Deviation Cybersecurity and NIST.pdf

Deviation Request

CONTROLLED UNCLASSIFIED INFORMATION (CUI)CONTROLLED UNCLASSIFIED INFORMATION (CUI)

April 2024 CONTROLLED UNCLASSIFIED INFORMATION (CUI) Page 3 of 5April 2024 CONTROLLED UNCLASSIFIED INFORMATION (CUI) Page 3 of 5

DFARS 252.204-7012 SAFEGUARDING COVERED DEFENSE INFORMATION AND CYBER INCIDENT REPORTING - Alternate I (AUG 2025) (DEVIATION 2025-WR001). If the requirement is related to a UK company within scope of the UK MOD ISN Number 2021/03, substitute the following paragraphs (e), (f), and (g) for paragraphs (e), (f), and (g) of the basic clause:

(e) Media preservation and protection. When a Contractor discovers a cyber incident has occurred, the Contractor shall preserve and protect images of all known affected information systems identified in paragraph (c)(1)(i) of this clause and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to --

(1) Allow DoD to request the media or decline interest; or

(2) For any United Kingdom (UK) company within scope of the UK MOD ISN Number 2021/03, allow the national/ designated security authority for the UK to coordinate with the DC3 so that the DC3 may request the national/designated security authority to provide information obtained from the media related to covered defense information provided by or developed for DoD that may have been compromised or to decline interest.

(f) Access to additional information or equipment necessary for forensic analysis. Upon request by DoD, the Contractor shall provide DoD with access to additional information or equipment that is necessary to conduct a forensic analysis, unless the Contractor is a UK company within scope of the UK MOD ISN Number 2021/03.

(g) Cyber incident damage assessment activities. If DoD elects to conduct a damage assessment, the Contracting Officer will request that the Contractor --

(1) Provide all of the damage assessment information gathered in accordance with paragraph (e) of this clause; or

(2) If the Contractor is a UK company within scope of the UK MOD ISN Number 2021/03, assist in the damage assessment by

(i) Carrying out its own internal damage assessment of information gathered in accordance with paragraph (e) of this clause; and

(ii) Providing the Contracting Officer with an assessment of the covered defense information that has been compromised.

DFARS 252.204-7020 NIST SP 800-171 DOD ASSESSMENT REQUIREMENTS - Alternate I (AUG 2025) (DEVIATION 2025-WR001). If the requirement is related to a UK company within scope of the UK MOD ISN Number 2021/03, substitute the following paragraphs (c), (d), and (g)(2) for paragraphs (c), (d), and (g)(2) of the basic clause:

(c) Requirements. The Contractor, excluding any UK company within scope of the UK MOD ISN Number 2021/03, shall provide access to its facilities, systems, and personnel necessary for the Government to conduct a Medium or High NIST SP 800-171 DoD Assessment, as described in NIST SP 800-171 DoD Assessment Methodology at https://www.acq.osd.mil/asda/dpc/cp/cyber/ docs/safeguarding/NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf, if necessary.

(d) Procedures. Excluding any UK company within scope of the UK MOD ISN Number 2021/03, summary level scores for all assessments will be posted in the Supplier Performance Risk System (SPRS) (https://www.sprs.csd.disa.mil/) to provide DoD Components visibility into the summary level scores of strategic assessments.

(g) Subcontracts.

(2) Excluding any subcontract or other contractual instrument with a UK company within scope of the UK MOD ISN Number 2021/03, the Contractor shall not award a subcontract or other contractual instrument, that is subject to the implementation of NIST SP 800-171 security requirements, in accordance with DFARS clause 252.204-7012 of this contract, unless the subcontractor has completed, within the last 3 years, at least a Basic NIST SP 800-171 DoD Assessment, as described in https:// www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171-Assessment-Methodology- Version-1.2.1-6.24.2020.pdf, for all covered contractor information systems relevant to its offer that are not part of an information technology service or system operated on behalf of the Government.