor to provide adequate security for all covered contractor information systems (including implementation of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” in effect at the acquisition is issued) and to comply with cyber incident reporting requirements. DFARS 252.204-7019 (Notice of NIST SP 800-171 DoD Assessment Requirements) and 252.204-7020 (NIST SP 800-171 DoD Assessment Requirements) and 252.204-7021 (Cybersecurity Maturity Model Certification Requirement). Compliance with the referenced provision and clause is mandatory to be eligible for award.

2. Applicability. NAVFAC has determined that additional safeguards are essential for acquisitions where access to unclassified NAVFAC information marked “CUI” via an information system is required and/or where access to the same is provided to Offerors/Contractors or when such information may be generated by the same in response to such an acquisition. Offerors/Contractors must adhere to the OPSEC guidance stipulated below when receiving unclassified NAVFAC information marked to indicate the same must be safeguarded (e.g., “CUI”)(see DoDI 5200.48) or when generating such information in response to an acquisition in order to protect the same and to avoid an OPSEC compromise or access to the same by unauthorized third parties including but not limited to an adversary (in order to maintain essential secrecy and/or for information security purposes). NAVFAC has determined that the OPSEC guidance stipulated below is required because this acquisition refers to and requires Offerors/Contractors to have access to unclassified NAVFAC information which has/have been marked “CUI,” in accordance with DoDI 5200.48.

CONTRACTOR DUTIES & RESPONSIBILITIES

(i) Offeror/Contractor shall limit disclosure of unclassified NAVFAC information marked in accordance with DoDI 5200.48 within its own organization to its directors, officers, partners, members, and/or employees, collectively referred to as its affiliate(s), having a need to know.

(ii) Offeror/Contractor is required to provide adequate security for all unclassified NAVFAC information marked in accordance with DoDI 5200.48 on covered contractor information systems.

(iii) It is recognized that adequate security will vary depending on the nature and sensitivity of the information on any given non-DoD information system. However, all unclassified NAVFAC information in the possession or control of non-DoD entities on non-DoD information systems shall minimally be safeguarded as follows:

a. Do not process unclassified NAVFAC information on publically available computers (e.g., those available for use by the general public in kiosks or hotel business centers).

b. Protect unclassified NAVFAC information by at least one physical or electronic barrier (e.g., locked container or room, logical authentication or logon procedure) when not under direct individual control of an authorized user.

c. At a minimum, overwrite media that have been used to process unclassified NAVFAC information before external release or disposal.

d. Encrypt all unclassified NAVFAC information marked in accordance with DoDI 5200.48 when it is stored on mobile computing devices such as laptops and personal digital assistants, compact disks, or authorized removable storage media such as thumb drives and compact disks, using the best encryption technology available to the contractor or teaming partner.

e. Limit transfer of unclassified NAVFAC information to subcontractors or teaming partners with a need to know and obtain a commitment from them to protect the information they receive to at least the same level of protection as that specified herein, the contract or other written agreement.

f. Transmit e-mail, text messages, and similar communications containing unclassified NAVFAC information using technology and processes that provide the best level of privacy available, given facilities, conditions, and environment. Examples of recommended technologies or processes include closed networks, virtual private networks, public key-enabled encryption, and transport layer security (TLS).

g. Encrypt organizational wireless connections and use encrypted wireless connections where available when traveling. If encrypted wireless is not available, encrypt document files (e.g., spreadsheet and word processing files), using at least application-provided password protected level encryption.

h. Transmit voice and fax transmissions only when there is a reasonable assurance that access is limited to authorized recipients.

i. Do not post unclassified NAVFAC information to website pages that are publicly available or have access limited only by domain or Internet protocol restriction. Such information may be posted to website pages that control access by user identification and password, user certificates, or other technical means and provide protection via use of TLS or other equivalent technologies during transmission. Access control may be provided by the intranet (vice the website itself or the application it hosts).

j. Provide protection against computer network intrusions and data exfiltration, minimally including:

(1) Current and regularly updated malware protection services, e.g., anti-virus, anti-spyware.

(2) Monitoring and control of both inbound and outbound network traffic (e.g., at the external boundary, sub-networks, individual hosts), including blocking unauthorized ingress, egress, and exfiltration through technologies such as firewalls and router policies, intrusion prevention or detection services, and host-based security services.

(3) Prompt application of security-relevant software patches, service packs, and hot fixes.

k. Comply with other current Federal and DoD information protection and reporting requirements for specified categories of information (e.g., medical, proprietary, critical program information (CPI), personally identifiable information, export controlled, etc.) as specified herein, in contracts, grants, and other legal agreements.

l. Report loss or unauthorized disclosure of unclassified NAVFAC information in accordance with the terms herein, the contract, grant, or other legal agreement requirements and mechanisms.

m. Do not use external IT services (e.g., e-mail, content hosting, database, document processing) unless they provide at least the same level of protection as that specified in the contract or other written agreement.

(iv) Offeror/Contractor’s personnel shall not discuss unclassified NAVFAC information marked in accordance with DoDI 5200.48 in public or over unprotected or unencrypted communications. NAVFAC information marked in accordance with DoDI 5200.48 may only be transmitted as directed by the Contracting Officer.

(v) Offeror/Contractor shall not transmit unclassified NAVFAC information marked in accordance with DoDI 5200.48 electronically over the Internet unless it is encrypted in accordance with appropriate Federal regulations. If in doubt, contact the Contracting Officer.

(vi) Because specific restrictions are needed to preclude unintentional release of unclassified NAVFAC information marked in accordance with DoDI 5200.48 to unauthorized parties including an adversary, unauthorized disclosure of the same may be punishable under 18 USC § 793 and/or any other applicable laws and/or regulations. Therefore, Offeror/Contractor’s personnel shall not disclose to unauthorized third parties, post to unofficial sites (including Social Networking sites) any images, data or information related to unclassified NAVFAC information marked in accordance with DoDI 5200.48.

(vii) Unauthorized disclosure and/or attempts to solicit unclassified NAVFAC information marked in accordance with DoDI 5200.48 by unauthorized third parties or others not affiliated with this acquisition shall be reported to the Contracting Officer, and/or the NAVFAC and/or installation Security Office, and your company Facility Security Officer and/or the Defense Security Service. Non-Disclosure requirements remain in effect during the duration of the awarded contract for this acquisition and indefinitely thereafter.

(viii) Practice OPSEC and implement countermeasures to protect unclassified NAVFAC information marked in accordance with DoDI 5200.48.

(ix) It is strongly recommended the Offeror/Contractor mark and protect related internal business information related to the acquisition and/or unclassified NAVFAC information marked in accordance with DoDI 5200.48. Internal company markings e.g., Business Sensitive, etc., are appropriate for identifying the aforementioned as sensitive information.

(x) Offeror/Contractor agrees to return or destroy unclassified NAVFAC information marked in accordance with DoDI 5200.48 upon notice of award of a contract under this acquisition which required disclosure of said unclassified NAVFAC information or not later than 10 days after such award, or upon request by the Contracting Officer.

(xi) Offeror/Contractor agrees it shall identify all derivative works produced using unclassified NAVFAC information marked in accordance with DoDI 5200.48 to the Contracting Officer, not later than the above referenced date and request instructions on disposition or retention of such derivative works. A “derivative work,” that is, a work that is based on (or derived from) one or more already existing works, in this case unclassified NAVFAC information marked in accordance with DoDI 5200.48.

(xii) Upon request by the Contracting Officer, Offeror/Contractor shall certify in writing or by email that he or she has destroyed the unclassified NAVFAC information within 10 days from such a request.

TERMS

Access – The ability or opportunity to obtain knowledge of controlled unclassified information.

Adequate security – means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

Adversary - Individuals, organizations, or countries that must be denied critical information in order to preserve mission integrity and maintain friendly mission effectiveness and the element of surprise. Adversary, in this context, includes any individual, organization, or country with which specific information should not be shared to preserve mission integrity or the element of surprise.

Covered Contractor Information System – means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.

Controlled Unclassified Information (CUI) - Unclassified information to which access or distribution limitations have been applied according to national laws, policies, and regulations of the United States Government (U.S. Government). It includes U.S. information that is determined to be exempt from public disclosure according to DoDD 5230.25, DoDD 5400.7, and so on, or that is subject to export controls according to the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR). This includes FOR OFFICIAL USE ONLY, Unclassified-NNPI, and PII etc. or other information (as described in the Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list/.html).

Critical Information - Critical information is defined as information important to the successful achievement of U.S. objectives and missions, or which may be of use to an adversary of the United States. Critical information consists of specific facts about friendly capabilities, activities, limitations (includes vulnerabilities), and intentions needed by adversaries for them to plan and act effectively so as to degrade friendly mission accomplishment. Critical information is information that is vital to a mission that if an adversary obtains it, correctly analyzes it, and acts upon it will prevent or seriously degrade mission success. Critical information can be classified information or unclassified information. Critical information can also be an action that provides an indicator of value to an adversary and places a friendly activity or operation at risk.

Critical infrastructure - Systems and assets, whether physical or virtual, so vital that the incapacity or destruction of such may have a debilitating impact on the security, economy, public health, or safety, environment, or any combination of these matters, across any Federal, state, regional, territorial, or local jurisdiction. INCLUDES - Critical Energy Infrastructure Information: specific engineering, vulnerability, or detailed design information about proposed or existing critical energy infrastructure that: (i) relates details about the production, generation, transportation, transmission, or distribution of energy; (ii) Could be useful to a person planning an attack on critical infrastructure; … and (iii) Does not simply give the general location of the critical infrastructure.

Critical utility infrastructure - (e.g., electrical, water, gas, steam, communications, IT, security, industrial Control Systems): a. Inventory of IP-based control systems consisting of network capable digital controllers and user interfaces used to monitor and control equipment (i.e., building control systems, utility control systems, electronic security systems, and fire and life safety systems per DoDI 8500.01 and 8510.01); (b) user/password/media control addresses (MAC Address); and System logs, software and hardware configurations/operating systems (OS). INCLUDES - DoD Critical Infrastructure Security Information or information that, if disclosed, would reveal vulnerabilities in the DoD critical infrastructure and, if exploited, would likely result in the significant disruption, destruction, or damage of or to DoD operations, property, or facilities, including information regarding and safeguarding of explosives, hazardous chemicals, or pipelines, related to critical infrastructure or protected systems owned or operated on behalf of DoD, including vulnerability assessments prepared by or on behalf of the DoD, explosives safety information (including storage and handling), and other site-specific information on or relating to installation security.

Federal Contract Information – means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as that on public Web sites) or simple…