Attachment 0007 SOW FOR OPSEC CYBER SECURITY 06-23-2022.pdf

STATEMENT OF WORK – M772/M776 MTSQ Fuze

A. OPERATIONS SECURITY (OPSEC):

The contractor shall have an identified certified Level II OPSEC coordinator per AR 530-1. The contractor shall develop an OPSEC Standard Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected.

Per AR 530-1 Operations Security, the contractor employees must complete Level I OPSEC Awareness training.

New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter. Level I OPSEC training is available at the following website: http://cdse.edu/catalog/elearning/GS130.html (Duration: 45 minutes).

B. CYBER SECURITY:

The Contractor shall use the following to supplement Defense Federal Acquisition Regulation Supplement (DFARS) Clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting.

1. System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews:

a. Within thirty (30) days of contract award, unless otherwise notified by the Government, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the Government at the Contractor's facility. The SSP(s) shall describe how the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 security requirements are implemented as required by Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract, and identify all applicable Commercial and Government Entity Code codes affected.

The Contractor shall fully cooperate in the Government's review of the SSPs at the Contractor's facility.

b. If the Government determines that the SSP(s) does not adequately describe how the NIST SP 800-171 security requirements are implemented, then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a Plan of Action and Milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

c. Upon conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor's facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

d. The Government may, in its sole discretion or in response to a cyber incident, conduct subsequent reviews at the Contractor's site to verify the information in the SSP(s). The Government may conduct reviews at any time upon thirty (30) days' notice to the Contractor.

2. Compliance to NIST SP 800-171:

a. The Contractor shall fully implement the Controlled Unclassified Information (CUI) Security Requirements (Requirements) in NIST SP 800-171 in effect at the time the solicitation is issued or as authorized by the Contracting Officer, or establish a SSP(s) and POAMs) that varies from NIST SP 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

b. Notwithstanding the allowance for such variation, the Contractor shall identify in any SSP and POAM their plans to implement the following, at a minimum:

Attachment 0007

(1) Implement Requirement 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication.

For legacy systems and systems that cannot support this requirement, a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Requirement 3.1.5 (least privilege) and associated Requirements, and identify practices that the Contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Requirement 3.1.12 (monitoring and control remote access sessions)-Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods;

(4) Audit user privileges on at least an annual basis;

(5) Implement Requirement 3.13.11 (Federal Information Processing Standards (FIPS) 140-2 validated cryptology or implementation of National Security Agency- or NIST-approved algorithms (i.e ., FIPS 140-2 Annex A: Advanced Encryption Standard (AES) Or Triple Data Encryption Standard (DES) or compensating controls as documented in a SSP and POAM));

(6) Implement Requirement 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which can be evaluated by the Government Program Manager for risk to the program;

(7) Implement Requirement 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

3. Cyber Incident Response:

a. The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period in DFARS clause 252.204-7012), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact. Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/lnstructions_for_Submitting_Media.docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

b. If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

4. Army Counterintelligence (CI) Outreach: The Contractor shall engage, whenever practicable, with Army Cl industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting Army programs and technologies; and make Contractor personnel available for threat briefings specific to foreign intelligence threats to Army programs and technologies.

5. Army Cl/Industry Monitoring:

a. In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Army Cl, which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor, or vendor logs that show network activity, including any additional logs the Contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

b. If the Government determines that the collection of all logs does not adequately protect its interests, the

Contractor will coordinate with Army Cl to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by the Army Cl, on the

Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an Army Cl network device shall be the subject of a separate agreement negotiated between Army Cl and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by Army Cl. Use of this alternative approach shall also be the subject of a separate agreement negotiated between Army Cl and the Contractor.

c. In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.

C. CONTROLLED UNCLASSIFIED INFORMATION (CUI):

a. CUI is unclassified information that requires safeguarding or dissemination controls, pursuant to and consistent with applicable law, regulations, and/or Government-wide policies.

b. Contractor employees that will require access to CUI will follow all DoD (DoDI 5200.48) and Army policies regarding access to CUI, and the handling, storage, transmission, and destruction of CUI. Contractor employees are required to complete initial CUI training (available at https://securityawareness.usalearning.gov/cui/index.html) within 30 days of start of performance on the contract, and then annually thereafter. All CUI must be transmitted via encrypted channels, such as the DoD Safe Access File Exchange (SAFE) website (https://safe.apps.mil/).

D. ANTITERRORISM:

DFARS Clause 252.225-7043, Antiterrorism/Force Protection for Defense Contractors Outside the US. The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non-contingency support. The key AT requirement is for non-local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor’s compliance with combatant commander and subordinate task force commander policies and directives.

https://safe.apps.mil/