CDRL_A002_Cyper_Security_and_DID.pdf

CONTRACT DATA REQUIREMENTS LIST

(1 Data Item)

Form Approved OMB No. 0704-0188

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the Government Issuing Contracting Officer for the Contract/PR No. listed in Block E.

A. CONTRACT LINE ITEM NO. B. EXHIBIT C. CATEGORY:

TDP TM OTHER __X__

D. SYSTEM/ITEM E. CONTRACT/PR NO. F. CONTRACTOR

1. DATA ITEM NO. 2. TITLE OF DATA ITEM 3. SUBTITLE

4. AUTHORITY (Data Acquisition Document No.)

DI-MGMT-82002A

5. CONTRACT REFERENCE

PD para 3.1 H

6. REQUIRING OFFICE

402 CMXG/MXDBE

7. DD 250 REQ

NO

9. DIST

STATEMENT

REQUIRED

A

10. FREQUENCY

ONE/R

12. DATE OF 1ST SUBMISSION

SEE BLK 16

14. DISTRIBUTION

a. ADDRESSEE

b. COPIES

8. APP CODE

N/A

11. AS OF DATE

SEE BLK 16

13. DATE OF SUBSEQUENT

SUBMISSION

SEE BLK 16

Draft

Final

Reg Repro

0 1

15. TOTAL 0 2 0

I. APPROVED BY J. DATE

DD Form 1423-1, FEB 2001 PREVIOUS EDITION MAY BE USED Page _ _ of __Pages

18. ESTIMATED

TOTAL PRICE

17. PRICE

GROUP

L9WC20

1 1

G. PREPARED BY DATE

A002 CYBER SECURITY DOCUMENTATION

16. REMARKS

Blocks 11, 12, 13: Data shall be provided in the original product format 2 months prior to the end of the contract.

Addressee:

402 CMXG/MXDBE/Attn: Shane Groves 420 Richard Ray Blvd.

Suite 100/ MXDQBE Robins AFB, GA 31098 The electronic file shall be emailed to shane.groves@us.af.mil.

SEE BLK 16

HARD COPY

ELECTRONIC 0 1 0

cHRISTINE l. cLARK 18 April 19 Christine L. Clark 18 April 19

DATA ITEM DESCRIPTION

Title: NAVAIR CYBERSECURITY IMPLEMENTATION PLAN

Number: DI-MGMT-82002A Approval Date: 20170523

AMSC Number: N9797 TBD Limitation: TBD

DTIC Applicable: No GIDEP Applicable: No

Preparing Activity: AS Project Number: MGMT-2017-010

Applicable Forms: CSIP Template

Use/relationship: The CSIP will be used to ensure that industry partners are protecting government data set forth by the Cybersecurity Plan (CSP).

This Data Item Description (DID) contains the format, content, and intended use information for the data product resulting from the work task described by the contract.

This DID supersedes DI-MGMT-82002.

Requirements:

1. Reference Documents. The applicable issue of the documents cited herein, including their approval dates and dates of any applicable amendments, notices and revisions, shall be specified in the contract.

2. Format. Contractor’s format acceptance.

3. Content. The content of the CSIP contains the necessary artifacts required by the Authorizing

Official (AO), Functional Authorization Official (FAO), or Program Information System

Security Manager (ISSM) to successfully assess that industry partners are protecting Government data at the required level set forth by the CSP.

3.1 Introduction. This section shall contain a narrative of the CSIP package content.

4. The content of this Cybersecurity Implementation Plan is to document how the contractor proposes to implement the requirements set forth in the Cybersecurity Plan (CSP).

5. Section “G” Assessment & Authorization and section “Q” Software may require additional documentation to validate the requirements set forth in the “G” and “Q” sections of the CSP per

CDRL YYY, Subtitle: Cyber Security System/Software Assurance Report.

A.

CYBERSECURITY . Describe how your company plans on addressing Cyber Security (CS) based on Section

“A” of the CSP. Address all statements in this section. The goal of this section is for the contractor to demonstrate understanding of Information Assurance.

B.

ARCHITECTURE. Describe how your company plans on addressing Information Assurance based on Section

“B” of the CSP. Address all statements in this section. The goal of this section is for the contractor to ensure that the contractor IT infrastructure and the Government IT infrastructure are compatible and interoperable.

Source: http://assist.dla.mil -- Downloaded: 2019-04-16T21:30Z Check the source to verify that this is the current version before use.

DI-MGMT-82002A

C.

CYBERSECURITY PRACTICES. Describe how your company plans on adhering to Cyber Security practices based on Section “C” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will comply with defined IA methodologies for the continual protection of DoN information.

D.

PUBLIC KEY INFRASTRUCTURE (PKI). Describe how your company plans on adhering to Information

Assurance practices based on Section “D” of the CSP. Address all statements in this section. The goal of this section is to articulate how PKI certificates will be acquired and utilized to meet the CSP requirements.

E.

ELECTRONIC MAIL (E-MAIL). Describe how your company plans on adhering to Information Assurance practices based on Section “E” of the CSP. Address all statements in this section. The goal of this section is to articulate how PKI certificates will be utilized with email programs for digital signature and encryption.

F.

DATA AT REST. Describe how your company plans on adhering to Information Assurance practices based on

Section “F” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will fulfil the CSP requirements for securing data at rest.

G.

ASSESSMENT & AUTHORIZATION (A&A). Describe how your company plans on adhering to Cyber

Security practices based on Section “G” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will appropriately support various aspects of the Assessment &

Authorization (A&A) effort. If an Information Technology (IT) system which includes Platform Information

Technology (PIT) systems or a system deemed as a “Control System” is NOT being delivered to the

Government; state that fact and mark the section “not applicable”.

H.

IA POC/IA Workforce. Describe how your company plans on adhering to Information Assurance practices based on Section “H” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will fulfill IA WorkForce requirements. If an IT system is NOT being delivered to the

Government; state that fact and mark the section “not applicable”.

I.

WEB SITES, ELECTRONIC ROOMS (E-ROOMS), & COLLOBORATION TOOLS. Describe how your company plans on adhering to Information Assurance practices based on Section “I” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will appropriately fulfill

CSP requirements to secure the online collaboration and management of government data.

J.

COMMON ACCESS CARDS (CAC) & SAAR-N FORMS. Describe how your company plans on adhering to

Information Assurance practices based on Section “J” of the CSP. Address all statements in this section. The goal of this section is to articulate an understanding of the process and requirements associated with obtaining a

CAC and access to government systems.

K.

CONTRACTOR OWNED UNCLASSIFIED NETWORK SECURITY. Describe how your company plans on adhering to Information Assurance practices based on Section “K” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will protect government-controlled unclassified information while in the contractor’s environment.

L.

INFORMATION SECURITY REQUIREMENTS FOR PROTECTION OF UNCLASSIFIED DOD

INFORMATION ON NON-DOD SYSTEMS. Describe how your company plans on adhering to Information

Assurance practices based on Section “L” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will safeguard unclassified DoD information while stored on non-

DoD information systems. Include any company specific policies and SOP’s currently in place for achieving this goal.

M.

CLASSIFIED SYSTEMS. Describe how your company plans on adhering to Information Assurance practices based on Section “M” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will meet CSP requirements when electronically transmitting classified information. If access to classified information is not a requirement in this contract state that fact and make the section “not applicable”.

N.

CLASSIFIED SPILLAGES. Describe how your company plans on adhering to Information Assurance practices based on Section “N” of the CSP. Address all statements in this section. The goal of this section is for the contractor to acknowledge the CSP requirement to appropriately report all classified spillages within the designated timeframe.

O.

CLASSIFIED RADIOS & TEMPEST CONTROLS. Describe how your company plans on adhering to

Information Assurance practices based on Section “O” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will comply with TEMPEST requirements. If classified radios with TEMPEST controls are NOT being delivered to the Government; state that fact and mark the section “not applicable”.

P.

PROCUREMENT OF CELLULAR TELEPHONES, PDA’S, AIR CARDS AND CALLING CARDS. Describe how your company plans on adhering to Information Assurance practices based on Section “P” of the CSP.

Address all statements in this section. The goal of this section is for the contractor to acknowledge an understanding of relevant procurement instructions and restrictions for use.

Q.

SOFTWARE. Describe in detail how your company plans on adhering to software deliverables based on

Section “Q” of the CSP. Address all statements in this section. The goal of this section is for the contractor to acknowledge an understanding of relevant components of protecting software deliverables. Ensure that each of the subsections are sufficiently explained to determine a software security posture and baseline.

Data Input Validation

Integrity Checking

Software Quality Assurance

Supply Chain Management and Software Assurance

R.

MISC. Describe how your company plans on adhering to requirements in Section “R” Misc. of the CSP.

End of DI-MGMT-82002A