HSAM Appendix G - Safeguarding of Sensitive Information for USCG.pdf

HSAM Appendix G – Individual Checklist for Controlled Unclassified Information

Procurement Title: ______________________ Requisition #: _______________________ Estimated Contract Value (incl. options): __________________________________________

USCG Instructions: The requiring office shall complete this checklist for all acquisitions, including assisted acquisitions, regardless of dollar value. The requiring official shall ensure the Statement of Work, Statement of Objective, Performance Work Statement or specification is reviewed by the organizations identified at HSAM 3004.470(b) [NOTE: USCG delegations are on the final page of this checklist] and obtain signatures, as applicable, on this checklist when the requiring official determines that (1) contractor and/or subcontractor employees require recurring access to government facilities or access to controlled unclassified information (CUI); (2) CUI will be collected or maintained on behalf of the agency; or (3) Federal information systems, which include contractor information systems operated on behalf of the agency, will be used to collect, process, store, or transmit CUI.

If it is not clear to the requiring official if the contractor will have access to CUI and/or Federal information systems, which include contractor information systems operated on behalf of the agency, will be used to collect, process, store, or transmit CUI, the requirements official shall at a minimum consult with the delegations from the Component Chief Information Officer (CIO), Chief Security Officer (CSO) and Privacy Officer as identified on the final page of this checklist. The requiring office shall submit the completed checklist as part of the procurement request package in accordance with HSAM 3004.7101.

Failure to submit a completed checklist will result in the return of the procurement request package.

The contracting officer is responsible for routing the checklist to the appropriate Head of the Contracting Activity (HCA) designee for signature and ensuring the solicitation and resultant contract reflect the requirements contained in the checklist.

A. Controlled Unclassified Information and Access Requirements (completed by the requiring office):

1. Will the contractor have access to any of the types of CUI (see CUI definition in HSAR 3002.101) listed below during the acquisition?

Yes No Chemical-terrorism Vulnerability Information (CVI) Yes No Homeland Security Agreement Information Yes No Homeland Security Enforcement Information Yes No Information Systems Vulnerability Information (ISVI) Yes No International Agreement Information Yes No Operations Security Information Yes No Personnel Security Information Yes No Physical Security Information Yes No Protected Critical Infrastructure Information (PCII) Yes No Personally Identifiable Information (PII) Yes No Sensitive PII (SPII) Yes No Sensitive Security Information (SSI) Other type of CUI or Classified Information_______________________________________

HSAM Appendix G - Individual 1 Revision Date: 08/03/2023 https://www.dhs.gov/publication/hsar

2.

3.

4.

5.

Note: If the answer is “Yes” to any of the information types listed above, the contracting officer shall include HSAR 3052.204-72 Safeguarding of Controlled Unclassified Information in the solicitation and resultant contract. If “Yes” is answered for PII and/or SPII, the contracting officer shall also include HSAR 3052.204-73 Notification and Credit Monitoring Requirements for Personally Identifiable Information Incidents in the solicitation and resultant contract.

Will contractor employees have access to DHS information systems? Yes No

Will contractor employees require recurring access to Government facilities?

Yes No

Note: If the answer is “No” to questions 1 through 3, proceed to the Signatures section of the checklist. When the answer is “No” to questions 1 through 3, the checklist shall, at a minimum, be signed by the requiring official and the HCA designee.

If the answer is “Yes” to any of questions 1 through 3, identify the information security, personnel security, and privacy clauses and provisions to be included in the solicitation and resultant contract:

Yes No FAR 52.224-3 Privacy Training – Alternate I (see FAR Class Deviation 17-03, Revision 1)

Yes No HSAR 3052.204-71 Contractor Employee Access Yes No HSAR 3052.204-71 Contractor Employee Access Alt I Yes No HSAR 3052.204-71 Contractor Employee Access Alt II Yes No HSAR 3052.204-72 Safeguarding of Controlled Unclassified

Information Yes No HSAR 3052.204-72 Safeguarding of Controlled Unclassified

Information Alt I Yes No HSAR 3052.204-73 Notification and Credit Monitoring

Requirements for Personally Identifiable Information Incidents Yes No Special Clause Information Technology Security Awareness Training

(see HSAR Class Deviation 15-01, Revision 1) Yes No Other:

If foreign end products or services are allowed under the contract, what additional security provisions are to be included in the solicitation to protect CUI and facilities from unauthorized access and disclosure?

HSAM Appendix G - Individual 2 Revision Date: 08/03/2023

B. Authority to Operate (ATO) and Continuous Monitoring Data Requirements (completed by requiring office in coordination with Component CIO designee):

1. Will Federal information systems, which include contractor information systems operated on behalf of the agency, be used to collect, process, store, or transmit CUI?

Yes No

2. If “Yes” to #1, has the requiring office coordinated development of the Security Requirements Traceability Matrix (SRTM) with the Component CIO or designee for inclusion in the solicitation? Yes N/A (only if “No” to #1)

3. If “Yes” to #1, will the solicitation require the submission of a draft security plan and instructions on how the draft security plan will be evaluated? Yes N/A (only if “No” to #1)

4. If “Yes” to #1, does the requirements document identify how the contractor should submit monthly continuous monitoring data to the Government? Yes N/A (only if “No” to #1)

5. If “Yes” to #1, identify and describe the continuous monitoring data requirements to be included in the solicitation.

Note: When Federal information systems, which include contractor information systems operated on behalf of the agency, will be used to collect, process, store, or transmit CUI , the SRTM shall be included in the solicitation. The SRTM is prepared by the Component CIO designee in coordination with the requiring office and shall be included in the procurement request package as an attachment to the requirements document (i.e., Statement of Work, Statement of Objectives, Performance Work Statement). Contracting officers shall ensure the solicitation requires vendors to submit a draft security plan with their proposal/quotation as their response to the SRTM. Instructions on how the draft security plan will be evaluated shall be included in the solicitation.

C. Data Retention Requirements (completed by requiring office):

1. Will the contractor be required to retain CUI for the Government?

Yes No

2. If “Yes” to #1, does the requirements document identify (a) retention requirements (e.g., length of time data must be retained before return and/or destruction) and (b) security requirements for the protection of retained data? Yes N/A (only if “No” to #1)

3. If “Yes” to #1, identify and describe the retention and security requirements to be included in the solicitation.

HSAM Appendix G - Individual 3 Revision Date: 08/03/2023

4. Does the Government have a plan to monitor and/or ensure contractor compliance with the retention and security requirements identified? Yes N/A (only if “No” to #1)

5. If “Yes” to #1, describe the Government’s plan to monitor and/or ensure contractor compliance with the retention and security requirements identified in the acquisition.

D. Additional Privacy Considerations (completed by requiring office in coordination with Component Privacy Officer designee):

1. Is privacy compliance documentation (Privacy Threshold Analysis, Privacy Impact Assessment, and/or System of Record Notice, as appropriate) required for this procurement? Yes No N/A

2. If “Yes” to #1, has any of the following privacy compliance documentation been completed?

Yes No N/A Privacy Threshold Analysis Yes No N/A Privacy Impact Assessment Yes No N/A System or Record Notice Yes No N/A Other:_____________________________________________

3. Is contractor support needed to complete privacy compliance documentation?

Yes No N/A

4. If contractor support is needed to complete the privacy compliance documentation, does the requirements document identify the activities and level of contractor support needed?

Yes N/A (only if “No” or “N/A” to #3)

5. If “Yes” to #3, identify and describe the activities and level of contractor support needed to complete the privacy compliance documentation.

HSAM Appendix G - Individual 4 Revision Date: 08/03/2023

Signature Page Instructions: After Requiring Official signature, submit this HSAM Appendix G AND the requirements document (description of requirements, SOW, SOO, PWS ) through the HSAM Appendix G Submission Tool to initiate review to the following USCG Offices or designees if the checklist instructs their input: Chief Security Officer, Chief Information Officer, and/or Privacy Officer as appropriate. Email addresses are provided for questions ONLY. If signatures are required for SSI, CVI, and PCII, the Requiring Office must submit the checklists via email AFTER USCG applicable signatures are received. The Requiring Office will provide the HSAM Appendix G for HCA Designee signature to the Contracting Officer to review and coordinate.

Role and Incluion Guidance Name, Title, Office, Phone # OR Reason for Exclusion

Signature (Include date if not signing electronically)

Requiring Official (or official title) To be signed by Program Manager, Contracting Officer's Representative (COR) or other Program designee.

USCG Chief Security Officer (CSO) or designee Include when contractor employees require recurring access to DHS facilities and/ or access to CUI. Email for questions only:

If <$10M: HQS-SMB-ChiefSecurityOfficer-AppendixG-0-10M@uscg.mil If ≥$10M to <$50M: HQS-SMB-ChiefSecurityOfficer-APs-10M-50M@uscg.mil

If ≥$50M: HQS-SMB-ChiefSecurityOfficer-APs-50andgreater@uscg.mil

USCG Chief Information Officer (CIO) or designee Include when information systems will be used to collect, process, store, or transmit CUI.

Email for questions only: HQS-DG-LST-CG-6-HSAMReview@uscg.mil

USCG Privacy Officer or designee Include when contractor employees will have access to Personally Identifiable Information (PII), Personal Health Information (PHI) and/or SPII.

Email for questions only: HQS-DG-M-CG-61-PII@uscg.mil

Sensitive Security Information (SSI) Program Office Include when contractor employees will have to access SSI.

Email : SSI@HQ.DHS.gov (if applicable submit after ITPASS coordination is completed)

Chemical-terrorism Vulnerability Information (CVI) Program Office Include when contractor employees will have access to CVI.

Email: CVI_HSAM_Requests@cisa.dhs.gov

Protected Critical Infrastructure Information (PCII) Program Office Include when contractor employees will have access to PCII.

Email: PCII-Assist@cisa.dhs.gov

USCG Head of the Contracting Activity (HCA) Designee If <$10M, then Contracting Officer (KO) If ≥$10M to <$50M, then Level above the KO If ≥$50M, then Deputy Head of the Contracting Activity (HCAd)

HSAM Appendix G - Individual 5 Revision Date: 08/03/2023 mailto:HQS-SMB-ChiefSecurityOfficer-AppendixG-0-10M@uscg.mil mailto:HQS-SMB-ChiefSecurityOfficer-APs-10M-50M@uscg.mil mailto:HQS-SMB-ChiefSecurityOfficer-APs-50andgreater@uscg.mil mailto:HQS-DG-LST-CG-6-HSAMReview@uscg.mil mailto:HQS-DG-M-CG-61-PII@uscg.mil mailto:SSI@HQ.DHS.gov mailto:CVI_HSAM_Requests@cisa.dhs.gov mailto:PCII-Assist@cisa.dhs.gov https://uscg.sharepoint-mil.us/sites/AppendixG/SitePages/Home.aspx

RO Info: (Name) Ava Stow (Title) Contracting Specialist (Organization) Coast Guard (Phone Number) 541-991-0079 CSO Info:

(Name) (Title)

USCG, DCMS-34

(Phone Number) CIO Info: (Name) CIO designee

USCG, CG-6

(Phone Number) PO Info: (Name) Privacy Officer

USCG, CG-6P

(Phone Number) TSA Info: (Name) TSA, SSI Program Office (Phone Number) CISA CVI Info: (Name) CISA, CVI Program Office (Phone Number) CISA PCII Info: (Name) CISA, PCII Program Office (Phone Number) HCA Info: (Name) (Title) (Organization) (Phone Number) Other type of CUI or Classified Information: