HQ0858-21-R-0016_CDRL A006 Information Management and Control Plan - Redacted.pdf

DD FORM 1423-1, FEB 2001 PREVIOUS EDITION MAY BE USED. Page 1 of 2 Pages Adobe Professional 8.0

18. ESTIMATED

TOTAL PRICE

17. PRICE GROUP

CONTRACT DATA REQUIREMENTS LIST

(1 Data Item)

Form Approved OMB No. 0704-0188

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the Government Issuing Contracting Officer for the Contract/PR No. listed in Block E.

A. CONTRACT LINE ITEM NO.

0002, 1002, 2002, 7002

B. EXHIBIT

A

C. CATEGORY:

TDP TM OTHER X-MGMT

D. SYSTEM/ITEM

See CDRL Cover page

E. CONTRACT/PR NO.

HQ0858-21-R-0016

F. CONTRACTOR

TBD

1. DATA ITEM NO.

A006

2. TITLE OF DATA ITEM

Work Management Plan

3. SUBTITLE

Information Management and Control Plan

4. AUTHORITY (Data Acquisition Document No.)

DI-MGMT-81911

5. CONTRACT REFERENCE

SOW Paragraph(s) 6.0, 6.3

6. REQUIRING OFFICE

MDA/CS

7. DD 250 REQ

NO

9. DIST STATEMENT

REQUIRED

E

10. FREQUENCY

QTRLY

12. DATE OF FIRST SUBMISSION

See Blk 16

14. DISTRIBUTION

a. ADDRESSEE

b. COPIES

8. APP CODE

N/A

11. AS OF DATE

N/A

13. DATE OF SUBSEQUENT

SUBMISSION

See Blk 16 Draft

Final

Reg Repro

16. REMARKS

Block 4: Format shall be contractor developed and approved by the Government.

Clarification of Requirements for DI-MGMT-81911. The report shall address the following areas:

a). The contractor shall describe their approach to safeguarding CUI by submitting an Information Management and Control Plan (IMCP).

b). The IMCP shall describe policies and procedures noting how CUI is tracked, shared, and how the CUI is protected with contractor’s/subcontractor’s unclassified information technology systems.

c). The IMCP shall clearly articulate how sharing of CUI is to be implemented and managed at all tiers of the supply chains.

d). It shall address what standard procedures are used to determine the need to transmit CUI and what internal mechanisms are used to determine the amount of CUI deemed necessary to transmit. The IMCP shall address what security controls are in place to ensure any CUI transmitted to sub-contractors (all tiers) is protected IAW DFARS 252.204-7012 and the contractor’s compliance monitoring procedures.

e). The IMCP shall Include a high-level summary of the Contractor’s SSP and POAM for their applicable network as Appendix A, SSP and POAM Summary, to the IMCP, to include each of the 14 NIST 800-171 control families (not at the individual control level).

The SSP and POAM summary (Appendix A) are exempt from the five (5) page limitation of the IMCP. Government reserves the right to request delivery of the SSP and POAM from the prime contractors and any applicable subcontractors included in the supply chain.

f). The offeror shall submit an IMCP Supplier Compliance Supplement (Appendix B) IAW SOW Paragraphs (X.X.X.X) and shall flow down the requirement to all subcontractors.

(Continued on next page)

MDA/PCO 1 1 0

MDA/COR 0 1 0

15. TOTAL 1 2 0

G. PREPARED BY

SECOR.JEFFREY.JOHN.11409181 Digitally signed by

SECOR.JEFFREY.JOHN.1140918144

44 Date: 2021.06.09 16:00:22 -05'00'

H. DATE I. APPROVED BY

HASE.THOMAS.ALLEN.138 Digitally signed by HASE.THOMAS.ALLEN.1383201736 3201736 Date: 2021.06.10 06:36:39 -05'00'

J. DATE

Approved for Public Release 21-MDA-10882 (11JUL2021)

CONTRACT DATA REQUIREMENTS LIST

(1 Data Item)

A. CONTRACT LINE ITEM NO.

0002, 1002, 2002, 7002

B. EXHIBIT

A

C. CATEGORY: X-MGMT

TDP TM OTHER

D. SYSTEM/ITEM

See CDRL Cover page

E. CONTRACT/PR NO.

HQ0858-21-R-0016

F. CONTRACTOR

TBD

16. REMARKS (Continued)

Block 7: Acceptance shall be by the Contracting Officer Representative (COR) via the Data Item Transmittal/Acceptance/Rejection form (Attachment 4).

Block 8: The data shall be reviewed and accepted/rejected based on its conforming to the requirements of the DID.

The Government shall have 30 days after receipt for review and acceptance of each submission. Final updates are due 15 days after receipt of Government comments.

Block 9: DISTRIBUTION - E - Distribution authorized to DoD Components only due to export controlled and administrative or operational use and/or proprietary information, September 9, 2020. Other requests for this document shall be referred to Consolidated Support Program Manager, MDA/CS Bldg 5224 Redstone Arsenal, AL 35898.

Block 10: The IMCP and IMCP Supplier Compliance Supplement shall be updated quarterly to include any new subcontractors joining the supply chain.

Block 12: The initial IMCP is due with proposals. The first IMCP update and IMCP Supplier Compliance Supplement are deferred until 60 days after contract award, with final supply chain vendors under contract.

Block 13: The IMCP and IMCP Supplier Compliance Supplement shall be updated quarterly to include any new subcontractors joining the supply chain.

Block 14: Distribution and submittal by electronic media wherever possible. Electronic deliverables shall be compatible with Office 2016 unless otherwise approved by the government.

Technical data or computer software that is properly included on the data rights assertion list incorporated into the contract and containing "Limited Rights" or "Restricted Rights" legends as specified in DFARS 252.227-7013 and 252.227-7014 shall not be delivered under or in conjunction with the CDRL without prior written approval of the Contracting Officer.

Technical data or computer software that is not properly included on a data rights assertion list incorporated into the contract shall NOT be delivered with any restrictive markings.

"Technical Data" is defined at DFARS 252.227-7013(a) (15) and means recorded information, regardless of the form or method of the recording, of scientific or technical nature (including computer software documentation). Computer software is defined at DFARS 252.227-7014(a)(4), and means computer programs, source code, source code listings, object code listings, design details, algorithms, processes, flow charts, formulae, and related material that would enable the software to be reproduced, recreated, or recompiled.

Under no circumstance shall technical data or computer software to be delivered under or in conjunction with this CDRL be marked "Proprietary" (or any similar nonconforming marking).

DD FORM 1423-1, FEB 2001 Page 2 of 2 Pages Reset

DD FORM 1423-1 (BACK), FEB 2001

INSTRUCTIONS FOR COMPLETING DD FORM 1423

(See DoD 5010.12-M for detailed instructions.)

FOR GOVERNMENT PERSONNEL

Item A. Self-explanatory.

Item B. Self-explanatory.

Item C. Mark (X) appropriate category: TDP - Technical Data Package;

TM - Technical Manual; Other - other category of data, such as "Provisioning,""Configuration Management," etc.

Item D. Enter name of system/item being acquired that data will support.

Item E. Self-explanatory (to be filled in after contract award).

Item F. Self-explanatory (to be filled in after contract award).

Item G. Signature of preparer of CDRL.

Item H. Date CDRL was prepared.

Item I. Signature of CDRL approval authority.

Item J. Date CDRL was approved.

Item 1. See DoD FAR Supplement Subpart 4.71 for proper numbering.

Item 2. Enter title as it appears on data acquisition document cited in Item 4.

Item 3. Enter subtitle of data item for further definition of data item (optional entry).

Item 4. Enter Data Item Description (DID) number, military specification number, or military standard number listed in DoD 5010.12-L (AMSDL), or one-time DID number, that defines data content and format requirements.

Item 5. Enter reference to tasking in contract that generates requirement for the data item (e.g., Statement of Work paragraph number).

Item 6. Enter technical office responsible for ensuring adequacy of the data item.

Item 7. Specify requirement for inspection/acceptance of the data item by the Government.

Item 8. Specify requirement for approval of a draft before preparation of the final data item.

Item 9. For technical data, specify requirement for contractor to mark the appropriate distribution statement on the data (ref. DoDD 5230.24).

Item 10. Specify number of times data items are to be delivered.

Item 11. Specify as-of date of data item, when applicable.

Item 12. Specify when first submittal is required.

Item 13. Specify when subsequent submittals are required, when applicable.

Item 14. Enter addressees and number of draft/final copies to be delivered to each addressee. Explain reproducible copies in Item 16.

Item 15. Enter total number of draft/final copies to be delivered.

Item 16. Use for additional/clarifying information for Items 1 through 15.

Examples are: Tailoring of documents cited in Item 4; Clarification of submittal dates in Items 12 and 13; Explanation of reproducible copies in Item 14.; Desired medium for delivery of the data item.

FOR THE CONTRACTOR

Item 17. Specify appropriate price group from one of the following groups of effort in developing estimated prices for each data item listed on the DD Form 1423.

a. Group I. Definition - Data which is not otherwise essential to the contractor's performance of the primary contracted effort (production, development, testing, and administration) but which is required by DD Form 1423.

Estimated Price - Costs to be included under Group I are those applicable to preparing and assembling the data item in conformance with Government requirements, and the administration and other expenses related to reproducing and delivering such data items to the Government.

b. Group II. Definition - Data which is essential to the performance of the primary contracted effort but the contractor is required to perform additional work to conform to Government requirements with regard to depth of content, format, frequency of submittal, preparation, control, or quality of the data item.

Estimated Price - Costs to be included under Group II are those incurred over and above the cost of the essential data item without conforming to Government requirements, and the administrative and other expenses related to reproducing and delivering such data item to the Government.

c. Group III. Definition - Data which the contractor must develop for his internal use in performance of the primary contracted effort and does not require any substantial change to conform to Government requirements with regard to depth of content, format, frequency of submittal, preparation, control, and quality of the data item.

Estimated Price - Costs to be included under Group III are the administrative and other expenses related to reproducing and delivering such data item to the Government.

d. Group IV. Definition - Data which is developed by the contractor as part of his normal operating procedures and his effort in supplying these data to the Government is minimal.

Estimated Price - Group IV items should normally be shown on the DD Form 1423 at no cost.

Item 18. For each data item, enter an amount equal to that portion of the total price which is estimated to be attributable to the production or development for the Government of that item of data.

These estimated data prices shall be developed only from those costs which will be incurred as a direct result of the requirement to supply the data, over and above those costs which would otherwise be incurred in performance of the contract if no data were required. The estimated data prices shall not include any amount for rights in data. The Government's right to use the data shall be governed by the pertinent provisions of the contract.