Attachment J-17 IMCP Supplier Compliance Supplemnt (Intel)_5.14.20_.pdf

HQ0858-20-R-0007

Attachment J-17: IMCP Supplier Compliance Supplement

TEAMS-Next Solicitation HQ0858-20-R-0007

Section J, Attachment 17

TEAMS-Next

Intelligence and Counter-Insider Threat

(IMCP) (CDRL A006)

IMCP Supplier Compliance Supplement

14 May 2020

Approved for Public Release 20-MDA-10554 (18 Aug 20)

As set forth in Statement of Work (SOW) (Attachment J-01) paragraph 6.0, “Cybersecurity

(IMCP CDRL A006)”, sub-section 6.4, see below for additional IMCP Supplier Compliance

Supplement requirements and template.

IMCP Supplier Compliance Supplement (Appendix B): If the contractor has suppliers that receive or generate CUI in performance of the contract, the contractor shall document and maintain on file an IMCP Supplier Compliance Supplement (Appendix B). The Supplement will contain the following:

a. List the contractor’s direct customer (i.e., the Government or the contractor’s next level up contractor), contract number, address and contract point of contact information.

b. List the contractor’s first-tier suppliers that receive or generate CUI in performance of the contract. Company Name, Data Universal Numbering System (DUNS), Address, Contract

Number. If CUI is not passed to or generated by any next-tier supplier, follow instructions 1-

6 in paragraph 4.i and state NA in the “Supplier Name” field of the Supplier Compliance

Supplement (Appendix B). All other fields (instructions 7-11) of the Supplier Compliance

Supplement (Appendix B) should remain blank.

c. Confirm contractor has identified and flowed only CUI, which is needed for their first-tier suppliers.

d. Confirm the DFARS 7012 clause is flowed to their first-tier suppliers.

e. Prime contractor will include the IMCP Supplier Compliance Supplement (Table 6.0) with delivery of CDRL A006 to its direct customer (i.e., the Government).

f. Non-prime contractors (within the extended supply chain) shall securely deliver the IMCP Supplier Compliance Supplement (Appendix B) via encrypted email or secure file transfer site at XXXXX@mail.com or https://XXXXX.mil directly to the Government within X business days after their subcontract is awarded. The prime contractor will confirm with

MDA when their 1st Tier Subcontracts are awarded.

g. All IMCP Supplier Compliance Supplements shall be updated semiannually at a minimum, but no more than four (4) times per year.

h. Subcontractor information delivered under paragraph 4.e or 4.f shall be marked as

“Company Name – Proprietary” and will be protected accordingly.

i. Template Instructions:

Submitted by: Input prime or non-prime contractor submitting the IMCP Compliance

Supplement

Subcontracted by: State the Company Name, the submitting non-prime is supporting under this Government contract. If the prime contractor to the Government state “prime contractor” in this field.

Approved for Public Release 20-MDA-10554 (18 Aug 20) mailto:XXXXX@mail.com https://xxxxx.mil/

Purpose: Identify non-prime contractors/suppliers who collect, develop, receive, transmit, use or store CUI

Date: Date of submission

Government Contract Number: List the Government Contract number the contractor is supporting.

Supplier Name: List all suppliers that collect, develop, receive, transmit, use or store

CUI in support of this contract.

DUNS: DUN & Bradstreet number

Supplier Point of Contact: Name, email and phone number from each supplier.

Does the Subcontract contain DFARS 252.204-7012: Yes or No.

Has the supplier completed the Self-Assessment IAW NIST 800-171r: Yes or No.

Does the supplier have a System Security Plan and Plan of Action and Milestones

IAW NIST 800-171r: Yes or No.

Table 6.0 – Appendix B: Template for Submission of IMCP Supplier Compliance

Supplement Submitted By: Knight Industries Subcontracted by: Dynamic Safety Systems Purpose: Suppliers with CUI Date: 6/6/2018

Government

Contract Number Supplier

Name

DUNS Supplier POC (e-mail and phone)

Subcontract contains

DFARS

252.204-

NIST 800-

171r1 Self-

Assessment

Complete

SSP &

POA&M

Complete

HQ0147-17-D-

ABC

Corp

12345678 lisa.smith@abc.com 202-

123-4567 Y Y Y

ArCCOM 78945612 jed.jones@arccom.net

234-567-8911 Y Y Y Vartan

Inc.

45612378 tom.a.smith@vareng.com

753-519-4566 Y Y Y Daniel

Armoring 15975312 alan.rogers@darmor.com

225-465-1788 Y Y N

Flow Down to next-tier suppliers: The successful offeror (prime) shall flow down their accepted IMCP procedures and requirements, including the IMCP Supplement (Appendix B), to their next tier suppliers and require flow down iteratively to any next tier supplier.

The Government reserves the right to request, review and/or inspect the contractor/ subcontractor IMCP (including all appendices) to verify implementation of the Information

Management and Control Plan and DFARS 7012. Further, the Government reserves the right to use the IMCPs to iteratively navigate through the tiered supply chain. A contractor will only have visibility to their next-tier supplier(s) IMCP’s – sections 3a-e. The Government reserves the right to request delivery of the SSP and POA&M from the prime contractor and any applicable non-prime or subcontractors included in the supply chain. All delivered data provided as part of the IMCP will be handled and classified by the Government as source selection sensitive information and stored accordingly.

Approved for Public Release 20-MDA-10554 (18 Aug 20) mailto:lisa.smith@abc.com mailto:jed.jones@arccom.net mailto:tom.a.smith@vareng.com mailto:alan.rogers@darmor.com