B08-CDRL A002_POAMs_BECS SETA.pdf

G. PREPARED BY

CONTRACT DATA REQUIREMENTS LIST

(1 Data Item)

16. REMARKS

C. CATEGORY:

TDP ________ TM _______ OTHER

Form Approved OMB No. 0704-0188

15. TOTAL

A. CONTRACT LINE ITEM NO. B. EXHIBIT

D. SYSTEM/ITEM E. CONTRACT/PR NO. F. CONTRACTOR

1. DATA ITEM NO. 2. TITLE OF DATA ITEM 3. SUBTITLE

4. AUTHORITY (Data Acquisition Document No.) 5. CONTRACT REFERENCE 6. REQUIRING OFFICE

7. DD 250 REQ

8. APP CODE

9. STATEMENT

REQUIRED

10. FREQUENCY

11. AS OF DATE

12. DATE OF FIRST SUBMISSION

13. DATE OF SUBSEQUENT

SUBMISSION

14. DISTRIBUTION

a. ADDRESSEE

b. COPIES

Draft Final

Reg Repro

H. DATE J. DATEI. APPROVED BY

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0701-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please DO NOT RETURN your form to the above address. Send completed form to the Government Issuing Contracting Officer for the Contract/PR No. listed in Block E.

DIST

22202-4302.

17. PRICE GROUP

18. ESTIMATED

TOTAL PRICE

DD FORM 1423-1, FEB 2001 PREVIOUS EDITION MAY BE USED. Page of Pages

CONTRACT DATA REQUIREMENTS LIST

(1 Data Item)

A. CONTRACT LINE ITEM NO. B. EXHIBIT C. CATEGORY:

TDP ________ TM _______ OTHER

D. SYSTEM/ITEM E. CONTRACT/PR NO. F. CONTRACTOR

16. REMARKS (Continued)

DD FORM 1423-1, FEB 2001 Page of Pages

INSTRUCTIONS FOR COMPLETING DD FORM 1423

(See DoD 5010.12-M for detailed instructions.)

Item A. Self-explanatory.

Item B. Self-explanatory.

Item C. Mark (X) appropriate category: TDP - Technical Data Package;

TM - Technical Manual; Other - other category of data, such as "Provisioning,""Configuration Management," etc.

Item D. Enter name of system/item being acquired that data will support.

Item E. Self-explanatory (to be filled in after contract award).

Item F. Self-explanatory (to be filled in after contract award).

Item G. Signature of preparer of CDRL.

Item H. Date CDRL was prepared.

Item I. Signature of CDRL approval authority.

Item J. Date CDRL was approved.

Item 1. See DoD FAR Supplement Subpart 4.71 for proper numbering.

Item 2. Enter title as it appears on data acquisition document cited in Item 4.

Item 3. Enter subtitle of data item for further definition of data item (optional entry).

Item 4. Enter Data Item Description (DID) number, military specification number, or military standard number listed in DoD 5010.12-L (AMSDL), or one-time DID number, that defines data content and format requirements.

Item 5. Enter reference to tasking in contract that generates requirement for the data item (e.g., Statement of Work paragraph number).

Item 6. Enter technical office responsible for ensuring adequacy of the data item.

Item 7. Specify requirement for inspection/acceptance of the data item by the Government.

Item 8. Specify requirement for approval of a draft before preparation of the final data item.

Item 9. For technical data, specify requirement for contractor to mark the appropriate distribution statement on the data (ref. DoDD 5230.24).

Item 10. Specify number of times data items are to be delivered.

Item 11. Specify as-of date of data item, when applicable.

Item 12. Specify when first submittal is required.

Item 13. Specify when subsequent submittals are required, when applicable.

Item 14. Enter addressees and number of draft/final copies to be delivered to each addressee. Explain reproducible copies in Item 16.

Item 15. Enter total number of draft/final copies to be delivered.

Item 16. Use for additional/clarifying information for Items 1 through 15.

Examples are: Tailoring of documents cited in Item 4; Clarification of submittal dates in Items 12 and 13; Explanation of reproducible copies in Item 14.; Desired medium for delivery of the data item.

FOR GOVERNMENT PERSONNEL

Item 17. Specify appropriate price group from one of the following groups of effort in developing estimated prices for each data item listed on the DD Form 1423.

a. Group I. Definition - Data which is not otherwise essential to the contractor's performance of the primary contracted effort (production, development, testing, and administration) but which is required by DD Form 1423.

Estimated Price - Costs to be included under Group I are those applicable to preparing and assembling the data item in conformance with Government requirements, and the administration and other expenses related to reproducing and delivering such data items to the Government.

b. Group II. Definition - Data which is essential to the performance of the primary contracted effort but the contractor is required to perform additional work to conform to Government requirements with regard to depth of content, format, frequency of submittal, preparation, control, or quality of the data item.

Estimated Price - Costs to be included under Group II are those incurred over and above the cost of the essential data item without conforming to Government requirements, and the administrative and other expenses related to reproducing and delivering such data item to the Government.

c. Group III. Definition - Data which the contractor must develop for his internal use in performance of the primary contracted effort and does not require any substantial change to conform to Government requirements with regard to depth of content, format, frequency of submittal, preparation, control, and quality of the data item.

Estimated Price - Costs to be included under Group III are the administrative and other expenses related to reproducing and delivering such data item to the Government.

d. Group IV. Definition - Data which is developed by the contractor as part of his normal operating procedures and his effort in supplying these data to the Government is minimal.

Estimated Price - Group IV items should normally be shown on the DD Form 1423 at no cost.

Item 18. For each data item, enter an amount equal to that portion of the total price which is estimated to be attributable to the production or development for the Government of that item of data. These estimated data prices shall be developed only from those costs which will be incurred as a direct result of the requirement to supply the data, over and above those costs which would otherwise be incurred in performance of the contract if no data were required. The estimated data prices shall not include any amount for rights in data. The Government's right to use the data shall be governed by the pertinent provisions of the contract.

FOR THE CONTRACTOR

DD FORM 1423-1 (BACK), FEB 2001

Information Security (IS) Plan of Action & Milestones (POAM)

1. Format: The POA&M shall follow the enterprise Mission Assurance Support System (eMASS) System Level Microsoft Excel format.

2. Content: The POA&M shall include a network POA&M that contains the following:

2.1. POA&M Header

a) Date initiated

b) Date last updated

c) Component Name/ Information System Owner

d) Department of Defense (DoD) Information Technology (IT) registration number

e) System/Project Name

f) System Identification

g) IS Type/System Record Type

h) POC phone number

i) POC e-mail

j) Office of Management and Budget (OMB) Project Identification

k) Security Costs

2.2. Weakness. Weaknesses shall be specified consecutively and numerically. This section shall include the following:

a) Specific Security Weakness Identified via DoD tools or Information Assurance Control (IAC) Tests.

b) Security Actions and Administrative Actions (e.g., finish Systems Requirements Review (SRR) tests, and register system in Department of Defense Information Technology Portfolio Registration-Department of the Navy (DITPR-DON)) c) If not applicable, then Not Applicable (NA) shall be included

2.3. The severity Category (CAT). The severity CAT is the residual risk and shall be specified as CAT I, II, III. If not applicable, this shall be the original Defense Information Systems Agency (DISA) Severity and identified as “raw”.

2.4. Information Assurance Control (IAC) and Impact Code. This section shall include the following:

a) Information Assurance (IA) control assigned to the finding

b) Impact code assigned to the IA control. Note that the impact code shall not change.

2.5. POC. Identify Office/Organization responsible for resolving the security weakness.

Dis Statement Required:

"CUI"

Date of First Submission (Blocks 12 and 13):

1. The Contractor shall submit a draft electronic Architectural Modernization Plan 90 days after contract award.

2. The Contractor shall submit the final electronic Architectural Modernization Plan 120 days after contract award.

Block 14:

Draft and final copies will be provided via DoD-SAFE.

a) Date when the weakness is scheduled to be resolved. Status column shall identify completion date updates (e.g., Not Okay = TBD, FY10, 3Q, etc)

b) If risks are accepted by Office of the Designating Authority (ODAA), then NA shall be specified.

2.8. Milestones with Completion Date

a) Identify specific requirements to correct weaknesses

b) Column 8 (Milestone change) shall identify changes to any milestones

c) If risks are accepted by ODAA, then NA shall be specified.

2.9. Milestone Changes:

a) Updates to the milestones/Completion date shall be included

b) If risks are accepted by ODAA, then NA shall be specified.

2.10. Source Identifying Weakness:

a) This shall identify the source of the weakness (i.e., Security Test Implementation Guide (STIG), Security Checklists, Retina, gold disk, etc.)

b) This shall identify the weakness type.

c) Include weakness identification (i.e., STIG ID, Vulnerability Management System Identification (VMS ID), Audit ID, etc.).

2.11. Status:

a) Shall specify status as “ongoing”, “completed, or “risk accepted”, “not valid – pending”, “TBD”, etc.

b) Adequate explanation in the comments column shall be included. Completion date shall be included if status is “completed”.

c) “Risk accepted” status shall be identified only after the risk is accepted by the ODAA.

d) Date of acceptance shall be specified.

2.12. Comments:

a) Necessary information, justification and mitigation shall be included.

b) This shall also contain justification for NA IA controls.

DI-MGMT-82190 Section 2.6 is not applicable.

Dist Statement Required:

"CUI"

Block 9: Use the following "DISTRIBUTION STATEMENT D". Distribution is authorized of technical documents to DoD components and their contractors with a "need-to-know" only. (Reason: for Administrative or Operational purposes, to protect critical technology and technical data that would provide insight into the vulnerabilities of U.S. critical infrastructure, including warfighting capabilities vital to National Security that would otherwise not be publicly available.) Other requests shall be referred to those listed in Block 14. (Date: 18 MAR 26)

Blocks 10-13: The Contractor shall submit POA&Ms documenting identified vulnerabilities, planned remediation actions, and status updates. POA&Ms shall be provided for all systems undergoing Authorization to Operate (ATO) activities and whenever otherwise required by the Government.

Block 14: The Contractor shall deliver POA&Ms via DoD-SAFE.