Attachment 2 Section K Addendum.pdf

Attachment 2 Section K – Addendum

252.204-7019 NOTICE OF NIST SP 800-171 DOD ASSESSMENT REQUIREMENTS (NOV

2020)

(a) Definitions.

“Basic Assessment”, “Medium Assessment”, and “High Assessment” have the meaning given in the clause 252.204-7020, NIST SP 800-171 DoD Assessments.

“Covered contractor information system” has the meaning given in the clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, of this solicitation.

(b) Requirement. In order to be considered for award, if the Offeror is required to implement

NIST SP 800-171, the Offeror shall have a current assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) (see 252.204-7020) for each covered contractor information system that is relevant to the offer, contract, task order, or delivery order. The Basic, Medium, and High NIST SP 800-171 DoD Assessments are described in the NIST SP 800-171 DoD Assessment Methodology located at https://www.acq.osd.mil/dpap/pdi/cyber/strategically_assessing_contractor_implementation_of_NIST _SP_800-171.html.

(c) Procedures.

(1) The Offeror shall verify that summary level scores of a current NIST SP 800-171 DoD Assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) are posted in the Supplier Performance Risk System (SPRS) (https://www.sprs.csd.disa.mil/) for all covered contractor information systems relevant to the offer.

(2) If the Offeror does not have summary level scores of a current NIST SP 800-171 DoD

Assessment (i.e., not more than 3 years old unless a lesser time is specified in the solicitation) posted in SPRS, the Offeror may conduct and submit a Basic Assessment to webptsmh@navy.mil for posting to SPRS in the format identified in paragraph (d) of this provision.

(d) Summary level scores. Summary level scores for all assessments will be posted 30 days post-assessment in SPRS to provide DoD Components visibility into the summary level scores of strategic assessments.

(1) Basic Assessments. An Offeror may follow the procedures in paragraph (c)(2) of this provision for posting Basic Assessments to SPRS.

(i) The email shall include the following information:

(A) Cybersecurity standard assessed (e.g., NIST SP 800-171 Rev 1).

(B) Organization conducting the assessment (e.g., Contractor self-assessment).

(C) For each system security plan (security requirement 3.12.4) supporting the performance of a DoD contract—

(1) All industry Commercial and Government Entity (CAGE) code(s) associated with the information system(s) addressed by the system security plan; and

(2) A brief description of the system security plan architecture, if more than http://www.acq.osd.mil/dpap/pdi/cyber/strategically_assessing_contractor_implementation_of_NIST http://www.sprs.csd.disa.mil/) mailto:webptsmh@navy.mil one plan exists.

requirement).

(D) Date the assessment was completed.

(E) Summary level score (e.g., 95 out of 110, NOT the individual value for each

(F) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on information gathered from associated plan(s) of action developed in accordance with NIST SP 800-171.

(ii) If multiple system security plans are addressed in the email described at paragraph

(d)(1)(i) of this section, the Offeror shall use the following format for the report:

System Security Plan CAGE Codes supported by this plan

Brief description of the plan architecture

Date of assessment

Total Score

Date score of 110 will achieved

(2) Medium and High Assessments. DoD will post the following Medium and/or High

Assessment summary level scores to SPRS for each system assessed:

(i) The standard assessed (e.g., NIST SP 800-171 Rev 1).

(ii) Organization conducting the assessment, e.g., DCMA, or a specific organization (identified by Department of Defense Activity Address Code (DoDAAC)).

(iii) All industry CAGE code(s) associated with the information system(s) addressed by the system security plan.

(iv) A brief description of the system security plan architecture, if more than one system security plan exists.

(v) Date and level of the assessment, i.e., medium or high.

(vi) Summary level score (e.g., 105 out of 110, not the individual value assigned for each requirement).

(vii) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on information gathered from associated plan(s) of action developed in accordance with NIST SP 800-171.

(3) Accessibility.

(i) Assessment summary level scores posted in SPRS are available to DoD personnel, and are protected, in accordance with the standards set forth in DoD Instruction 5000.79, Defense-wide Sharing and Use of Supplier and Product Performance Information (PI).

(ii) Authorized representatives of the Offeror for which the assessment was conducted may access SPRS to view their own summary level scores, in accordance with the SPRS Software User’s Guide for Awardees/Contractors available at https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf.

http://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf

(iii) A High NIST SP 800-171 DoD Assessment may result in documentation in addition to that listed in this section. DoD will retain and protect any such documentation as “Controlled Unclassified Information (CUI)” and intended for internal DoD use only. The information will be protected against unauthorized use and release, including through the exercise of applicable exemptions under the Freedom of Information Act (e.g., Exemption 4 covers trade secrets and commercial or financial information obtained from a contractor that is privileged or confidential).

252.225-7974 Representation Regarding Business Operations with the Maduro Regime.

(Deviation 2020-O0005)

Use the following provision in all solicitations, including solicitations using FAR part 12 procedures for the acquisition of commercial items, unless the solicitation is—

(a) Jointly determined by the Secretary of Defense and the Secretary of State to be—

(1) Necessary for purposes of—

(i) Providing humanitarian assistance to the people of Venezuela;

(ii) Disaster relief and other urgent lifesaving measures; or

(iii) Carrying out noncombatant evacuations; or

(2) Vital to the national security interests of the United States; or

(b) Related to the operation and maintenance of the United States Government’s consular offices and diplomatic posts in Venezuela.

REPRESENTATION REGARDING BUSINESS OPERATIONS WITH THE

MADURO REGIME (DEVIATION 2020-O0005) (FEB 2020)

(a) Definitions. As used in this provision—

“Agency or instrumentality of the government of Venezuela” means an agency or instrumentality of a foreign state as defined in section 28 U.S.C. 1603(b), with each reference in such section to

“a foreign state” deemed to be a reference to “Venezuela.”

“Business operations” means engaging in commerce in any form, including acquiring, developing, maintaining, owning, selling, possessing, leasing, or operating equipment, facilities, personnel, products, services, personal property, real property, or any other apparatus of business or commerce.

“Government of Venezuela” means the government of any political subdivision of Venezuela, and any agency or instrumentality of the government of Venezuela.

“Person” means—

(1) A natural person, corporation, company, business association, partnership, society, trust, or any other nongovernmental entity, organization, or group;

(2) Any governmental entity or instrumentality of a government, including a multilateral development institution (as defined in section 1701(c)(3) of the International Financial

Institutions Act (22 U.S.C. 262r(c)(3)); and

(3) Any successor, subunit, parent entity, or subsidiary of, or any entity under common ownership or control with, any entity described in paragraphs (1) or (2) of this definition.

(b) Prohibition. In accordance with section 890 of the National Defense Authorization

Act for Fiscal Year 2020 (Pub. L. 116-92), contracting officers are prohibited from entering into a contract for the procurement of products or services with any person that has business operations with an authority of the government of Venezuela that is not recognized as the legitimate government of Venezuela by the United States Government, unless the person has a valid license to operate in Venezuela issued by the Office of Foreign Assets Control of the

Department of the Treasury.

(c) Representation. By submission of its offer, the Offeror represents that the

Offeror—

(1) Does not have any business operations with an authority of the Maduro regime or the government of Venezuela that is not recognized as the legitimate government of

Venezuela by the United States Government; or

(2) Has a valid license to operate in Venezuela issued by the Office of Foreign Assets

Control of the Department of the Treasury.

(End of provision)