Attachment 1 Cyber Security Requirements.pdf

PART C3

SECURITY / CYBER-SECURITY

C3.1 Information Technology and Cyber Security

C3.1.1 Personnel Requirements

The Contractor shall provide skilled, experienced, professional and/or technical personnel consistent with the task requirements of this PWS, with staffing plans in the Contractor’s technical proposal. Contractor personnel supporting cybersecurity functions shall be appropriately certified according to DoD Manual (DoDM) 8140.03 Cyberspace Workforce Qualification & Management Program upon contract and/or MOD awards.

The Contractor is responsible to provide qualified personnel, as specified, and as required by the PWS, and shall bear all cost for training of its personnel. The Government will not reimburse the Contractor for the cost for training of Contractor personnel. Training will not be allowed on Government time.

The Contractor shall provide a monthly DoD 8140.03 deliverable report as specified by the COR/COTR, that includes a list of applicable key personnel. The following information shall be provided in the report, due by the 5th business day of each month:

Work Role Work Role Task Company Contract Name/Description COR Name Contract # Primary Foundational Qualification Personnel Certification Held and Expiration Date Primary Foundational Qualification Personnel Certification Status (Current or Past Due)

If a certification becomes obsolete during the life of the contract, the Contractor shall be responsible for ensuring applicable personnel obtain an acceptable replacement certification prior to the IT/OT product’s end of support or end of life.

The provisions of this PWS shall be fully applicable to all subcontractors.

Information given to the Contractor during the life of this contract shall only be used for the purpose of carrying out the provisions of this contract. Agency marked “Controlled Unclassified (CUI)” or bearing other sensitivity markings shall be handled in accordance with (IAW) Agency information security program regulations and shall not be divulged or disclosed without Agency permission in writing. Requests for disclosure shall be addressed to the Contracting Officer (KO).

1. Personnel Security Requirements

Most work to be performed under this requirement is unclassified, however, a security clearance maybe required. All Contractor personnel proposed to work on the network, or any IT capabilities/functions (at a minimum) will be required to have an IT-II, a clearance requiring a National Agency Check with Law and Credit (NACLC) or NACLC equivalent, or an IT-I, a clearance requiring a Single Scope Background Investigation, prior to the work commencing.

2. Citizenship Each Contractor employee shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence, or who presents evidence from the Immigration and Naturalization Service that employment will not affect his immigration status.

3. Identification Badges Contractor employees (including those of subcontracts) requiring physical access to the contractual place of performance and/or access to the DLA network/system for successful contract performance will be required to obtain a Common Access Card (CAC) prior to starting work. Lost or stolen CACs must be promptly reported by the Contractor to the KO or their authorized representative and to the appropriate Government security personnel. The Government will retain sole decisional authority on issuance of a replacement CAC.

4. Privileged Access The DoD 8140, Information Assurance Workforce Improvement Programs requires training and certification for - Cybersecurity duties performed. All contract employees performing cyber-IA functions shall meet the requirements in accordance with DoD/DLA guidance.

Additionally, all contract employees shall be certified in operating systems on any system on which system administration duties are performed. Proof of certification shall be provided before privileged access is granted, at time of proposal/resume submission; this includes, but is not limited to, system administration access, network administration access, router/switch access, or firewall access. All documentation required for security certification will be maintained by both the Contractor and the Government.

All contract employees shall have acquired the necessary certifications, per the DoD 8140, and remain in good standing for the duration of the contract. These certification requirements are not based on position title; they are based on duties. All Contractor personnel requiring elevated/privileged access to any network or OT system, subsystem, or components, either during provisioning or post award, shall satisfy any necessary and/or applicable requirements to meet DLA account provisioning, system administration, and personnel certification standards.

The Contractor shall provide a copy of all current certifications to the Contracting Officer at time of award and remain in good standing during the contract period of performance. The Contractor shall provide the monthly DoD 8140 deliverable report to the COR/COTR that includes a list of applicable DoD 8140 key personnel. If a certification becomes obsolete during the life of the contract, the Contractor shall be responsible for ensuring applicable personnel obtain an acceptable replacement certification. The Contractor is responsible for all PWS requirements and shall provide skilled, experienced, professional, or technical personnel consistent with the task-specific requirements.

DoD 8140 baseline certifications can be found here:

DoDM 8140.03 (Manual) Cyberspace Workforce Qualification and Management Program

Cybersecurity Strength Requirements

The Contractor shall adhere to all existing authorities and policies of the Director of National Intelligence regarding the protection of sensitive compartmented information (SCI), as directed by Executive Order 12333 and other laws and regulations.

The Contractor shall satisfy the Risk Management Framework (RMF) requirements of subchapter III of chapter 35 of Title 44, United States Code (U.S.C.), also known as the “Federal Information Security Management Act (FISMA) of 2002”.

The Contractor shall enable DLA to meet the standards required by the Office of Management and Budget (OMB) and the Secretary of Commerce, pursuant to FISMA and section 11331 of Title 40, U.S.C.

FIPS 199 / CNSSI 1253 Security Categorization: The Contractor shall participate in categorization discussions with the DLA J6 PM, functional lead, and the Information System Security Manager (ISSM) and provide all required FIPS 199 documentation as requested to support security categorization.

The Contractor shall provide a recommendation on system categorization based on sound technical expertise in accordance with FIPS 199 then work in coordination with the prescribed DLA System Owner (SO) and ISSM to support the categorization IAW FIPS 199, CNSSI 1253 and OSD Facility Related Control Systems (FRCS) Master List including DLA specific systems, then document the results of the security categorization in the System DLA FIPS 199 document and the Concept of Operations (CONOPs).

Assigned DLA PM will coordinate with the Contractor to identify and document Confidentiality, Availability, Integrity (CIA) of the system in a DLA FIPS 199 document for approval by DLA ISSM personnel.

Cybersecurity Assurance Requirements The Contractor shall design, develop, and integrate cybersecurity solutions supporting the Department of Defense and all other applicable Government agencies.

This will be achieved through abiding by all applicable cybersecurity policies, regulations, and directives to ensure a favorable Assessment and Authorization (A&A), Assessment and Incorporate (A&I), or FRCS Assess Only Risk Assessment (FRCS AORA) decision, as well as obtaining an Authority to Connect (ATC) to DLA’s network. The Contractor shall mitigate risk identified through the RMF authorization process down to a level acceptable to the DLA Authorizing Official (AO).

Coding for Security. The Contractor shall provide documentation of development practices and standards applied to Government approved Contractor-written control system software, including firmware, used to ensure a high level of defense against unauthorized access.

The solution shall comply with the security control requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53r5, “Security and Privacy Controls for Federal Information Systems and Organizations” and NIST 800-82r3, “Guide to Industrial Control Systems (ICS) Security”. The Contractor shall provide details of any alternative but equally effective security measures used to compensate for the inability to satisfy a particular derived security requirement (mitigation to control compliance https://dl.dod.cyber.mil/wp-content/uploads/cyber-workforce/pdf/unclass-dod-manual-8140_03.pdf findings). This information shall be submitted in writing to the DLA J6 PM for cybersecurity approval as soon as the alternative is identified.

Typical Contractor services activities include:

Analyzing DLA physical, electrical, computerized, and mechanical environments the identified FRCS solution will control (e.g., the physical Operational process to be controlled, such as those used in manufacturing, metering and robotics)

Developing a DLA Automation Solution FRCS architecture in terms of devices, dataflow, and control loops, outlining interconnectivity with engineering and operator workstations, and Safety Instrumented Systems (SISs) for testing; testing shall be in accordance with DoD Control Systems Security Requirements Guide (SRG), and other identified DLA test processes.

Defining how the DLA FRCS Automation Solution will connect to external (e.g., plant) and networks, by system description, concept, and dataflow diagram on Perdue Levels. Guidance on the applicability of Purdue Enterprise Reference Architecture (PERA) levels are found in the United Facilities Criteria (UFC) 4-010-06, Cybersecurity of Facilities-Related Control Systems.

Installing, configuring, patching, backing up, and testing for DLA handover of the Automation Solution to the DLA asset owner for operation.

Gaining approval of the DLA asset owner for many of the decisions made and outputs generated during the execution of these activities.

The Contractor shall protect unclassified DoD data from unauthorized access or disclosure in accordance with DoDI 8582.01, “Security of Unclassified Information on Non-DoD Information Systems.” Controlled Unclassified Information: All Government controlled unclassified information obtained by the Contractor shall be protected in accordance with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations”.

Agencies or Military Services providing external information system services must comply with DLA information security requirements and employ overlayed security controls in accordance with applicable federal laws, Executive Orders, directives, instructions, policies, regulations, standards, and guidance.

Tasks and Deliverables

• The Contractor shall provide required implementation and design documentation to the DLA PM and security engineering teams to conduct a cybersecurity risk assessment (RA) of proposal. Results from accepted RAs will be incorporated into the Systems concepts of operations (CONOPs).

• The Contractor, in collaboration with assigned COR and COTR shall identify and document applicable cybersecurity enterprise architectures and deliver system conceptual design drawings.

• The Contractor shall leverage, to the greatest extent possible, DLA Enterprise processes and capabilities.

System and Network Requirements

• All system/network components and applications shall be compatible with all applicable Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs). Any STIG exceptions must be identified as part of the Contractor’s proposal to the Government and approved by J6 Cybersecurity.

Exceptions incurring risk found unacceptable to the DLA Authorizing Official are not permitted.

• All network components and applications shall be IPv4 and IPv6 compatible.

• Network components shall allow configuration of IEEE 802.1x or port security for authentication.

• The Contractor shall provide a complete list of all ports, protocols and services required for any computer system running control system applications or required to interface the control system applications. The listing shall include all ports and services required for normal operation as well as any other ports and services required for emergency operation. The listing shall also include an explanation or cross reference to justify why each service is necessary for operation.

• The Contractor shall identify any system wireless communication capability, enabled, or disabled. All wireless communications shall meet applicable STIG requirements to include FIPS 140-2 certification. Any requirement to use wireless or cellular must be approved in writing by DLA J6, coordinated with the J62B PM and documented with the DLA Frequency Manager.

Information and Operational Technology Infrastructure Requirements

In general, the DLA expects to furnish the IT Infrastructure to host the OT solution(s) and/or system(s) (including VLANs, and Virtual Machines (VMs)) unless there is a hardware, compatibility, or mission issue preventing it. As such, the Contractor must clearly identify “what” anticipated Government IT Infrastructure is required to host and operate the OT solution(s) and/or system(s) within the design documentation submitted for Government approval at time of award. These anticipated designs will be incorporated into the system CONOPs. The Contractor will be responsible for all installation, configuration, and deployment of the OT solution(s) and/or system(s) (including but not limited to) its subsystem(s), application(s), and patch cabling, if required.

Any requirement for the Contractor to provide their own IT Infrastructure, standalone server, or management workstation hardware due to compatibility issues must be documented in the Contractor’s proposal and approved by J6 prior to contract award, if applicable. All Contractor provided IT Infrastructure must meet DoD STIG requirements. If the Contractor provides their own IT Infrastructure for the OT solution(s) and/or system(s), upon AO approval of the security authorization package (and prior to final OT solution(s) and/or system(s) acceptance or go-live), all Contractor provided IT Infrastructure will become the property of the Government.

All specialized software provided by the Contractor to the Government must have the applicable license key(s) as well as sales/transaction records, ownership control(s), manuals, technical publications, documentation, and any other information supporting ownership accompanying it. At the time of Contractor hand-off of Contractor owned IT Infrastructure to the Government, all design information for Enterprise Architecture (EA) for the “as built” OT solution(s) and/or system(s) will be provided. Any Contractor provided operating system (OS), software, and firmware throughout the duration of the contract will be upgraded by the Contractor prior to the Contractor’s end of mainstream support for the OS, software, or firmware.

The Contractor will be responsible for the implementation including meeting all required STIG compliance.

The Contractor shall be responsible for all configuration and deployment which meet DoD, NIST and USG regulatory and cybersecurity policy requirements.

Any OT solution(s) and/or system(s) with IT Infrastructure provided by the Contractor must be upgradeable and remain compliant to cybersecurity specifications during the lifecycle of the solution. Contractor supplied systems must meet DoD STIG requirements, with any exceptions noted in the design documentation.

The Contractor is responsible for all software maintenance activities for any/all appliances including but not limited to, firmware updates, OS patching, software patches etc. for the duration of the contract period.

The Contractor will be responsible for all physical maintenance activities for any/all appliances including but not limited to, replacement of defective components such as hard drives (to be destroyed onsite per DoD policy, guidance), motherboards, daughterboards etc. for the duration of the contract period.

Activities are typically short and frequently recurring, and may include one of more of the following:

a. Patching and anti-virus updates

b. Equipment upgrades and maintenance, including small engineering adjustments not directly related to control algorithms

c. Component and system migration

d. Change management

e. Contingency plan management System(s) shall operate using a Contractor fully supported operating system (OS), software, and firmware throughout the duration of the contract. All operating systems, software, and firmware shall be upgraded prior to the Contractor’s end of mainstream support for the operating system, software, or firmware. The solution must be upgradeable and remain compliant to DoD cybersecurity specifications during the lifecycle of the solution.

Any removable flash media required for system operation must be reviewed and approved in writing by the DLA J6 Flash Media Approval Program prior to implementation.

All FRCS OT solution(s) and/or system(s) must use the PERA Model for Control Hierarchy (reference ISBN 1-55617-265-6) to provide logical and/or physical architecture for networking, security hardware, software, and methods. The PERA Model is an industry standard for manufacturing and/or industrial control systems that segments hardware, devices, and equipment into a hierarchical based design.

Deliverables The table below provides a summary of the deliverables required of the Contractor based on identified cybersecurity requirements for Assess and Authorize (A&A), Assess and

Incorporate (A&I), and Facility Related Control System Lean Cybersecurity Risk Assessment

(FRCS LCRA).

# Deliverable Name Reference (these sections w/be adjusted based on PWS/SOW) Submission Due

8140 Report

3.0

Monthly (NLT 5th business day of each month) RMF Documentation:

System Diagrams (Architecture, Authorization Boundary, Data Flow and Purdue)

5.0

Draft- One (1) month after contract award

Final - six (6) months after contract award

Comprehensive Hardware/

Software List (DLA provided template)

5.0

Draft- One (1) month after contract award

Final - six (6) months after contract award

4 System CONOPs 5.0 Six (6) months after contract award

Ports, Protocols and

Services Management

(PPSM)

5.0 Four (4) months after

contract award

6 FIPS 199 Categorization 5.0 One (1) month after contract award

Cybersecurity Scan Results

(ACAS, SCAP,

WebInspect)

5.0

Draft - One (1) month after contract award

Final - six (6) months after contract award

Security Technical Implementation Guides (STIGs) and Security Requirement Guides (SRGs) Checklists

5.0 Six (6) months after

contract award

Documentation supporting RMF security control implementation (as outlined in DLA RMF

SOP)

(*When required)

5.0 Six (6) months after

contract award

10 Control assessment procedure test results 5.0 Six (6) months after contract award

11 Plan of Actions and Milestones (POA&Ms) 5.0 Six (6) months after contract award

PII Confidentiality Impact Level (PCIL)

Categorization Worksheet Privacy Impact

Assessment

5.0 One (1) month after contract

award

System Administrator

Installation/ Configuration Documentation

6.2 Four (4) months after

contract award

Application Software release/patch Documentation

6.2 Four (4) months after

contract award

Example for 8140 Work Role: Personnel Certification are required for Operational Technology

Reference: DoD Cyber Workforce Qualifications Matrices Management – DoD Cyber Exchange https://cyber.mil/wid/cwmp/qualifications-matrices/ https://cyber.mil/wid/cwmp/qualifications-matrices/

C3.1.5.4 Reference Documents

The Contractor shall provide cybersecurity (CS) in accordance with all current policies, procedures, and statutes, to include (but not restricted to) the following, as applicable, to specific task orders (most current version):

System Identification Reference Documents:

a. Committee on National Security Systems Instruction 1253, Security Categorization and Control Selection for National Security Systems, July 29, 2022

b. Federal Information Processing Standards Publication 199, Standards for Security Categorization of Federal Information and Information Systems, February 2004

c. Federal Information Processing Standards Publication 200, Minimum Security Requirements for Federal Information and Information Systems, March 2006

d. Federal Information Security Management Act (P.L. 107-347, Title III), December

e. Department of Defense Instruction 5000.02, Operation of the Defense Acquisition System, January 23, 2020

f. Department of Defense Instruction 5200.39, Critical Program Information (CPI) Identification and Protection within the Research, Development, Test, and Evaluation (RDT&E) Incorporating Change 3, Effective October 1, 2020

System Compliance, Instructions and Guidelines Reference Documents:

a. 44 U.S.C. § 3542, January 2012

b. Department of Defense Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology, July 19, 2022

c. Department of Defense Instruction 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems & Networks, Incorporating Change 3, October 15, 2018

d. DoD Program Manager’s Guidebook for Integrating the Cybersecurity Risk Management Framework (RMF) into the System Acquisition Lifecycle

e. Defense Acquisition Guidebook (DAG)

f. Department of Defense Directive 8140.01, Cyberspace Workforce Management, October 5, 2020

g. Department of Defense Instruction 8330.01, Interoperability of Information Technology (IT), Including National Security Systems (NSS), September 27, 2022

System Cybersecurity Implementation Reference Documents:

a. Department of Defense Instruction 8580.1, Information Assurance (IA) in the Defense Acquisition System, July 9, 2004

b. National Institute of Standards and Technology Special Publication 800-82 Revision 3, Guide to Industrial Control Systems (ICS) Security, February 2015

c. UFGS-25 50 00.00 20 Cybersecurity of Facility-Related Control Systems

d. United Facilities Criteria (UFC) 4-010-06, Cybersecurity of Facilities-Related Control Systems

Personnel Requirements Reference Documents:

a. DoD Manual (DoDM) 8140.03 Cyberspace Workforce Qualification & Management Program, dated 15 Feb 2023

FRCS Guidelines Reference Documents:

a. Deputy Under Secretary of Defense (Installations and Environment) Memo dated 19 Mar 14, subject: Real Property Related ICS Cybersecurity

b. Defense Logistics Agency Risk Management Framework Standard Operating Procedures, April 2021

c. Office of the Assistant Secretary of Defense Facility Related Control Systems (FRCS) Master List Memo, October 2020

d. Department of Defense Control Systems Security Requirements Guide Version 1, Release 1, July 14, 2021

C3.2 Installation Security

A. The Contractor and its personnel shall comply with all DoD and DLA regulatory guidance, including but not limited to:

• DLAI 5200.01, Information Security Program

• DLAI 5205.02, Operations Security (OPSEC) Program

• DoDM 5200.01, Information Security Program

• DoDI 5200.02, DoD Personnel Security Program

• DoDM 5200.02, Procedures for the DoD Personnel Security Program

• DoD 5200.8-R, Physical Security Program

• DoD 5205.02-M, DoD Operations Security (OPSEC) Program Manual

• DoD 5220.22-M, National Industrial Security Program Operating Manual

(NISPOM)

• DoD 5220.22-R, Industrial Security Regulation

• DoD 2000.12, DoD Antiterrorism Program

• DoDI O-2000.16, V. 1-2) DoD Antiterrorism (AT) Program Implementation

• DoD O-2000.12-H, DoD Antiterrorism Handbook

• DoD 5220.22-S, COMSEC Supplemental to Industrial Security Manual for Safeguarding Classified Information

• DoDI 5240.6, Counterintelligence (CI) Awareness and Briefing Program

• DoD 5100.76-M, Physical Security of Sensitive Conventional Arms, Ammunition and Explosives (AA&E)

• DLAM 5200.08 (V. 1-2) DLA Physical Security Manual

• DLA Crime and Loss Prevention SOP

B. The Contractor or any visitors of the Contractor entering DoD locations to perform contract requirements shall abide by all security regulations and may be subject to security inspections. Contractor personnel and property shall be subject to search and seizure upon entering, while on, and upon leaving the DoD locations pursuant to regulatory guidance.

C. All Contractor personnel shall always conduct themselves IAW acceptable business decorum. The Contractor shall remove any individual from the site whose continued presence or employment on this contract is deemed by the KO or designee to be contrary to the public interest, adversely affect health, morale, welfare, or good order and discipline on the installation, or is inconsistent with the best interests of national security. IAW USC Title 18, Crimes and Criminal Procedure, Part I, Crimes, Chapter 67, Military and Navy, Section 1382, the Installation Commander has the authority to bar individuals from the host installation.

D. In the event of a strike by Contractor personnel, the Contractor shall be responsible for the cost of any increased security as determined necessary by the Installation or DLA Site Commander/Director.

E. The Contractor shall report immediately to the KO or designee any suspected, alleged, or actual criminal incidents IAW DLAI 5105 Reporting of Criminal Incidents.

F. The Contractor shall register all Contractor vehicles used in performance of the contract requirements and ensure that Contractor employee vehicles to be driven on the host installation, to include motorcycles, are registered with the host installation security office and are in conformance with State and local regulations in effect at the time of registration and as long as employed by the Contractor. Evidence of a valid driver’s license, vehicle registration card, and insurance are required for registration. Contractor employees shall maintain current registration and proof of insurance on all Privately-Owned Vehicles (POV) brought on host installation. The Contractor shall maintain current registration and proof of insurance on all Contractor-owned vehicles brought on the host installation.

G. The Contractor and its employees shall abide by host installation parking regulations. All vehicles shall be parked in designated parking areas only. The Contractor and its employees shall conform to Federal, State and host installation driving regulations.

C3.3 Physical Security

A. The Contractor shall control access by locking or unlocking the areas or facilities used by the Contractor in the performance of the contract requirements. The Contractor shall lock all overhead doors, cages, vaults, warehouse doors, windows, and other areas for reasons of internal security before leaving an area unattended and prior to the conclusion of any working day.

B. The Contractor shall operate under the site’s approved security plan.

C. In the event a Contractor area is found unsecured or there is an alarm response during non-duty hours, the Contractor’s designated Point of Contact (POC) will be required to secure the area. The Contractor shall inform the KO or designee of the results of the alarm response. The Contractor shall report any facility security violations to the KO or designee within one (1) hour of discovery.

D. Upon request of the KO or designee, the Contractor shall prepare and provide reports to update progress on all recommended corrective actions stemming from Government inspections or assessments conducted at the site (i.e., Security Program Review (SPR), OPSEC/INFOSEC inspections, Vulnerability Assessments (VA), DoD and DLA regulations or policies etc.)

E. The Contractor’s Security Specialist shall participate in working groups (i.e., Physical Security Anti-terrorism, Force Protection and OPSEC), if requested.

C3.4 Identification of Contractor Employees

A. The Homeland Security Presidential Directive 12 (HSPD-12) dated 27 September 2012 has established criteria for Contractors who require a Common Access Card (CAC) for either physical access to an installation or access to government information technology (IT) systems. The Government requires Personnel Security Investigations (PSI) to establish that applicants or incumbents either employed by the Government or working for the Government under contract are suitable for the job and are eligible for a public trust or sensitive position. Upon favorable review and initiation of the PSI, Contractor personnel may be granted temporary access pending final adjudication of the PSI.

B. A Contractor Investigative Request (CIR) form annotating the appropriate designation shall be submitted for each contract employee.

C3.5 Information Security

Upon favorable review and initiation of the PSI to establish the suitability of an employee for the job and the approval for temporary IT access pending final adjudication but not less than fourteen (14) working days prior to the employee’s start date, the Contractor shall request Information Technology (IT) eligibility for an employee requiring access and passwords to the government data systems. The employee may start prior to the fourteen working day timeline at the Contractor’s discretion provided all other Personnel Clearance requirements (1.4.4 A) are met and there is adequate contractor workload which does not require IT access. All Contractor employees who perform data entry and query functions shall require IT Level III category eligibility (the minimum access level that includes no sensitive or classified information).

Contractor access to Government IT data systems shall be granted on a “need-to-know” basis, IAW DLAI 6401 IA Management Controls and IA Technical Controls to Contractor personnel who will perform data input and retrieval functions and for “clearance special access,” if applicable IAW DoD 5200.2-R, Personnel Security Program. All Contractor personnel provided with access to government computers and systems shall observe IT security policies and procedures as provided by the KO or designee. The Contractor shall notify the KO or designee within 12 hours when, for reasons of personnel resignation, reassignment, termination, or completion of portions of the contract, Contractor personnel no longer require access to government systems.

The Contractor shall observe all copyright agreements. In the interest of protecting government systems from computer viruses, the Contractor shall not use public domain software nor shall Contractor personnel download software from public bulletin boards or Internet websites. Should the introduction of a computer virus or malicious destruction of computer software, stored information, or hardware result from the use of public domain software or from software taken from a public bulletin board or Internet website, the Contractor shall be required to repair the damage and incur all costs at no expense to the Government and without impact on delivery schedules.

C3.6 Privacy Act Information

Contractor shall comply with requirements of DoD Directive (DODD) 5400.11 regarding control of privacy act information. Specifically, the Contractor shall ensure that any personally identifiable information (such as but not limited to individual names and associated personal contact information or social security numbers) is restricted to access required for execution of this contract and is not disclosed or stored on any unsecure systems.

C3.7 Sensitive Information

Work on this IDIQ will require Contractor personnel to have access to sensitive, privileged, or Privacy Act information. Personnel shall adhere to the Privacy Act, (5 U.S.C. § 552a) and applicable Agency rules and regulations. Contractor personnel shall not divulge, or release privacy data or information developed or obtained in the performance of this contract award, until made public or specifically authorized by the Government. The Contractor shall not use, disclose, or reproduce a third-party company’s proprietary data, other than as authorized and required in the performance of this IDIQ award. The Contractor shall notify the COR within 24 hours, identifying personnel that no longer require access to Government Information Systems

(IS).