DD1423_A024Draft_E-9ATMRS.pdf

DD FORM 1423-1, FEB 2001

CONTRACT DATA REQUIREMENTS LIST

(1 Data Item)

PREVIOUS EDITION MAY BE USED.

Form Approved OMB No. 0704-0188

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the Government Issuing Contracting Officer for the Contract/PR No. listed in Block E.

A. CONTRACT LINE ITEM NO. B. EXHIBIT C. CATEGORY:

TDP ________ TM _______ OTHER

D. SYSTEM/ITEM E. CONTRACT/PR NO. F. CONTRACTOR

1. DATA ITEM NO. 2. TITLE OF DATA ITEM 3. SUBTITLE

4. AUTHORITY (Data Acquisition Document No.) 5. CONTRACT REFERENCE 6. REQUIRING OFFICE

7. DD 250 REQ

8. APP CODE

9. DIST STATEMENT

REQUIRED

10. FREQUENCY

11. AS OF DATE

12. DATE OF FIRST SUBMISSION

13. DATE OF SUBSEQUENT

SUBMISSION

14. DISTRIBUTION

a. ADDRESSEE

b. COPIES

Draft Final

Reg Repro

15. TOTAL

16. REMARKS

17. PRICE GROUP

18. ESTIMATED

TOTAL PRICE

G. PREPARED BY H. DATE I. APPROVED BY J. DATE

Page of Pages

CONTRACT DATA REQUIREMENTS LIST

(1 Data Item)

A. CONTRACT LINE ITEM NO. B. EXHIBIT C. CATEGORY:

TDP ________ TM _______ OTHER

D. SYSTEM/ITEM E. CONTRACT/PR NO. F. CONTRACTOR

16. REMARKS (Continued)

DD FORM 1423-1, FEB 2001 Page of Pages

INSTRUCTIONS FOR COMPLETING DD FORM 1423

(See DoD 5010.12-M for detailed instructions.)

FOR GOVERNMENT PERSONNEL

Item A. Self-explanatory.

Item B. Self-explanatory.

Item C. Mark (X) appropriate category: TDP - Technical Data Package;

TM - Technical Manual; Other - other category of data, such as "Provisioning,""Configuration Management," etc.

Item D. Enter name of system/item being acquired that data will support.

Item E. Self-explanatory (to be filled in after contract award).

Item F. Self-explanatory (to be filled in after contract award).

Item G. Signature of preparer of CDRL.

Item H. Date CDRL was prepared.

Item I. Signature of CDRL approval authority.

Item J. Date CDRL was approved.

Item 1. See DoD FAR Supplement Subpart 4.71 for proper numbering.

Item 2. Enter title as it appears on data acquisition document cited in Item 4.

Item 3. Enter subtitle of data item for further definition of data item (optional entry).

Item 4. Enter Data Item Description (DID) number, military specification number, or military standard number listed in DoD 5010.12-L (AMSDL), or one-time DID number, that defines data content and format requirements.

Item 5. Enter reference to tasking in contract that generates requirement for the data item (e.g., Statement of Work paragraph number).

Item 6. Enter technical office responsible for ensuring adequacy of the data item.

Item 7. Specify requirement for inspection/acceptance of the data item by the Government.

Item 8. Specify requirement for approval of a draft before preparation of the final data item.

Item 9. For technical data, specify requirement for contractor to mark the appropriate distribution statement on the data (ref. DoDD 5230.24).

Item 10. Specify number of times data items are to be delivered.

Item 11. Specify as-of date of data item, when applicable.

Item 12. Specify when first submittal is required.

Item 13. Specify when subsequent submittals are required, when applicable.

Item 14. Enter addressees and number of draft/final copies to be delivered to each addressee. Explain reproducible copies in Item 16.

Item 15. Enter total number of draft/final copies to be delivered.

Item 16. Use for additional/clarifying information for Items 1 through 15.

Examples are: Tailoring of documents cited in Item 4; Clarification of submittal dates in Items 12 and 13; Explanation of reproducible copies in Item 14.; Desired medium for delivery of the data item.

FOR THE CONTRACTOR

Item 17. Specify appropriate price group from one of the following groups of effort in developing estimated prices for each data item listed on the DD Form 1423.

a. Group I. Definition - Data which is not otherwise essential to the contractor's performance of the primary contracted effort (production, development, testing, and administration) but which is required by DD Form 1423.

Estimated Price - Costs to be included under Group I are those applicable to preparing and assembling the data item in conformance with Government requirements, and the administration and other expenses related to reproducing and delivering such data items to the Government.

b. Group II. Definition - Data which is essential to the performance of the primary contracted effort but the contractor is required to perform additional work to conform to Government requirements with regard to depth of content, format, frequency of submittal, preparation, control, or quality of the data item.

Estimated Price - Costs to be included under Group II are those incurred over and above the cost of the essential data item without conforming to Government requirements, and the administrative and other expenses related to reproducing and delivering such data item to the Government.

c. Group III. Definition - Data which the contractor must develop for his internal use in performance of the primary contracted effort and does not require any substantial change to conform to Government requirements with regard to depth of content, format, frequency of submittal, preparation, control, and quality of the data item.

Estimated Price - Costs to be included under Group III are the administrative and other expenses related to reproducing and delivering such data item to the Government.

d. Group IV. Definition - Data which is developed by the contractor as part of his normal operating procedures and his effort in supplying these data to the Government is minimal.

Estimated Price - Group IV items should normally be shown on the DD Form 1423 at no cost.

Item 18. For each data item, enter an amount equal to that portion of the total price which is estimated to be attributable to the production or development for the Government of that item of data.

These estimated data prices shall be developed only from those costs which will be incurred as a direct result of the requirement to supply the data, over and above those costs which would otherwise be incurred in performance of the contract if no data were required. The estimated data prices shall not include any amount for rights in data. The Government's right to use the data shall be governed by the pertinent provisions of the contract.

DD FORM 1423-1 (BACK), FEB 2001

<SYSTEM NAME> Cybersecurity Impact Evaluation Recommendation

1. SYSTEM/MISSION DESCRIPTION: The <SYSTEM NAME> is an Aircraft Weapon System Platform with embedded Information Technology (IT) that performs special purpose missions <DESCRIBE UNIQUE MISSION/DEPLOYMENT>. The modifications to the <SYSTEM NAME> have been assessed by the Information System Security Manager (ISSM) for impact to the platform’s Cybersecurity posture. Modifications which have a negative impact to the Cybersecurity posture require a complete technical assessment of the impact and risk to the <SYSTEM NAME> mission and system prior to operational deployment. Modifications assessed as not having a negative impact to the systems Cybersecurity posture will be technically validated and approved by the Security Control Assessor (SCA).

2. PROJECT NAME: Cybersecurity risk has been assessed for the <SYSTEM MODIFICATION NAME> modification to the <SYSTEM NAME>: <DESCRIBE SYSTEM MODIFICATION, CAPABILITIES, PROPOSED DEPLOYMENT, AND MISSION

IMPACTS>.

DATA FLOW: The <SYSTEM MODIFICATION NAME> modification to the <SYSTEM NAME> has the following data flows:

<DESCRIBE DATA FLOWS INCLUDING:

SOURCE/DESTINATION/DATA TYPE/PURPOSE/INTERFACE/DIRECTION/CLASSIFICATION/PROTECTION MECHANISMS>.

3. CYBERSECURITY VALIDATION APPROACH: A system description and technical evaluation of the operational employment for the <SYSTEM MODIFICATION NAME> has been developed and appended to the current Platform IT (PIT) Architecture Analysis Report attached. It presents a <QUANTIFY RISK LEVEL: VERY LOW, LOW, MODERATE, HIGH, VERY HIGH> risk to the <SYSTEM NAME>. This risk assessment is based on the following: < CYBERSECURITY RISK IMPACT STATEMENT &

SUMMARIZE JUSTIFICATION FOR RISK IMPACT ASSESSMENT>.

CYBERSECURITY IMPACTS

DoDI 8500.01 and AFI 17-101 PLATFORM IT FUNCTIONS IMPACTED BY MODIFICATION:

Data Transfers: This Modification updates, deletes, or adds to existing PIT data transfers or data paths Bus Connection: This Modification updates, adds, and/or deletes bus connections (e.g. 1760, 429, 1553, ...)

Software/Hardware: This Modification updates, adds, or deletes existing PIT SW/HW Antennas: This Modification updates, adds, or deletes connections to communications infrastructure/antennas Connections: This Modification establishes new, or alters existing PIT data connections Air-Gap: This Modification alters air-gap data flows or configuration, or establishes a direct network connection Instruments: This Modification updates, adds, or deletes connections to PIT systems instruments Flight Controls: This Modification updates, adds, or deletes connections to PIT system Flight Controls Mission Systems: This Modification updates, adds, or deletes connections to the Mission Systems Crew Systems: This Modification updates, adds, or deletes connections to the Crew Systems Diagnostic Systems: This Modification is a Diagnostic System or connects to a Diagnostic System Avionics: This Modification updates, adds, or deletes connections to, and interacts with the Avionics Electrical Power: This Modification updates, adds, or deletes connections to the Aircraft Electrical Power System Computer Resources: This Modification connects to computer resources external to the PIT Boundary Maintenance: This Modification requires an update to SSP and CONOPS, describing how the modification shall be installed, removed, and/or operated in an approved manner.

Classification of Data: The Modification includes Classified Data.

Mission Equipment: This Modification is PIT specific Mission Support Equipment.

This system change impacts cybersecurity risk and requires a new authorization prior to fielding (IATT/ATO): YES

NO

Current PIT Authorization and Date: <IDENTIFY CURRENT AUTHORIZATION AND DATE> Authorization Termination Date: <IDENTIFY AUTHORIZATION END DATE>

*Include this Modification in documentation for the next authorization decision review as an update to the system baseline*

CYBERSECURITY INFORMATION

SYSTEM SECURITY MANAGER

(ISSM)

ORGANIZATION

PHONE

SIGNATURE/DATE

CHIEF ENGINEER (APPROVE)

SECURITY CONTROL ASSESSOR

(SCA) (APPROVE)

CUI (When document is filled in and classified, apply appropriate classification markings) (If required, add appropriate distribution statement; an example Distribution D statement is below.) DISTRIBUTION D. Distribution authorized to Department of Defense and U.S. DoD contractors only; Vulnerability Information; <date of determination>. Other request for this document shall be referred to <Office Symbol and complete

3. Clarification:

The Contractor shall perform administrative support for the technical tasking of the program’s Authority To Operate (ATO) requirements. The Contractor shall use Government-furnished data to provide various technical administrative services including, but not limited to, Contractor personnel and visitor badging; coordinate and schedule team meetings ; coordinate and schedule telecons and VTCs; coordinate lab/facility access; and track and update team action items as requested.

Each paragraph includes a description of the expected content associated with that particular paragraph. The contractor shall pay close attention to this analysis UNCLASSIFIED and mark the deliverable in accordance with the security marking requirements of the contract.

3(b)/3(c) Clarification:

Executive Summary: Contractor shall summarize and include purpose for study, team members and their roles, scope, and time frame. Also include considerations, difficulties, compromises, or assumptions significantly impacting output of assessment. Include high-level discussion with recommendations and mitigation strategies. Ensure portion markings are maintained, especially if UNCLASSIFIED subset of Executive Summary is needed for communications. ES should not be longer than two pages in length.

Summary: Contractor shall provide summary of impacts to design and inclusion of controls that determine “information risk” affecting the confidentiality, integrity, and availability of systems and data:

• The existence and operational state of reasonably-expected cybersecurity controls

• The overall maturity of the IT security program that focuses on the current capabilities of people, processes, and technologies relied upon to protect the system and its data.

Conclusion: Contractor shall determine and state potential downloads for modification solution that would be software/firmware changes accomplished in the same way as current software/firmware changes are currently executed.

Appendix A – References

Appendix B - Acronym List

BLOCK 10, 12 & 13: Contractor shall submit Draft 30 calendar days prior to PDR, Final 30 calendar days prior to CDR. Contractor shall document and submit revisions as required.

BLOCK 14: Contractor shall submit electronically.

The Contractor shall deliver the document marked in accordance with (IAW) applicable Defense Acquisition Regulation Supplements (DFARS) clauses of the contract. The USG reserves the right to review, rebut, and make a determination regarding the validity of Contractor’s assertions.