Draft Special H Clause - Joint Cyber Information Tracking System.docx

Joint Cyber Information Tracking System (JCITS):

1. Upon contract signature and every six months, contractor shall provide network forward facing internet protocol (IP) touch points and domains (public domain) to the DSS Cyber Division through the program office. All IP addresses that may, either actively or passively, support program-related traffic should be reported.

2. The contractor shall report any and all cyber threat activity (e.g., cyber intrusions, data exfiltration, denial of service events, and other cyber-attacks) to both unclassified systems (networks, facilities, hardware or software) or classified systems. Cyber threat activity includes any extraction, copying or destruction or any other compromise of data; information that may define the network, defenses, vulnerabilities, users, functions, and resident information, e.g. scanning, reconnaissance or probing; denial of service or other cyber-attacks. Reportable information extends to tools, means, methods and enabling factors, such as malicious emails, websites, Cloud or internet service or security providers. The contractor shall deliver all available information related to cyber incidents to the DCSA and AF OSI local counterintelligence agents within 24 hours of a cyber incident. The specific data or information affected must be reported within 8 business days to the program office.

3. The contractor shall report insider cyber threat activity under NISPOM 1-301 or NISPOM 1-302, and otherwise as the insider threat program may require.

4. Contractors shall ensure all subcontractors, down to the fourth tier, are subject to the same contractual requirements listed in 1-3 above.