Attachment 1_Cybersecurity Information-25APR2024.pdf

CYBER-SECURITY REQUIREMENTS

C3.1 Information Technology and Cyber Security

The Contractor shall provide cybersecurity (CS) in accordance with all current policies, procedures, and statutes, to include (but not restricted to) the following, as applicable, to specific task orders (most current version):

C3.1.1 System Identification Reference Documents:

a. Committee on National Security Systems Instruction 1253, Security Categorization and

Control Selection for National Security Systems, July 29, 2022

b. Federal Information Processing Standards Publication 199, Standards for Security

Categorization of Federal Information and Information Systems, February 2004

c. Federal Information Processing Standards Publication 200, Minimum Security

Requirements for Federal Information and Information Systems, March 2006

d. Federal Information Security Management Act (P.L. 107-347, Title III), December 2002

e. Department of Defense Instruction 5000.02, Operation of the Defense Acquisition System, January 23, 2020

f. Department of Defense Instruction 5200.39, Critical Program Information (CPI)

Identification and Protection within the Research, Development, Test, and Evaluation (RDT&E) Incorporating Change 3, Effective October 1, 2020

C3.1.2 System Compliance, Instructions and Guidelines Reference Documents:

a. 44 U.S.C. § 3542, January 2012

b. Department of Defense Instruction 8510.01, Risk Management Framework (RMF) for

DoD Information Technology, July 19, 2022

c. Department of Defense Instruction 5200.44, Protection of Mission Critical Functions to

Achieve Trusted Systems & Networks, Incorporating Change 3, October 15, 2018

d. DoD Program Manager’s Guidebook for Integrating the Cybersecurity Risk Management

Framework (RMF) into the System Acquisition Lifecycle

e. Defense Acquisition Guidebook (DAG)

f. Department of Defense Directive 8140.01, Cyberspace Workforce Management, October

5, 2020

g. Department of Defense Instruction 8330.01, Interoperability of Information Technology

(IT), Including National Security Systems (NSS), September 27, 2022

C3.1.3 System Cybersecurity Implementation Reference Documents:

a. Department of Defense Instruction 8580.1, Information Assurance (IA) in the Defense Acquisition System, July 9, 2004

b. National Institute of Standards and Technology Special Publication 800-82 Revision 3, Guide to Industrial Control Systems (ICS) Security, February 2015

c. UFGS-25 50 00.00 20 Cybersecurity of Facility-Related Control Systems

d. United Facilities Criteria (UFC) 4-010-06, Cybersecurity of Facilities-Related Control Systems

C3.1.4 Personnel Requirements Reference Documents:

a. DoD Manual (DoDM) 8140.03 Cyberspace Workforce Qualification & Management

Program, dated 15 Feb 2023

C3.1.5 FRCS Guidelines Reference Documents:

a. Deputy Under Secretary of Defense (Installations and Environment) Memo dated 19 Mar 14, subject: Real Property Related ICS Cybersecurity

b. Defense Logistics Agency Risk Management Framework Standard Operating Procedures, April 2021

c. Office of the Assistant Secretary of Defense Facility Related Control Systems (FRCS) Master List Memo, October 2020

d. Department of Defense Control Systems Security Requirements Guide Version 1, Release 1, July 14, 2021

C3.2 Personnel Requirements

The Contractor shall provide skilled, experienced, professional and/or technical personnel consistent with the task requirements of this PWS, with staffing plans in the Contractor’s technical proposal. Contractors supporting cybersecurity functions shall be appropriately certified according to DoD Manual (DoDM) 8140.03 Cyberspace Workforce Qualification & Management Program upon contract and/or MOD awards.

The Contractor is responsible for providing qualified personnel, as specified, and as required by the PWS, and shall bear all cost for training its personnel. The Government will not reimburse the Contractor for the costs of training Contracted personnel. Training will not be allowed on Government time.

The Contractor shall provide a monthly DoD 8140.03 deliverable report as specified by the COR/COTR, that includes a list of applicable key personnel. The following information shall be provided in the report, due by the 5th business day of each month:

Work Role Work Role Task Company Contract Name/Description COR Name Contract # Primary Foundational Qualification Personnel Certification Held and Expiration Date

Primary Foundational Qualification Personnel Certification Status (Current or Past Due)

If a certification becomes obsolete during the life of the contract, the Contractor shall be responsible for ensuring applicable personnel obtain an acceptable replacement certification prior to the IT/OT product’s end of support or end of life.

The provisions of this PWS shall be fully applicable to all subcontractors.

Information given to the Contractor during the life of this contract shall only be used for the purpose of carrying out the provisions of this contract. Agency marked “Controlled Unclassified (CUI)” or bearing other sensitivity markings shall be handled in accordance with (IAW) Agency information security program regulations and shall not be divulged or disclosed without Agency permission in writing. Requests for disclosure shall be addressed to the Contracting Officer (KO).

C3.2.1 Personnel Security Requirements

Most work to be performed under this requirement is unclassified, however, a security clearance maybe required. All Contractor personnel proposed to work on the network, or any IT capabilities/functions (at a minimum) will be required to have an IT-II, a clearance requiring a National Agency Check with Law and Credit (NACLC) or NACLC equivalent, or an IT-I, a clearance requiring a Single Scope Background Investigation, prior to the work commencing.

C3.2.2 Citizenship

Each Contractor employee shall be a citizen of the United States of America, or an alien who has been lawfully admitted for permanent residence, or who presents evidence from the Immigration and Naturalization Service that employment will not affect his immigration status.

C3.2.3 Identification Badges

Contractors requiring physical access to places of performance and/or access to the DLA network/system will be required to obtain a Common Access Card (CAC) prior to starting work. Contractors must report lost or stolen CACs to the KO or authorized representative, and to the appropriate Government security personnel. The Government will retain sole decisional authority on issuance of a replacement CAC.

C3.2.4 Privileged Access

The DoD 8140, Information Assurance Workforce Improvement Programs requires training and certification for performing cybersecurity duties. All contracted employees performing cyber and Information Assurance functions shall meet the requirements in accordance with DoD/DLA guidance.

Earl, Robert D CIV DLA INFO OPERATIONS (USA) Recommend simplifying and just using Cybersecurity and removing Information Assurance.�

Additionally, all contracted employees shall be certified in operating systems on any system on which system administration duties are performed. Proof of certification shall be provided before privileged access is granted, at time of proposal/resume submission; this includes, but is not limited to, system administration access, network administration access, router/switch access, or firewall access. All documentation required for security certification will be maintained by both the Contractor and the Government.

All contract employees shall have acquired the necessary certifications, per the DoD 8140, and remain in good standing for the duration of the contract. These certification requirements are based on duties, not based on position title. All Contractors requiring elevated/privileged access to any network or OT system, subsystem, or components, either during provisioning or post award, shall satisfy any necessary and/or applicable requirements to meet DLA account provisioning, system administration, and personnel certification standards.

The Contractor shall provide a copy of all current certifications to the Contracting Officer at time of award and remain in good standing during the contract period of performance. The Contractor shall provide the monthly DoD 8140 deliverable report to the COR/COTR that includes a list of applicable DoD 8140 key personnel. If a certification becomes obsolete during the life of the contract, the Contractor shall be responsible for ensuring applicable personnel obtain an acceptable replacement certification. The Contractor is responsible for all PWS requirements and shall provide skilled, experienced, professional, or technical personnel consistent with the task-specific requirements.

DoD 8140 baseline certifications can be found here:

DoDM 8140.03 (Manual) Cyberspace Workforce Qualification and Management Program

C3.3 Cybersecurity Strength Requirements

The Contractor shall adhere to all existing authorities and policies of the Director of National Intelligence regarding the protection of sensitive compartmented information (SCI), as directed by Executive Order 12333 and other laws and regulations.

The Contractor shall satisfy the Risk Management Framework (RMF) requirements of subchapter III of chapter 35 of Title 44, United States Code (U.S.C.), also known as the “Federal Information Security Management Act (FISMA) of 2002”.

The Contractor shall enable DLA to meet the standards required by the Office of Management and Budget (OMB) and the Secretary of Commerce, pursuant to FISMA and section 11331 of Title 40, U.S.C.

FIPS 199/CNSSI 1253 Security Categorization: The Contractor shall participate in categorization discussions with the DLA J6 PM, functional lead, and the Information System Security Manager (ISSM) and provide all required FIPS 199 documentation as requested to support security categorization.

https://dl.dod.cyber.mil/wp-content/uploads/cyber-workforce/pdf/unclass-dod-manual-8140_03.pdf

The Contractor shall provide a recommendation on system categorization based on sound technical expertise in accordance with FIPS 199 then work in coordination with the prescribed DLA System Owner (SO) and ISSM to support the categorization IAW FIPS 199, CNSSI 1253 and OSD Facility Related Control Systems (FRCS) Master List including DLA specific systems, then document the results of the security categorization in the System DLA FIPS 199 document and the Concept of Operations (CONOPs).

Assigned DLA PM will coordinate with the Contractor to identify and document Confidentiality, Availability, Integrity of the system in a DLA FIPS 199 document for approval by DLA ISSM personnel.

C3.4 Cybersecurity Assurance Requirements

The Contractor shall design, develop, and integrate cybersecurity solutions supporting the Department of Defense and all other applicable Government agencies.

This will be achieved through abiding by all applicable cybersecurity policies, regulations, and directives to ensure a favorable Assessment and Authorization (A&A), Assessment and Incorporate (A&I), or FRCS Assess Only Risk Assessment decision, as well as obtaining an Authority to Connect (ATC) to a DLA network. The Contractor shall mitigate risk identified through the RMF authorization process down to a level acceptable to the DLA Authorizing Official (AO).

Coding for Security. The Contractor shall provide documentation of development practices and standards applied to Government approved Contractor-written control system software, including firmware, used to ensure a high level of defense against unauthorized access.

The solution shall comply with the security control requirements documented in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53r5, “Security and Privacy Controls for Federal Information Systems and Organizations” and NIST 800- 82r3, “Guide to Industrial Control Systems (ICS) Security”. The Contractor shall provide details of any alternative but equally effective security measures used to compensate for the inability to satisfy a particular derived security requirement (mitigation to control compliance findings). This information shall be submitted in writing to the DLA J6 PM for cybersecurity approval as soon as the alternative is identified.

Typical Contractor services activities include:

a. Analyzing DLA physical, electrical, computerized, and mechanical environments the identified FRCS solution will control (e.g., the physical Operational process to be controlled, such as those used in manufacturing, metering, and robotics).

b. Developing a DLA Automation Solution FRCS architecture in terms of devices, dataflow, and control loops, outlining interconnectivity with engineering and operator workstations, and Safety Instrumented Systems (SISs) for testing; testing shall be in accordance with DoD Control Systems Security Requirements Guide (SRG), and other identified DLA test processes.

c. Defining how the DLA FRCS Automation Solution will connect to external (e.g., plant) and networks, by system description, concept, and dataflow diagram on Perdue Levels. Guidance on the applicability of Purdue Enterprise Reference Architecture (PERA) levels are found in the United Facilities Criteria (UFC) 4- 010-06, Cybersecurity of Facilities-Related Control Systems.

e. Installing, configuring, patching, backing up, and testing for DLA handover of the Automation Solution to the DLA asset owner for operation.

f. Gaining approval of the DLA asset owner for many of the decisions made and outputs generated during the execution of these activities.

The Contractor shall protect unclassified DoD data from unauthorized access or disclosure in accordance with DoDI 8582.01, “Security of Unclassified Information on Non-DoD Information Systems.” Controlled Unclassified Information: All Government controlled unclassified information obtained by the Contractor shall be protected in accordance with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations”.

Agencies or Military Services providing external information system services must comply with DLA information security requirements and employ overlayed security controls in accordance with applicable federal laws, Executive Orders, directives, instructions, policies, regulations, standards, and guidance.

C3.5 Tasks and Deliverables

The Contractor shall provide required implementation and design documentation to the DLA PM and security engineering teams to conduct a cybersecurity risk assessment (RA) of proposal. Results from accepted RAs will be incorporated into the Systems concepts of operations (CONOPs).

The Contractor, in collaboration with assigned security manager, PM and system owner, shall identify and document applicable cybersecurity enterprise architectures and deliver system conceptual design drawings.

The Contractor shall leverage, to the greatest extent possible, DLA Enterprise processes and capabilities.

C3.5.1 System and Network Requirements

All system/network components and applications shall be compatible with all applicable Defense Information System Agency (DISA) Security Technical Implementation Guides (STIGs). Any STIG exceptions must be identified as part of the Contractor’s proposal to the

Government and approved by J6 Cybersecurity. Exceptions incurring risk found unacceptable to the DLA Authorizing Official are not permitted.

All network components and applications shall be IPv4 and IPv6 compatible.

Network components shall allow configuration of IEEE 802.1x or port security for authentication.

The Contractor shall provide a complete list of all ports, protocols and services required for any computer system running control system applications or required to interface the control system applications. The listing shall include all ports and services required for normal operation as well as any other ports and services required for emergency operation. The listing shall also include an explanation or cross reference to justify why each service is necessary for operation.

The Contractor shall identify any system wireless communication capability, enabled, or disabled. All wireless communications shall meet applicable STIG requirements to include FIPS 140-2 certification. Any requirement to use wireless or cellular must be approved in writing by DLA J6, coordinated with the J62B PM and documented with the DLA Frequency Manager.

C3.5.2 Information and Operational Technology Infrastructure Requirements

In general, the DLA expects to furnish the IT Infrastructure to host the OT solution(s) and/or system(s) (including VLANs, and Virtual Machines (VMs)) unless there is a hardware, compatibility, or mission issue preventing it. As such, the Contractor must clearly identify “what” anticipated Government IT Infrastructure is required to host and operate the OT solution(s) and/or system(s) within the design documentation submitted for Government approval at time of award. These anticipated designs will be incorporated into the system CONOPs. The Contractor will be responsible for all installation, configuration, and deployment of the OT solution(s) and/or system(s) (including but not limited to) its subsystem(s), application(s), and patch cabling, if required.

Any requirement for the Contractor to provide their own IT Infrastructure, standalone server, or management workstation hardware due to compatibility issues must be documented in the Contractor’s proposal and approved by J6 prior to contract award, if applicable. All Contractor provided IT Infrastructure must meet DoD STIG requirements. If the Contractor provides their own IT Infrastructure for the OT solution(s) and/or system(s), upon AO approval of the security authorization package (and prior to final OT solution(s) and/or system(s) acceptance or go-live), all Contractor-provided IT Infrastructure will become the property of the Government.

All specialized software provided by the Contractor to the Government must have the applicable license key(s) as well as sales/transaction records, ownership control(s), manuals, technical publications, documentation, and any other information supporting ownership accompanying it. At the time of Contractor hand-off of Contractor-owned IT Infrastructure to the Government, all design information for Enterprise Architecture (EA) for the “as built”

OT solution(s) and/or system(s) will be provided. Any Contractor provided operating system (OS), software, and firmware throughout the duration of the contract will be upgraded by the Contractor prior to the Contractor’s end of mainstream support for the OS, software, or firmware.

The Contractor will be responsible for the implementation including meeting all required STIG compliance.

The Contractor shall be responsible for all configuration and deployment which meet DoD, NIST and Government regulatory and cybersecurity policy requirements.

Any OT solution(s) and/or system(s) with IT Infrastructure provided by the Contractor must be upgradeable and remain compliant to cybersecurity specifications during the lifecycle of the solution. Contractor-supplied systems must meet DoD STIG requirements, with any exceptions noted in the design documentation.

The Contractor is responsible for all software maintenance activities for any/all appliances including but not limited to, firmware updates, OS patching, software patches etc. for the duration of the contract period.

The Contractor will be responsible for all physical maintenance activities for any/all appliances including but not limited to, replacement of defective components such as hard drives (to be destroyed onsite per DoD policy, guidance), motherboards, daughterboards, etc., for the duration of the contract period.

Maintenance activities start after handover of the DLA Automation Solution to the DLA asset owner and may continue until the asset owner no longer requires them.

Activities are typically short and frequently recurring, and may include one of more of the following:

a. Patching and anti-virus updates

b. Equipment upgrades and maintenance, including small engineering adjustments not directly related to control algorithms

c. Component and system migration

d. Change management

e. Contingency plan management

All maintenance activities will include completion of identified DoD/DLA Security Awareness training, independent of other training received.

System(s) shall operate using a Contractor fully supported operating system (OS), software, and firmware throughout the duration of the contract. All operating systems, software, and firmware shall be upgraded prior to the Contractor’s end of mainstream support for the operating system, software, or firmware. The solution must be upgradeable and remain compliant to DoD cybersecurity specifications during the lifecycle of the solution.

Any removable flash media required for system operation must be reviewed and approved in writing by the DLA J6 Flash Media Approval Program prior to implementation.

All FRCS OT solution(s) and/or system(s) must use the PERA Model for Control Hierarchy (reference ISBN 1-55617-265-6) to provide logical and/or physical architecture for networking, security hardware, software, and methods. The PERA Model is an industry standard for manufacturing and/or industrial control systems that segments hardware, devices, and equipment into a hierarchical based design.

C3.5.3 Deliverables

The table below provides a summary of the deliverables required of the Contractor based on identified cybersecurity requirements for Assess and Authorize (A&A), Assessment and Incorporate (A&I), and Facility Related Control System Lean Cybersecurity Risk Assessment

(FRCS LCRA).

# Deliverable Name Reference (these sections w/be adjusted based on

PWS/SOW)

Submission Due

8140 Report

3.0

Monthly (NLT 5th business day of each month)

RMF Documentation:

System Diagrams (Architecture, Authorization Boundary, Data Flow and Purdue)

5.0

Draft- One (1) month after contract award

Final - six (6) months after contract award

Comprehensive

Hardware/ Software List (DLA provided template)

5.0

Draft- One (1) month after contract award

Final - six (6) months after contract award

4 System CONOPs 5.0 Six (6) months after contract award

Ports, Protocols and

Services Management

(PPSM)

5.0 Four (4) months after

contract award

6 FIPS 199 Categorization 5.0 One (1) month after contract award

Cybersecurity Scan

Results (ACAS, SCAP, WebInspect)

5.0

Draft - One (1) month after contract award

Final - six (6) months after contract award

Security Technical Implementation Guides (STIGs) and Security Requirement Guides (SRGs) Checklists

5.0 Six (6) months after

contract award

# Deliverable Name Reference (these sections w/be adjusted based on

PWS/SOW)

Submission Due

Documentation supporting RMF security control implementation

(as outlined in DLA

RMF SOP)

(*When required)

5.0 Six (6) months after

contract award

10 Control assessment procedure test results 5.0 Six (6) months after contract award

11 Plan of Actions and Milestones (POA&Ms) 5.0 Six (6) months after contract award

PII Confidentiality Impact Level (PCIL)

Categorization Worksheet

Privacy Impact Assessment

5.0 One (1) month after

contract award

System Administrator Installation/

Configuration Documentation

6.2 Four (4) months after

contract award

Application Software release/patch Documentation

6.2 Four (4) months after

contract award

Example for 8140 Work Role: Personnel Certification are required for Operational Technology

Reference: DoD Cyber Workforce Qualifications Matrices Management – DoD Cyber Exchange https://cyber.mil/wid/cwmp/qualifications-matrices/ https://cyber.mil/wid/cwmp/qualifications-matrices/

Recommend using NIST 800-82 guidance using ISA 99.02.01/IEC 62443 standards: Security for Industrial Automation and Control Systems for DLA physical systems architecture, introducing the six (6) Purdue network levels of the OT/FRCS environment, depicting the systems and technologies that reside at each level:

PURDUE LEVEL DESCRIPTION EXAMPLES

Level 5: Enterprise Networks Corporate-level services supporting individual business units and users. These systems are usually located in corporate data centers.

Servers providing:

• Enterprise Active Directory (AD)

• Internal email

• Customer Relationship Management (CRM) systems

• Human Resources (HR) systems

• Document Management systems

• Backup solutions

• Enterprise Security Operations Centre (SOC)

Level 4: Business Networks IT networks for business users at local sites. Connectivity to Enterprise-wide area network (WAN) and possibly local Internet access. Direct Internet access should not extend below this level.

• Business workstations

• Local file and print servers

• Local phone systems

• Enterprise AD replicas

Level 3.5 IT/OT BOUNDARY (DMZ) Boundary defense management servers and tools

Level 3:

Site-Wide Supervisory

Monitoring, supervisory, and operational support for a site or region.

• Level 3 Human-machine interfaces (HMIs)

• Alarm servers

• Analytic systems

• Historians (if scoped for an entire site or region)

Level 2: Local Supervisory Monitoring and supervisory control for a single process, cell, line, or distributed control system (DCS) solution. Isolate processes from one another, grouping by function, type, or risk.

• Level 2 HMIs

• Alarm servers

• Process analytic systems

• Historians

• Control room (if scoped for a single process and not the site/region)

Level 1: Local Controllers Devices and systems to provide automated control of a process, cell, line, or DCS solution. Modern ICS solutions often combine Levels 1 and 0.

• Programmable Logic Controllers (PLCs)

• Control processors

• Programmable relays

• Remote terminal units (RTUs)

• Process-specific microcontrollers

Level 0: Field Devices Sensors and actuators for the cell, line, process, or DCS solution.

Often combined with Level 1.

• Basic sensors and actuators

• Smart sensors/actuators speaking fieldbus protocols

• Intelligent Electronic Devices (IEDs)

• Industrial Internet-of-Things (IIoT) devices

• Communications gateways

• Other field instrumentation https://gca.isa.org/hubfs/ISAGCA%20Quick%20Start%20Guide%20FINAL.pdf

C3.6 Physical Security

A. The Contractor shall control access by locking or unlocking the areas or facilities used by the Contractor in the performance of the contract requirements. The Contractor shall lock all overhead doors, cages, vaults, warehouse doors, windows, and other areas for reasons of internal security before leaving an area unattended and prior to the conclusion of any working day.

B. The Contractor shall operate under the site approved security plan.

C. In the event a Contractor area is found unsecured or there is an alarm response during non-duty hours, the Contractor’s designated Point of Contact (POC) will be required to secure the area. The Contractor shall inform the KO or designee of the results of the alarm response. The Contractor shall report any facility security violations to the KO or designee within one (1) hour of discovery.

D. Upon request of the KO or designee, the Contractor shall prepare and provide reports to update progress on all recommended corrective actions stemming from Government inspections or assessments conducted at the site (i.e., Security Program Review (SPR), OPSEC/INFOSEC inspections, Vulnerability Assessments (VA), DoD and DLA regulations or policies etc.)

E. The Contractor’s Security Specialist shall participate in working groups (i.e., Physical Security Anti-terrorism, Force Protection and OPSEC), if requested.

C3.7 Key Control

A. The Contractor shall establish and maintain a Key and Lock Control Program as part of their Physical Security SOP, IAW DLAM 5200.08 DLA Physical Security Manual. The Contractor shall safeguard keys provided by the Government. The Contractor shall designate in writing to the KO or designee a key custodian to manage the key control program by the start of full performance.

B. The Contractor shall develop and maintain a roster of employees with key or lock access requirements for key control boxes or equivalent system IAW DLAM 5200.08 DLA Physical Security Manual. The Contractor shall provide the KO or designee updated rosters as information changes. At all times the Contractor shall keep all keys within the Key and Lock Control Program under continuous accountability and shall limit the number of individuals authorized to draw keys to the minimum required by security and operational requirements.

C. The Contractor shall not duplicate keys or allow their use by unauthorized Contractor personnel. The Contractor shall report any deviation from these rules or lost keys to the KO or designee within one (1) hour after discovery of occurrence and submit a detailed written report by close of business (COB) the same working day. If lost keys are discovered at the end of the day, and it is not possible to submit a written report to the KO or designee by COB the same working day, the Contractor shall submit the report within two (2) hours of the beginning of business on the next working day. The Contractor shall reimburse the Government for all costs associated with replacing locks or re-keying as a result of key duplication or loss.

C3.8 Identification of Contractor Employees

A. The Homeland Security Presidential Directive 12 (HSPD-12) dated 27 September 2012 has established criteria for Contractors who require a Common Access Card (CAC) for either physical access to an installation or access to government information technology (IT) systems. The Government requires Personnel Security Investigations (PSI) to establish that applicants or incumbents either employed by the Government or working for the Government under contract are suitable for the job and are eligible for a public trust or sensitive position. Upon favorable review and initiation of the PSI, Contractor personnel may be granted temporary access pending final adjudication of the

PSI.

B. A Contractor Investigative Request (CIR) form annotating the appropriate designation shall be submitted for each contract employee.

C3.9 Information Security

A. Upon favorable review and initiation of the PSI to establish the suitability of an employee for the job and the approval for temporary IT access pending final adjudication but not less than fourteen (14) working days prior to the employee’s start date, the Contractor shall request Information Technology (IT) eligibility for an employee requiring access and passwords to the government data systems. The employee may start prior to the fourteen working day timeline at the Contractor’s discretion provided all other Personnel Clearance requirements (1.4.4 A) are met and there is adequate contractor workload which does not require IT access. All Contractor employees who perform data entry and query functions shall require IT Level III category eligibility (the minimum access level that includes no sensitive or classified information).

B. Contractor access to Government IT data systems shall be granted on a “need-to-know” basis, IAW DLAI 6401 IA Management Controls and IA Technical Controls to Contractor personnel who will perform data input and retrieval functions and for “clearance special access,” if applicable IAW DoD 5200.2-R, Personnel Security Program. All Contractor personnel provided with access to government computers and systems shall observe IT security policies and procedures as provided by the KO or designee. The Contractor shall notify the KO or designee within 12 hours when, for reasons of personnel resignation, reassignment, termination, or completion of portions of the contract, Contractor personnel no longer require access to government systems.

C. The Contractor shall observe all copyright agreements. In the interest of protecting government systems from computer viruses, the Contractor shall not use public domain software nor shall Contractor personnel download software from public bulletin boards or Internet websites. Should the introduction of a computer virus or malicious destruction of computer software, stored information, or hardware result from the use of public domain software or from software taken from a public bulletin board or Internet website, the Contractor shall be required to repair the damage and incur all costs at no expense to the Government and without impact on delivery schedules.

C3.10 Privacy Act Information

Contractors shall comply with requirements of DoD Directive (DODD) 5400.11 regarding control of privacy act information. Specifically, Contractors shall ensure that any personally identifiable information (such as but not limited to individual names and associated personal contact information or social security numbers) is restricted to access required for execution of this contract and is not disclosed or stored on any unsecure systems.

C3.11 Sensitive Information

Work on this IDIQ will require Contractor personnel to have access to sensitive, privileged, or Privacy Act information. Personnel shall adhere to the Privacy Act, (5 U.S.C. § 552a) and applicable Agency rules and regulations. Contractors shall not divulge, or release privacy data or information developed or obtained in the performance of this contract award, until made public or specifically authorized by the Government. Contractors shall not use, disclose, or reproduce a third-party company’s proprietary data, other than as authorized and required in the performance of this IDIQ award. Contractors shall notify the COR within 24 hours, identifying personnel that no longer require access to Government Information Systems (IS).