Attachment3_InformationSecurity.pdf

Attachment 3

1.1 INFORMATION SECURITY

The contractor will be provided Federal contract information1or Controlled defense information2 which includes but is not limited to Controlled unclassified information (CUI)3, Controlled technical information4, Contractor attributional/proprietary information5, etc. (hereinafter collectively called “CUI”) under this solicitation, contract, task order, or delivery order (hereinafter collectively referred to as “acquisition”).

According to FAR 52.204-21, DFARS 252.204-7012 and DoDI 5200.48 “Controlled Unclassified Information” (CUI) (06 March 2020) the contractor shall provide adequate security6 for all CUI residing on or passing through non-DoD information systems including all subcontractor information systems utilized in support of the acquisition. The contractor shall only disseminate CUI within the scope of assigned duties and with a clear expectation that confidentiality is preserved. In accordance with (IAW) SECNAVINST 5510.36B, DON Information Security Program (Jul 16, 2019) all Department of the Navy (DON) employees including contractors shall be personally and individually responsible for properly protecting classified information and CUI under their custody and control and shall ensure classified information and CUI are protected IAW the same and Volumes 1 thru 3 of DoDM 5200.01, DoD Information Security Program of 24 Feb 2012 (Incorporating Change 1, Effective May 9, 2018) and DoDI 5200.48.

1.1.2 Information Safeguarding Requirements

The contractor shall protect/safeguard CUI and shall provide compliance documentation validating they are meeting this requirement in accordance with DFARS 252.204-7012. Certain information provided by the government under this acquisition, requires unique handling, storage, marking, and/or release/dissemination procedures (see Addendum “A” CONTRACTOR OPSEC GUIDANCE” for specific details which is/are incorporated in full by reference herein). Contractor is cautioned to study Addendum “A” and comply accordingly.

1 In accordance with FAR 4.1901 “Federal contract information” means: information, not intended for public release, that is provide by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as on a public Web site) or simple transactional information, such as that necessary to process payments.

2 In accordance with DFARS 252.204-7012 “Covered defense information” means unclassified controlled technical information or other information, as described in the Controlled Unclassified Information (CUI) Registry at https://www.archives.gov/cui/registry/category-list, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies, and is—

(1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the performance of the contract; or

(2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.

3 In accordance with 32 CFR Part 2002 “Controlled Unclassified Information” means information the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Government-wide policy requires or permits an agency to handle using safeguarding or dissemination controls. However, CUI does not include classified information (see paragraph (e) of this section) or information a non-executive branch entity possesses and maintains in its own systems that did not come from, or was not created or possessed by or for, an executive branch agency or an entity acting for an agency.

4 In accordance with DFARS 252.204-7012 “Controlled technical information” means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information would meet the criteria, if disseminated, for distribution statements B through F using the criteria set forth in DoD Instruction 5230.24, Distribution Statements on Technical Documents. The term does not include information that is lawfully publicly available without restrictions.

5 In accordance with DFARS 252.204-7012 “Contractor attributional/proprietary information” means information that identifies the contractor(s), whether directly or indirectly, by the grouping of information that can be traced back to the contractor(s) (e.g., program description, facility locations), personally identifiable information, as well as trade secrets, commercial or financial information, or other commercially sensitive information that is not customarily shared outside of the company.

6 In accordance with DFARS 252.204-7012 “Adequate security” means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information.

The contractor shall track all “CUI” associated with its execution and performance under this acquisition. The contractor shall document, maintain, and provide the Government, a record of subcontractors, vendors, and/or suppliers who will receive or develop CUI who are associated with the execution and performance of this acquisition. Contractor shall restrict unnecessary sharing and/or flow down of CUI associated with execution and performance under this acquisition. Contractor shall restrict unnecessary sharing and/or flow down of CUI based on a ‘need-to-know’ to execute and perform the requirements under this acquisition. Contractor shall flow down the requirements specified in this section to its subcontractors, vendors, and/or suppliers.

All contractor and subcontractor personnel assigned to this acquisition, shall complete annually the Center for Development of Security Excellence (CDSE) “DoD CUI Mandatory Controlled Unclassified Information (“CUI) Training” located on the CDSE eLearning website at https://www.dodcui.mil, or similar Contracting Officer approved annual CUI training, no later than 30 September of each year. Contractors and their subcontractors will report to NAVFAC FE by 15 October each year the number of their employees assigned to the acquisition, who were trained, the number remaining to be trained, and the completion percentage. Failure to comply with the requirement for annual CUI training may result in termination of the acquisition and may be reported as non-compliant with NAVFAC CUI requirements. The point of contact (POC) for reporting annual CUI training under this acquisition is Rie Hanazato, via email, rie.hanazato.ja@fe.navy.mil, or the Contracting Officer if the POC is unavailable.

1.1.3 Disclosure of Information Requirements

In accordance with DFARS Clause 252.204-7000, Disclosure of information, contractor employees shall not discuss or disclose any information provided to them in the performance of their duties to parties other than authorized Government and/or Contractor personnel who have a "need to know." Contractor shall not use any information or documentation provided by the Government or developed under this acquisition, for other purposes without the consent of the Government Contracting Officer IAW DFARS 252.204-7000. Contractor shall not release to anyone outside the Contractor's organization any CUI, regardless of medium (e.g., film, tape, document, etc.), pertaining to any part of this acquisition, or any program related to the same, unless the Contracting Officer has given prior written approval IAW DFARS 252.204-7000. Markings: All deliverables/submittals generated by the Contractor under this acquisition shall be properly marked in accordance with DoDI 5200.48. Technical information7 and CTI shall also be marked with appropriate Distribution Statements and Export Control warnings in accordance with DoDD 5230.24, Distribution Statements on Technical Documents (Oct. 15, 2018) and program Security Classification Guidance.

1.1.4. Operations Security (OPSEC) Requirements

Information Security programs are usually oriented towards the protection of classified information and materials.

Operations Security (OPSEC) involves the protection of critical information focusing on unclassified information that may be susceptible to adversary exploitation. Pursuant to DoDD 5205.02E, Department of Defense Operations Security (OPSEC) Program (May 11, 2018), SECNAVINST 3070.2A, OPERATIONS SECURITY (9 May 2019), SECNAVINST 5510.36B, DON INFORMATION SECURITY PROGRAM (Jul 16 2019), and NAVFACFEINST 3432.1 (24 AUG 2017), NAVFAC FE's OPSEC program implements requirements in DoD 5205.02, DoD Operations Security (OPSEC) Program Manual (November 3, 2008, Incorporating Change 1, Effective April 26, 2018). OPSEC requirements are applicable when contractor personnel have access to or generate CUI as defined in DFARS 225.204-7012. As such, OPSEC Measures (i.e., the planned action to conceal or protect identified critical information and indicators from disclosure, observation, or detection and to protect

7 In accordance with DFARS 252.204-7012 “Technical information” means technical data or computer software, as those terms are defined in the clause at DFARS 252.227-7013 , Rights in Technical Data— Noncommercial Items, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.

the same from collection) are applicable to this acquisition. Contractor is cautioned to study Addendum “A” and comply accordingly.

All contractor and subcontractor personnel shall comply with NAVFACFEINST 3432.1 (24 AUG 2017).

NAVFACFEINST 3432.1 is available from the Contracting Office. All contractor and subcontractor personnel assigned to this acquisition, shall complete annually the Center for Development of Security Excellence (CDSE) “OPSEC Awareness for Military Members, DoD Employees and Contractors” located on the CDSE eLearning website at https://www.cdse.edu/toolkits/deliveruncompromised/index.html, or similar Contracting Officer approved annual OPSEC training, no later than 30 September of each year. Contractors and their subcontractors will report to NAVFAC FE by 15 October each year the number of their employees assigned to the acquisition, who were trained, the number remaining to be trained, and the completion percentage. Failure to comply with the requirement for annual OPSEC training may result in termination of the acquisition and may be reported as non-compliant with NAVFAC OPSEC requirements. The point of contact (POC) for reporting annual OPSEC training under this acquisition is Rie Hanazato, via email, rie.hanazato.ja@fe.navy.mil, or the Contracting Officer if the POC is unavailable.

Note: the following clauses have been incorporated in this acquisition - DFARS 252.204.7000 Disclosure of Information, 252.204-7008 Compliance with Safeguarding Covered Defense Information Controls, 252.204-7009 Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information, and 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting. DFARS Clause 252.204-7000 restricts the release of unclassified information outside contractor's organization without prior Contracting Officer permission, with exceptions; DFARS Clause 252.204-7008 requires contractor compliance with Safeguarding Covered Defense Information Controls; DFARS Clause 252.204-7009 limits the use or disclosure of contractor reported cyber incident information, and DFARS 252.204-7012 requires contractor to provide adequate security for all covered contractor information systems (including implementation of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” in effect at the acquisition is issued) and to comply with cyber incident reporting requirements.

1.1.5. Violations of the Information Security Requirement

A knowing, willful, or negligent failure to comply with the above-referenced Information Security requirements may result in criminal penalties under applicable Federal law, as well as administrative remedies including but not limited to termination of the acquisition.