Attachment_2_-_Baseline_Compliance_Contract_Guidelines.pdf

Baseline Compliance Contract Guidelines

Table of Contents Section 1.0 – Information Technology & Cybersecurity Requirements

Section 2.0 – Cybersecurity Incident Response

Section 3.0 – Privacy Requirements

Section 4.0 – Accessibility Requirements (Section 508)

Section 5.0 – Records Management Requirements

Section 6.0 – Contractor Personnel Security Requirements

Section 7.0 – Controlled Unclassified Information (CUI) Requirements

Section 8.0 – Paperwork Reduction Act of 1995

Section 9.0 – Reference Documents

Section 10.0 – Glossary

DOI Information Management and Technology Compliance Acquisition Guidelines

This document provides guidance regarding what Information Technology (IT) concerns must be incorporated, as applicable, in all Department of the Interior (DOI) contract actions that involve IT products or services. Contracting Officer Representatives (CORs) and/or the requirement owner shall work closely with their contracting officer to ensure the below requirements are properly addressed in IT contracts within the appropriate section. Any referenced regulation or policy should be linked to or otherwise provided to the contractor.

Section 1.0 – Information Technology & Cybersecurity Requirements

A. Applicability This term applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”). The Contractor shall use these terms in all subcontracts.

B. Requirements Information systems and system services provided to the Department of the Interior (DOI) by the Contractor must comply with DOI Information Technology Cybersecurity and Privacy Control Standards, privacy policies and other related guidance. Contracts that involve Industrial Control System (ICS) products and services should be evaluated on an individual basis and contain language specific to ICS. Please contact the Bureau of Reclamation (BOR) at ICSsecurity@usbr.gov for all ICS issues and guidance.

The Contractor and the contractor managed systems shall comply with all Federal regulations and guidance, including but not limited to:

a. Federal Information Security Modernization Act of 2014 (FISMA) accessible at https://www.cisa.gov/federal-information-security-modernization-act

b. Federal Risk and Authorization Management Program (FedRAMP) for cloud hosted systems accessible at https://www.fedramp.gov

c. Section 208 of the E-Government Act of 2002 accessible at https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW- 107publ347.pdf

d. Privacy Act of 1974 accessible at https://www.justice.gov/opcl/privacy-act-1974

e. Federal Information Processing Standards (FIPS) and the National Institute of

Standards and Technology (NIST) 800-Series Special Publications (SP) accessible at https://www.nist.gov

f. Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource, accessible at https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a1 30revised.pdf.

C. Information Systems The Contractor shall manage information in accordance with applicable laws, regulations, executive orders, and policies regarding the marking, safeguarding, and dissemination of Controlled Unclassified Information (CUI). Personally Identifiable Information (PII) is a subset of mailto:ICSsecurity@usbr.gov https://www.cisa.gov/federal-information-security-modernization-act https://www.fedramp.gov/ https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf https://www.govinfo.gov/content/pkg/PLAW-107publ347/pdf/PLAW-107publ347.pdf https://www.justice.gov/opcl/privacy-act-1974 https://www.nist.gov/ https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf information designated as CUI, and Sensitive PII is a subset of PII that requires additional controls and safeguards. See Section 3, Privacy Requirements.

The Contractor shall not use or redistribute any sensitive information processed, stored, and/or transmitted by the Contractor except as specified in the contract.

Contractor Information Systems shall comply with FISMA. The Contractor shall provide an

Assessment and Authorization (A&A) documentation package for each system that complies with Federal Information Processing Standard (FIPS) 199, National Institute of Standards and Technology (NIST) Special Publication (SP) 800-34, NIST SP 800-37, NIST SP 800-53, NIST SP 800-60, et al.

The Contractor cryptographic modules used to protect DOI information shall comply with the current FIPS 140 version and be validated by the Cryptographic Module Validation Program.

Access to all Government data stored outside the confines of a DOI managed data center shall comply with Trusted Internet Connections (TIC) requirements.

All Contractor personnel requiring access to DOI information data and/or system shall be cleared at appropriate levels as set forth:

a. Low Risk position will require a National Agency Check with Written Inquiries (NACI) or equivalent investigation.

b. Moderate Risk position will require either a Limited Background Investigation (LBI) or a Minimum Background Investigation (MBI) based on the CO’s determination; and,

c. High Risk position will require a Background Investigation (BI).

Vulnerability Scanning - All systems must be scanned monthly with a vulnerability analysis tool using authenticated scans that are acceptable to DOI. Vulnerabilities and weaknesses shall be remediated in accordance with (IAW) Departmental mandated time frames commensurate with the level of risk.

D. Cloud All Contractors’ cloud-hosted Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS) or other ‘as a Service’ offerings shall comply with FedRAMP and the language within the DOI cloud hosting program guidelines.

E. Internet Protocol Version 6 (IPv6) Applicability of Internet Protocol Version 6 (IPv6) to DOI-related components (networks, infrastructure, and applications) specific to individual acquisitions shall be in accordance with the Department of the Interior Acquisition, Arts, and Asset Policy DOI-AAAP-0055, Procuring Internet Protocol Version 6 (IPv6), (per OMB Memorandum M-05-22, August 2, 2005) regardless of whether the acquisition is for modification, upgrade, or replacement. All Enterprise Architecture related component acquisitions shall be IPv6-compliant as defined in the U.S.

Government Version 6 (USGv6) Profile (NIST SP 500-267) and the corresponding declarations of conformance defined in the USGv6 Test Program.

F. Continuous Monitoring All Contractor-operated systems that input, store, process, output, and/or transmit DOI CUI information shall meet or exceed the continuous monitoring requirements identified in the DOI Continuous Monitoring Plan or the Bureau or Office Continuous Monitoring Plan, whichever is more stringent.

The Contractor managed systems are required to assign an Information System Security

Officer (ISSO) and System Owner (SO) within their organization to support the processes described in this contract. The Contractor ISSO and SO resources are required to comply with DOI or other approved annual and Role Based Security Training (RBST) requirements.

The Contractor managed systems are required to submit Continuous Monitoring Reports per the Continuous Monitoring Plan to the assigned ISSO per the timelines prescribed in the plan. The Contractor managed systems may be required to submit to a penetration test (at the discretion of the awarding program) in coordination with DOI cybersecurity personnel or approved contract officials.

The Contractor must provide the following in alignment with DOI’s continuous monitoring strategy:

a. account management

b. vulnerability management

c. patch management

d. antivirus

e. malware detection

f. event management

g. configuration management

h. license management

i. incident management

G. Security Training & Reviews All users of Federal information systems are required by Title 5, Code of Federal Regulations, Part 930.301, Subpart C, as amended, to be exposed to security awareness materials annually or whenever system security changes occur, or when the user’s responsibilities change. The Department of the Interior (DOI) requires that Contractor employees take an annual Information Technology Security Awareness Training course before accessing federal information systems under the contract. Unless otherwise specified, the training shall be completed within thirty (30) days of contract award and be completed on an annual basis thereafter. Any new Contractor employees assigned to the contract shall complete the training before accessing federal information systems under the contract. The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Unless otherwise specified, initial training certificates for each Contractor and subcontractor employee shall be provided to the Contracting Officer’s Representative (COR) not later than thirty (30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification each year. The e-mail notification shall state the required training has been completed for all Contractor and subcontractor employees.

The Government may elect to conduct random periodic reviews to ensure that the security requirements contained in this contract are being implemented and enforced. The Contractor shall afford DOI, the Office of the Inspector General, and other Government organizations access to the Contractor’s facilities, installations, operations, documentation, databases, and personnel used in the performance of this contract. Access shall be provided, to the extent necessary as determined by the Government, for the Government to carry out a program of inspection, investigation, and audit to safeguard against threats and hazards to the integrity, availability, and confidentiality of Government data or the function of computer systems used in performance of this contract and to preserve evidence of computer crime

H. Contractor Reporting Requirements The Contractors operating information systems on behalf of DOI shall comply with FISMA reporting requirements. Annual and quarterly data collection will be coordinated by DOI System Owners. Contractors must provide DOI with the requested information based on the timeframes provided with each request. The Contractor systems shall comply with near real time feeds in accordance with Department of Homeland Security (DHS) Continuous Diagnostics and Mitigation (CDM) requirements as coordinated by DOI. Reporting requirements are determined by OMB and may change each reporting period.

The Contractor managed systems shall adhere to NIST 800-53 and submit to an annual assessment performed in coordination with DOI cybersecurity personnel or approved contract officials. All results of the annual assessment become the property of DOI.

The Contractor shall comply with DHS or other Government Oversight bodies regarding

Cybersecurity related mandates and directives (Binding Operational Directives (BOD), etc.) or any additional ad-hoc reporting requirements.

Section 2.0 – Cybersecurity Incident Response

This term applies to the Contractor, its subcontractors, and Contractor employees (hereafter referred to collectively as “Contractor”. The Contractor shall use these terms in all subcontracts.

B. Definitions.

As used in this term-

“Incident” means an occurrence that (1) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system;

or (2) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

C. Requirements

All Contractors employees and Information system service providers shall be responsible for recognizing and reporting security incidents. Information system service providers shall receive the current version of the DOI Incident Response Plan, Policy, and Handbook at time of award, in addition to Bureau or Office specific guidance for appropriate reporting and response at all levels.

All suspected or confirmed Information Security Incidents shall be reported in accordance with the requirements below even if it is believed the incident may be limited, small, or insignificant. For hosting environments, including cloud systems and services, this includes incidents occurring on the service provider’s underlying infrastructure supporting containers utilized by DOI. In such cases, the vendor’s primary security operations and/or incident response unity shall engage directly with the DOI Cyber Security Operations (CSO) section and provide DOI CSO with security and event logs covering the period of the incident and up to six months prior. DOI CSO and Bureau/Office Incident Response Teams will determine when an incident requires additional focus and attention.

All Contractor employees and Information system service providers shall report all information security incidents to the appropriate Bureau or Office Incident Response team and to the DOI Computer Incident Response Center (DOI CIRC) immediately, no later than 1 hour after “becoming aware of the incident,” at: DOICIRC@ios.doi.gov, (703) 648-5655, regardless of day or time. Any contractor action to respond to, contain, remediate, or recover from a security event constitutes “becoming aware of the incident.”

When notifying the DOI CIRC and the appropriate Bureau or Office Incident Response team, the Contractor shall include the Contracting Officer (CO) and Contracting Officer’s Representative (COR) on the correspondence email to DOICIRC@ios.doi.gov and the appropriate Bureau or Office Incident Response team. If the Contractor reported the incident by phone, then immediately following the reporting, the Contractor shall notify the CO and COR via email. The Contractor is responsible for verifying all notification was received and acknowledged by the CO or COR. If the Contractor has any questions regarding these procedures, they shall contact the CO or the COR.

The Contractor shall not include any controlled information in the subject or body of any e-mail. Contractor shall transmit controlled Information using NIST FIPS 140-2 compliant and validated encryption methods to protect controlled Information in email attachments. Passwords must not be communicated in the same email as the attachment. Contractor shall contact the CO or COR if encryption software is needed for guidance on appropriate, Federally approved encryption methods.

Section 3.0 – Privacy Requirements

A. Applicability.

B. Definitions.

As used in this term-

“Breach” means the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence where (1) a person other than an authorized user accesses or potentially accesses personally identifiable information or (2) an authorized user accesses or potentially accesses personally identifiable information for an other than authorized purpose.

“Personally Identifiable Information (PII)” means information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual

“Sensitive PII” is a subset of PII that, if lost, compromised, or disclosed without authorization could result in substantial harm, embarrassment, inconvenience, or unfairness to an individual. Sensitive PII is controlled unclassified information and requires additional controls and safeguards to protect the privacy of individuals. Sensitivity of PII may depend on specific PII elements, groupings of PII, context or use of PII, or requirements under applicable Federal laws, regulations, and policy such as the Privacy Act of 1974 and the CUI Rule. Sensitive PII includes but is not limited to: full or truncated Social Security Numbers (SSN), driver's license or state identification number;

financial account number; date of birth; citizenship; ethnic or religious affiliation; biometric identifiers such as fingerprint, voiceprint, or iris scan; medical information; criminal history; system authentication information such as passwords, personal identification numbers or mother's maiden name.

3.1 Privacy Act Requirements

The Contractor shall comply with the requirements of the Privacy Act of 1974 and shall not remove PII or Privacy Act material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When Privacy Act records, information, data, documentary material, and/or equipment is no longer required, it shall be returned to the Department’s control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer.

3.2 Privacy Controls

The Contractor shall meet the privacy requirements of the E-Government Act, FISMA, applicable Federal privacy laws, NIST, OMB, and DOI (including but not limited to those listed in the Table of Authorities) for the collection, handling, processing, and sharing of PII, and ensure compliance with the privacy controls requirements of NIST SP 800- 53, FIPS 199, FIPS 200, and DOI Privacy Control standards as appropriate for the sensitivity of the system. Contractor shall monitor the information system and update controls for continued privacy compliance on an ongoing basis and shall provide status reports to DOI upon request.

The Contractor shall be required to provide all necessary support to assist DOI in meeting the requirements of the Privacy Act and related laws and shall provide supporting documentation and access to information upon request by authorized agency officials. Support in this context includes timely responding to requests for information from DOI about the access, creation, collection, use, storage, maintenance, transmission, sharing, or disposition of PII on the Contractor’s system or processes, and providing timely review of relevant compliance documents for factual accuracy for:

• Requests for access or disclosure of records to individuals.

• Subpoenas or other judicial process.

• Discovery and litigation processes.

• Accounting of disclosures of records to third parties when authorized.

• Privacy impact assessments and related privacy artifacts.

• System of records notices.

• Privacy complaints and incidents; and

• Audits or remedial activities related to oversight of PII and system of records.

3.3 Privacy Breach Reporting Requirements

The Contractor shall provide notice to DOI CIRC or the appropriate Bureau or Office Incident Response team of any known or suspected breach of PII and meet breach reporting and mitigation requirements in accordance with the DOI Privacy Breach Response Plan or Bureau or Office applicable response plan. The report of a breach of PII shall not, by itself, be interpreted as evidence that the Contractor has failed to provide adequate information security safeguards for sensitive information or has otherwise failed to meet the requirements of the contract.

The Contractor shall report all known or suspected breaches in electronic or physical form to the CO, COR, and the DOI CIRC or Bureau/Office point of contact no later than one hour following discovery via email at DOICIRC@ios.doi.gov or (703) 648-5655, regardless of day or time and as specified within the DOI Privacy Breach Response Plan and the applicable Bureau response plan.

The Contractor will only include non-controlled data in the subject or body of any e-mail and shall not include any Sensitive PII (SPII). Where necessary, SPII shall be transmitted using encryption methods to protect controlled unclassified information in attachments in accordance with FIPS 140-2 cryptographic requirements. Passwords shall be securely communicated separately.

The Contractor shall not contact individuals impacted by a breach involving PII until directed by the government. All determinations related to response activities, appropriate notifications to individuals and Federal agencies and other organizations, and any remedial actions will be made by DOI officials.

The Contractor shall take immediate action to contain and mitigate the impact of the breach and cooperate with DOI officials to investigate the breach and determine remedial measures.

• Contractor shall provide full access and cooperation for all activities determined by DOI to be required to ensure an effective breach response, including providing all requested images, log files, and event information to facilitate rapid resolution of breaches.

• Breach response activities determined to be required by DOI may include but are not limited to, inspections; investigations; forensic reviews; data analyses and processing;

and final determinations of responsibility for the breach and/or liability for any additional response activities.

• DOI, at its sole discretion, may obtain the assistance of Federal agencies and/or third-party firms to aid in breach response activities, as needed.

The Contractor shall provide a detailed written analysis with the following data elements available at the time of the breach, and a follow up report with any additional information or updates within 24 hours of the initial breach report, that shall address all relevant information concerning the compromise:

• Government programs, platforms or systems involved.

• Location(s) of the breach.

• Date and time the breach was discovered.

• Nature of the event (loss, theft, unauthorized access).

• Description or summary of events.

• Description of PII involved, such as name, Social Security number, date of birth, etc.

• Number of potentially impacted individuals; and

• Estimated number of records exposed or compromised.

The Contractor shall collaborate with DOI officials on breach remedial activities to include notifications, credit monitoring, establishing a call center, or other relief to affected individuals as appropriate under the circumstances of the breach as proscribed in the contract. The Contractor shall have the capability to notify individuals whose PII resided in the Contractor system at the time of the breach not later than 5 business days after being directed to notify individuals. The Contractor shall not proceed with notifications unless the CO has directed in writing that notification is appropriate, subject to prior approval by DOI Privacy Officials, in accordance with the DOI Privacy Breach Response Plan. Notification may require the Contractor’s use of address verification and/or address location services. All determinations, including response activities, notifications to affected individuals and/or Federal agencies, and related services will be made by authorized DOI officials at DOI’s discretion.

In the event that an SPII or PII breach occurs as a result of the violation of a term of this contract by the Contractor or its employees, or the Contractor’s covered persons, the Contractor shall, as directed by the Contracting Officer and at no cost to the Government, without delay correct or mitigate the violation. If DOI incurs a cost for individual notifications and remediation services procured as the result of a breach of SPII or PII, the Contractor shall reimburse DOI for all costs.

3.4 Privacy Training Requirements

All Contractor and subcontractor employees are required to take privacy awareness training prior to accessing DOI information or information systems. All Contractor and subcontractor employees must also complete role-based privacy training prior to accessing PII or Privacy Act data. All required privacy training shall be completed within thirty (30) days of contract award and prior to granting access to DOI information systems or any PII, and must be completed on an annual basis thereafter, not later than September 30th of each year. Any new Contractor employees assigned to the contract shall also meet these privacy training requirements. Privacy training shall meet the requirements of FAR 52.224-3 Privacy Training (JAN 2017).

The Contractor shall maintain copies of training certificates for all Contractor and subcontractor employees as a record of compliance. Initial training certificates for each Contractor and subcontractor employee shall be provided to the COR not later than thirty (30) days after contract award. Subsequent training certificates to satisfy the annual training requirement shall be submitted to the COR via e-mail notification not later than October 30th of each year. The e- mail notification shall state the required training has been completed for all Contractor and subcontractor employees.

Section 4.0 – Accessibility Requirements (Section 508)

Section 508 of the Rehabilitation Act of 1973, as amended (29 U.S.C § 794 (d)) requires that when Federal agencies develop, procure, maintain, or use information and communication technology (ICT), it must be accessible to people with disabilities. Federal employees and members of the public who have disabilities must have access to, and use of, information and data that is comparable to people without disabilities.

Where ICT conforming to one or more requirements in the Revised 508 Standards is not commercially available, the agency shall procure the ICT that best meets the agency’s business needs and the Revised 508 Standards, in accordance with 36 CFR 1194 E202.7 and FAR 39.2. Any selection of a product or service that meets less accessibility standards due to a significant difficulty or expense shall only be permitted under an undue burden claim and requires authorization from the DOI Section 508 Office according to 375 DM 8.

B. Requirements

a. Products, platforms and services delivered as part of this statement of work that are ICT, or contain ICT, shall conform to the Revised 508 Standards, which are located at 36 CFR § 1194.1 & Appendices A, C and D and available at https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines. In the revised regulation, ICT replaced the term Electronic and Information Technology (EIT) used in the original 508 standards.

https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-ict-refresh/final-rule/text-of-the-standards-and-guidelines

1. Applicable Functional Performance Criteria: All functional performance criteria in Chapter 3 of the Revised 508 Standards apply when using an alternative design or technology that results in substantially equivalent or greater accessibility and usability by individuals with disabilities than would be provided by conformance to one or more of the requirements in Chapters 4 and 5 of the Revised 508 Standards, or when Chapters 4 or 5 do not address one or more functions of ICT.

2. Applicable 508 requirements for electronic content features and components (including Electronic training materials): All requirements in E205 of the revised 508 Standards apply, including all Web Content Accessibility Guidelines (WCAG) 2.0 Level AA Success Criteria.

3. Applicable 508 requirements for software features and components (including Software infrastructure): All requirements in Chapter 5 apply, including all WCAG 2.0 Level AA Success Criteria, 502 Interoperability with Assistive Technology, and 503 Application.

4. Applicable 508 requirements for hardware features and components: All requirements in Chapter 4 apply.

5. Applicable 508 requirements for support services and documentation: All requirements in Chapter 6 apply.

b. When providing installation, configuration or integration services for ICT, the Contractor shall not reduce the original ICT item’s level of Section 508 conformance prior to the services being performed.

c. When providing maintenance upgrades, substitutions, and replacements to ICT, the Contractor shall not reduce the original ICT’s level of Section 508 conformance prior to upgrade, substitution, or replacement. The agency reserves the right to request an Accessibility Conformance Report (ACR) for proposed substitutions and replacements prior to acceptance.

d. Contractors shall provide an ACR for each commercially available ICT item offered through this contract. The ACR should be created using the Voluntary Product Accessibility Template (VPAT) Version 2.4 Rev 508 (or later), located at https://www.itic.org/policy/accessibility/vpat.

e. When developing or modifying ICT for the government, the Contractor shall ensure the ICT fully conforms to the applicable Section 508 Standards. When modifying a commercially available or government-owned ICT, the Contractor shall not reduce the original ICT Item’s level of Section 508 conformance.

f. When developing or modifying web and software ICT, the Contractor shall demonstrate Section 508 conformance by providing Section 508 test results based on the versions of the DHS Trusted Tester Methodology currently approved for use, as defined at https://www.dhs.gov/compliance-test-processes. The Contractor shall use testers who are certified by DHS on how to use the DHS Trusted Tester Methodology (e.g. “DHS Certified Trusted Testers”) to conduct accessibility testing. Information on how testers can become certified is located at https://www.dhs.gov/publication/trusted-tester-resources.

g. Contractor personnel shall possess the knowledge, skills, and abilities necessary to address the applicable revised Section 508 Standards for each ICT.

https://www.itic.org/policy/accessibility/vpat https://www.dhs.gov/compliance-test-processes https://www.dhs.gov/publication/trusted-tester-resources

h. Exceptions for this statement of work have been determined by DOI and only the exceptions described in 375 Departmental Manual (DM) 8 DOI Section 508 Program and Responsibilities, dated February 5, 2016, may be applied. Any request for additional exceptions shall be sent to the COR and a determination will be made according to 375 DM 8.

Section 5.0 – Records Management Requirements

When Federal agencies acquire goods or services, they need to determine what Federal records management requirements should be included in the contract. Federal contractors often create, send, or receive Federal records. Federal contracts should provide clear legal obligations describing how the contract employees must handle Federal records.

Agency records officers, procurement counsel, and acquisitions officers must discuss how to integrate records management obligations into their existing procurement processes. The National Archives and Records Administration (NARA) has developed language to be included as an agency-specific term and condition in Federal contracts for a variety of services and products. Most contracts should include language on records management obligations, but each contract should be evaluated individually as not all conditions will be appropriate for all contracts. For example, the data-rights paragraph may not be appropriate for all contracts. Instead, agencies may be better served by one of the established data-rights clauses in the Federal Acquisition Regulations.

This language should not replace specific records management requirements included within Federal information system contracts.

A. Applicability

This term applies to all Contractors whose employees create, work with, or otherwise handle Federal records, as defined in Section B, regardless of the medium in which the record exists. The Contractor shall use these terms in all subcontracts.

B. Definitions

“Federal record” as defined in 44 U.S.C. § 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.

The term Federal record:

• includes all departmental records.

• does not include personal materials.

• applies to records created, received, or maintained by Contractors pursuant to their department contract.

• may include deliverables and documentation associated with deliverables.

C. Requirements

a. Contractors shall comply with all applicable records management laws and regulations, as well as NARA records policies, including but not limited to the Federal Records Act (44 U.S.C. chs. 21, 29, 31, 33), NARA regulations at 36 CFR Chapter XII Subchapter B, and Departmental Policy.

b. The Contractor shall coordinate with the appropriate Departmental and Bureau Records Management Programs to ensure the identification, storage, retrieval, preservation, access, control markings, and disposition of records using the official Departmental record keeping system(s). This includes the implementation of all technical aspects to appropriately interconnect and or transfer records to the system(s). Any exceptions to using this system must be expressly presented by the Contractor in writing to and approved by the Departmental and/or Bureau Records Management Programs. Thereafter, each major or minor variance must be expressly presented in writing.

c. When the Department or bureau contracts for the design, development, or operation of a system on behalf of the Department, the contractor must make and preserve records to sufficiently document all planning, design, development, or operation of the system.

d. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under the legal control of, the Government are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, the Privacy Act of 1974 (5 U.S.C. 552a), as amended, and Executive Order 13556 Controlled Unclassified Information. Contractors shall maintain all records created for Government use or created in the course of performing the contract and/or delivered to, or under the legal control of the Government and must manage them in accordance with Federal law. Electronic records and associated metadata must be accompanied by sufficient technical documentation to permit understanding and use of the records and data and must be managed and scheduled for disposition only as permitted by statute or regulation.

e. DOI and its contractors are responsible for preventing the alienation or unauthorized destruction of records, including all forms of mutilation. Records may not be removed from the legal custody of DOI or destroyed except for in accordance with the provisions of the agency records schedules and with the written concurrence of the Head of the Contracting Activity and the Bureau Records Officer. The routine disposition of records created and maintained by DOI and the Contractor may be suspended through coordination of the Departmental Records Officer, Bureau/Office Records Officer, the Records Management Contact, the Program Manager or Site Manager. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, Contractors must report to DOI. The agency must report promptly to NARA in accordance with 36 CFR 1230.

f. The Contractor shall immediately notify the appropriate Contracting Officer upon discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records, or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the [contract vehicle]. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment is properly protected. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government’s behalf, without the express written permission of the Head of the Contracting Activity. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to DOI control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the [contract vehicle]. The Contractor shall provide a mechanism for reliably deleting DOI data upon request by DOI.

g. The Contractor is required to obtain the Contracting Officer's approval prior to engaging in any contractual relationship (sub-contractor) in support of this contract requiring the disclosure of information, documentary material and/or records generated under, or relating to, contracts. The Contractor (and any sub-contractor) is required to abide by Government and DOI guidance for protecting sensitive, proprietary information, classified, and controlled unclassified information.

h. The Contractor shall only use Government IT equipment for purposes specifically tied to or authorized by the contract and in accordance with DOI policy.

i. The Contractor shall not create or maintain any records containing any non-public DOI information that are not specifically tied to or authorized by the contract.

j. The Contractor shall not retain, use, sell, or disseminate copies of any deliverable that contains information covered by the Privacy Act of 1974 or that which is generally protected from public disclosure by an exemption to the Freedom of Information Act.

k. The DOI owns the rights to all data and records produced as part of this contract.

All deliverables under the contract are the property of the U.S. Government for which DOI shall have unlimited rights to use, dispose of, or disclose such data contained therein as it determines to be in the public interest. Any Contractor rights in the data or deliverables must be identified as required by FAR 52.227-11 through

FAR 52.227-20.

l. Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take DOI-provided records management training. The Contractor is responsible for confirming training has been completed according to agency policies, including initial training and any annual or refresher training.

Section 6.0 – Contractor Personnel Security Requirements

Federal Personal Identification Card Requirements

Acquired services shall comply with the following regulations and requirements. Homeland Security Presidential Directive-12 requires that all Federal entities ensure that all Contractors have current and approved security background investigations that are equivalent to investigations performed on Federal employees. The Contractor shall comply with DOI-AAAP-0081 policy requirements. Background investigations will be performed by the Office of Personnel Management (OPM).

Section 7.0 – Controlled Unclassified Information (CUI) Requirements referred to collectively as “Contractor”). The Contractor shall use these terms in all subcontracts.

B. Definitions

a. Sensitive Information. Sensitive information means any information that warrants a degree of protection and administrative control as defined in law, regulation, governmentwide policy, or judicial opinion.

b. Controlled Unclassified Information (CUI): information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law regulation or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. Legacy materials may retain For Official Use Only (FOUO), Sensitive But Unclassified (SBU), or other markings until the artifact is no longer considered “data at rest;”

it is revised, reused, or goes in motion.

c. Personally Identifiable Information (PII): a subset of information designated as CUI. See Privacy Section for additional requirements.

d. Sensitive PII: subset of PII that requires additional controls and safeguards. See Privacy Section for additional requirements.

C. Authorities

a. EO 13556, November 4, 2010, Controlled Unclassified Information

b. 32 CFR 2002, Controlled Unclassified Information (Implementing Directive)

c. The Federal CUI Registry

d. Departmental standards

D. Requirements

a. The contractor must manage CUI in accordance with applicable laws, regulations, executive orders, and policies.

b. The Contractor must identify and safeguard controlled information from unauthorized release into public domain, or to unauthorized persons, organizations, or subcontractors.

c. The Contractor or subcontractor must not disclose or release the materials provided to the Contractor to any individuals of the Contractor's organization not directly engaged in providing services under the contract or that do not have a valid need-to-know. All technical data provided to the Contractor by the Government must be protected from public or private disclosure in accordance with the markings printed on them.

d. The Contractor must not release to anyone outside the Contractor’s organization any sensitive information unless the CO has given prior written approval. This includes, but is not limited to, news releases, marketing promotions, articles, interviews, reports, social media posts, and any other media releases. Requests for approval must identify the specific information to be released, the medium to be used, the purpose for the release, and a description of the need-to-know. The Contractor must submit its request to the CO at minimum ten business days before the proposed date for release. Subcontractors must submit requests for authorization to release through the prime Contractor to the CO.

e. Contractor controlled computer systems housing CUI must follow the NIST Special Publications: SP 800-171 Rev. 2 (or current Rev); SP 800-171A; and, SP 800-172 (or current Rev).

f. If the contractor believes that CUI information has been compromised, they will follow the incident response procedures in the DOI Incident Response Policy and Plan.

E. Training

Individuals originating or working with sensitive information must complete CUI training to become an authorized holder. CUI must only be disseminated to authorized holders in the furtherance of a lawful government purpose.

Section 8.0 – Paperwork Reduction Act of 1995 If a portion of the contract seeks information from ten or more members of the public, the contactor will work with the Bureau Information Collection Clearance Officer to obtain a Paperwork Reduction Act clearance from the Office of Management and Budget (OMB).

Section 9.0 – Reference Documents

All DOI-specific documents referenced in this document necessary for Contractor review and reference can be provided by the CO/COR.

Section 10.0 – Glossary

Please refer to the NIST online glossary at: https://csrc.nist.gov/glossary https://csrc.nist.gov/glossary