Attachment J-17 IMCP Supplier Compliance Supplement 2.24.20.pdf

HQ0858-20-R-0014

Attachment J-17: IMCP Supplier Compliance Supplement

TEAMS-Next Solicitation HQ0858-20-R-0014

Section J, Attachment 17

TEAMS-Next Cybersecurity (IMCP) (CDRL A006)

IMCP Supplier Compliance Supplement

24 February 2020

Approved for Public Release 20-MDA-10578 (18 Sep 20)

As set forth in Statement of Work (SOW) (Attachment J-01) paragraph 6.0, “Cybersecurity

(IMCP CDRL A006)”, sub-section 6.4, see below for additional IMCP Supplier Compliance

Supplement requirements and template.

IMCP Supplier Compliance Supplement (Appendix B): If the Contractor has suppliers that receive or generate CUI in performance of the contract, the Contractor shall document and maintain on file an IMCP Supplier Compliance Supplement (Appendix B). The Supplement will contain the following:

a. List the Contractor’s direct customer (i.e. the Government or the Contractor’s next-level up Contractor), contract number, address and contract point of contact information.

b. List the Contractor’s first-tier suppliers that receive or generate CUI in performance of the contract. Company Name, DUNS, Address, Contract Number. If CUI is not passed to or generated by any next-tier supplier, follow instructions 1-6 in paragraph 4.i and state

NA in the “Supplier Name” field of the Supplier Compliance Supplement (Appendix B).

All other fields (instructions 7-11) of the Supplier Compliance Supplement (Appendix B) should remain blank.

c. Confirm Contractor has identified and flowed only CUI which is needed for their first-tier suppliers.

d. Confirm the DFARS 7012 clause is flowed to their first-tier suppliers.

e. Prime Contractor will include the IMCP Supplier Compliance Supplement (Appendix B) with delivery of CDRL A006 to its direct customer (i.e. the Government).

f. Non-Prime Contractors (within the extended supply chain) shall securely deliver the

IMCP Supplier Compliance Supplement (Appendix B) via encrypted email directly to the

Government COR within 60 days after their subcontract is awarded. The prime

Contractor will confirm with MDA when their 1st Tier Subcontracts are awarded.

g. All IMCP Supplier Compliance Supplements shall be updated semiannually at a minimum but no more than four (4) times per year.

h. Subcontractor information delivered under paragraph 4.e or 4.f shall be marked as

“Company Name – Proprietary” and will be protected accordingly.

i. Template Instructions:

Submitted by: Input Prime or Non-Prime Contractor submitting the IMCP

Compliance Supplement

Subcontracted by: State the Company Name, the submitting Non-Prime is supporting under this government contract. If the Prime Contractor to the government state “Prime Contractor” in this field

Purpose: Identify Non-Prime Contractors/Suppliers who collect, develop, receive, transmit, use or store CUI

Date: Date of submission

Supplier Name: List all suppliers that collect, develop, receive, transmit, use or store CUI in support of this contract

DUNS: Dun & Bradstreet number

Supplier Point of Contact: Name, email and phone number from each supplier.

Does the Subcontract contain DFARS 252.204-7012: Yes or No.

Has the supplier completed the Self-Assessment IAW NIST 800-171r: Yes or

No.

Does the supplier have a System Security Plan and Plan of Action and Milestones

IAW NIST 800-171r: Yes or No.

Appendix B: Template for Submission of IMCP Supplier Compliance Supplement Example

Submitted By:

Knight

Industries

Subcontracted

By:

Dynamic

Safety

Systems

Purpose:

Suppliers with CUI

Date: 6/6/2018

Government

Contract

Number

Supplier

Name

DUNS

Supplier POC (email and phone)

Subcontract contains

DFARS

252.204-

NIST 800-

171r1 Self-

Assessment complete

SSP &

POAM

Complete

HQ0147-17-D-

ABC

Corp 12345678 lisa.smith@abc.com

202-123-4567 Y Y Y

ArCCOM 78945612 jed.jones@arccom.net

234-567-8911 Y Y Y

Vartan

Inc. 45612378 tom.a.smith@vareng.com

753-519-4566 Y Y Y

Daniel

Armoring 15975312 alan.rogers@darmor.com

225-465-1788 Y Y N

Approved for Public Release 20-MDA-10578 (18 Sep 20) mailto:lisa.smith@abc.com mailto:jed.jones@arccom.net mailto:tom.a.smith@vareng.com mailto:alan.rogers@darmor.com

Flow Down to next-tier suppliers: The successful offeror (PRIME) shall flow down their accepted IMCP procedures and requirements, including the IMCP Supplement (Appendix B), to their next tier suppliers and require flow down iteratively to any next tier supplier.

The Government reserves the right to request, review and/or inspect the

Contractor/subcontractor IMCP (including all appendices) to verify implementation of the

Information Management and Control Plan and DFARS 7012. Further, the Government reserves the right to use the IMCPs to iteratively navigate through the tiered supply chain. A

Contractor will only have visibility to their next-tier supplier(s) IMCP’s – sections 3a-e.

Government reserves the right to request delivery of the SSP and POAM from the prime

Contractors and any applicable Non-Prime or subcontractors included in the supply chain. All delivered data provided as part of the IMCP will be handled and classified by the Government as source selection sensitive information and stored accordingly.