Attachment 7 - Information Technology Systems Security -Prospective Offeror Non-Disclosure Agreement.pdf

CONTRACTOR NON-DISCLOSURE AGREEMENT (NDA)

Each contractor/subcontractor who may have access to non-public information under their contract must sign the form: Commitment to Protect Non-Public Information – Contractor Agreement1. The Agreement is on the next page.

Please be aware that separate Agreements are required for each contract.

For NIH contractors registered in the NIH Enterprise Directory (NED) system:

• The NDA is now included in the full and refresher version of the NIH Security Awareness courses.

• The NDA is also available for direct electronic acceptance from the menu within the Security and Privacy Awareness Training system.

• Note: NIH contractors who will not be receiving an Active Directory (network) account can also use the NDA form on the next page.

For NIH contractors who are NOT registered in the NED system:

• The NDA form on the following page shall be used.

• The printed copy of the form must be signed and submitted to your Project Officer prior to performing any work on the contract. Other copies are retained and/or submitted as stated in the Agreement.

Note: Contractors are no longer required to upload a copy of their Agreement into the Security Awareness Tracking System.

1 HHS Rules of Behavior: HHS-OCIO-OIS-2019-05-004 and HHS Security and Privacy Language for Information and Information Technology Procurements, Appendix C

COMMITMENT TO PROTECT NON-PUBLIC INFORMATION

Contractor Agreement

Access to non-public information may be required in the performance of my official duties, while working under the following contract or subcontract with the National Institutes of Health (NIH): Contract Number _________________________________ between ________________________________ and my employer ______________________________.

(NIH I/C Name or Component) (Contractor’s Company)

Should I have access to non-public information, I agree that I shall not release, publish, or disclose such information to unauthorized persons. I shall protect such information and will employ all reasonable efforts to maintain the confidentiality of such information. These efforts shall be no less than the degree of care employed by NIH to preserve and safeguard sensitive information.

I agree that I shall immediately notify the NIH IT Service Desk of any suspected or confirmed unauthorized disclosure and/or misuse of sensitive information.

[ 301-496-4357 (local), 866-319-4357 (toll free), 301-496-8294 (TTY) or http://itservicedesk.nih.gov].

I understand that there are laws and regulations which provide for criminal and/or civil penalties for improper disclosure, including but not limited to:

a) 18 U.S.C. 641 (Public Money, Property or Records)

b) 18 U.S.C. 1832 (Trade Secrets)

c) 18 U.S.C. 1905 (Disclosure of Confidential Information)

d) 5 U.S.C. 552a (Privacy Act)

I have read and understand the requirements stated above and agree to adhere to them for the duration of time I work under a contract or subcontract with NIH. I understand that violation of the agreement may subject me to criminal and civil penalties.

Select one of the two options for signing this form:

1) Digital Signature 2) Manual Signatures (requires Witness)

Insert Digital Signature Type or Print Your Name: _____________________________

Signature: _________________________________________

Date: ___________________

Type or Print Witness Name: __________________________

Signature: _________________________________________

Date: ___________________

Copies are to be retained by:

1) NIH IC Project Officer

2) Individual Contractor

3) Contractor’s Company (Division of Contract Management) System