Attachment 0006 - Additional Solicitation and Contract Requirements.docx

Attachment 0006: Additional Solicitation and Contract Requirements Request for Proposal: W15QKN-21-R0041

ADMINISTRATIVE SPACE OCCUPIED BY CONTRACTORS AT PICATINNY ARSENAL

In the event that the Contractor, in performing the requirements in the Statement of Work (SOW) under this contract, will occupy Government owned administrative space on the U.S. Army installation, Picatinny Arsenal, NJ, the Contractor shall provide the following information:

(1) Name of Contractor

(2) Contract number (including the task order number if applicable);

(3) Start date and end date of contract

(4) Name(s) of Contractor personnel occupying administrative space at Picatinny

(5) Building number being occupied

(6) Square footage required

(7) Current use of square footage

(8) Unit Identification Code (UIC) for the contracted employees

The information shall be reported within ten (10) days of award and shall be provided in accordance with the SOW and associated Contract Requirements Data List (CDRL) (DD 1423) and submitted to the following:

Garrison Space Manager:

Army Stationing Identification Program (ASIP) Manager:

Procuring Contracting Officer (PCO): Katherine N. Conklin, ACC-NJ-MC, katherine.n.conklin.CIV@usa.army.mil.

Contracting Officer’s Representative (COR):TBD

(End of Clause)

IMPLEMENTATION OF ENHANCED SECURITY PROTECTIONS FOR CONTRACTOR INFORMATION SYSTEMS – STATEMENT OF WORK LANGUAGE

1. System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews

(a) Within thirty (30) days of contract award, unless otherwise notified by the Government, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the Government at the Contractor's facility. The SSP(s) shall describe how the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 security requirements are implemented as required by Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract, and identify all applicable Commercial and Government Entity Code codes affected. The Contractor shall fully cooperate in the Government's review of the SSPs at the Contractor's facility.

(b) If the Government determines that the SSP(s) does not adequately describe how the NIST SP 800-171 security requirements are implemented, then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a Plan of Action and Milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

(c) Upon conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor's facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

(d) The Government may, in its sole discretion or in response to a cyber incident, conduct subsequent reviews at the Contractor's site to verify the information in the SSP(s). The Government may conduct reviews at any time upon thirty (30) days' notice to the Contractor.

2. Compliance to NIST SP 800-171

(a) The Contractor shall fully implement the Controlled Unclassified Information (CUI) Security Requirements (Requirements) in NIST SP 800-171 in effect at the time the solicitation is issued or as authorized by the Contracting Officer, or establish a SSP(s) and POAMs) that varies from NIST SP 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

(b) Notwithstanding the allowance for such variation, the Contractor shall identify in any SSP and POAM their plans to implement the following, at a minimum:

(1) Implement Requirement 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Requirement 3.1.5 (least privilege) and associated Requirements, and identify practices that the Contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Requirement 3.1.12 (monitoring and control remote access sessions)-Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods;

(4) Audit user privileges on at least an annual basis;

(5) Implement Requirement 3.13.11 (Federal Information Processing Standards (FIPS) 140-2 validated cryptology or implementation of National Security Agency- or NIST-approved algorithms (i.e., FIPS 140-2 Annex A: Advanced Encryption Standard (AES) Or Triple Data Encryption Standard (DES) or compensating controls as documented in a SSP and POAM));

(6) Implement Requirement 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which can be evaluated by the Government Program Manager for risk to the program;

(7) Implement Requirement 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

3. Cyber Incident Response:

(a) The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period in DFARS clause 252.204-7012 ), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact. Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/lnstructions_for_Submitting_Media.docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

(b) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

4. Army Counterintelligence (Cl) Outreach

The Contractor shall engage, whenever practicable, with Army Cl industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting Army programs and technologies; and make Contractor personnel available for threat briefings specific to foreign intelligence threats to Army programs and technologies.

5. Army Cl/Industry Monitoring

(a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Army Cl, which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor, or vendor logs that show network activity, including any additional logs the Contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

(b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor will coordinate with Army Cl to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by the Army Cl, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an Army Cl network device shall be the subject of a separate agreement negotiated between Army Cl and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by Army Cl. Use of this alternative approach shall also be the subject of a separate agreement negotiated between Army Cl and the Contractor.

(c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.

(End of Clause)