DRAFT - USC PWS Cyber Language 6 Jan 12 version.docx

3.J. Information Assurance

3.J.1. Handling of Non-Public Information

In performance of this contract, the contractor may have access to sensitive, non-public information. Sensitive, non-public information is information that is not available to the general public that has a degree of confidentiality, such that its loss, misuse, unauthorized access or modification could compromise that confidentiality and harm important interests, such as national security, law enforcement, or the conduct of agency programs. An example of sensitive, non-public information is shipment information that contains cargo specifics, shipment destinations, or future movement information. The contractor agrees (a) to use and protect such information from unauthorized disclosure in accordance with Attachment 2 of Directive Type Memorandum (DTM) 08-027 - Security of Unclassified DOD Information on Non-DOD Information Systems, 31 July 2009; (b) to use and disclose such information only for the purpose of performing this contract and to not use or disclose such information for any personal or commercial purpose; (c) to obtain permission of the Government Program Manager before disclosing/discussing such information with a third party; (d) to return and/or electronically purge, upon Government request, any non-public, sensitive information no longer required for contractor performance; and (e) to advise the Government Program Manager of any unauthorized release of such information.

3.J.2. Requirement for Contractor Information Assurance (IA) Report

The Contractor shall provide an Information Assurance Report to describe their environment that adequately safeguards DOD non-public information resident on or transiting the contractor's unclassified information systems from unauthorized access and disclosure. Protection measures applied should consider the risks (i.e. consequences and their probability) of loss, misuse, unauthorized access, or modification of information. The report shall address the SANS (SysAdmin, Audit, Network, Security) Institute's Twenty Critical Security Controls for Effective Cyber Defense: Consensus Audit Guidelines (http://www.sans.org/critical-security-controls) and be provided in accordance with the attached template at Attachment X to the PWS. The contractor is encouraged to provide additional information above and beyond what is outlined in the SANS guidelines to enhance the government’s understanding of their information security posture. The report will be updated 30 days prior to exercise of an option period, if applicable.

3.J.3. Cyber Security Incidents

3.J. 3.1. Reporting Requirements

The contractor shall report to the following two Government organizations within 24 hours of discovery of any suspected cyber intrusion events that affect DOD information resident on or transiting the contractor's unclassified information systems.

1. USTRANSCOM Global Command, Control, Communications and Computers (C4) Coordination Center (GCCC) E-mail: ustcJ6-gccc@ustranscom.mil Commercial Phone: 618-229-4222

2. USTRANSCOM Deployment and Distribution Operation Center (DDOC) E-mail: ustc-ddocchief@ustranscom.mil Commercial Phone: 618-220-7700

Initial report shall be provided even if some details are not yet available, with follow-on detailed reporting within 72 hours. Reportable cyber intrusion events include the following:

Definition of advanced persistent threat: An extremely proficient, patient, determined, and capable adversary, including two or more of such adversaries working together.

3.J.3.2. Incident Report Content

3.J.3.3. Incident Report Submission

The contractor will submit unclassified network cyber incident reports to the USTRANSCOM Technical Information Analysis Center (TIAC) and USTRANSCOM designated government personnel via encrypted email or another mutually agreed upon secure communications method. Copies of malware require special handling and pre-coordination must be accomplished prior to submission.

3.J.3.4. Incident Response Coordination

In the event of a known or potential intrusion, the contractor agrees at no additional cost to the Government to cooperate with follow-on actions by the Government to further characterize and evaluate the suspect activity. The contractor acknowledges that damage assessments may be necessary to ascertain intruder methodology and identify systems compromised as a result of the intrusion. Company acknowledges that in certain cases a complete forensic analysis may be necessary to ascertain intruder methodology and identify systems compromised as a result of the intrusion. Once an intrusion is identified, the company agrees to take all reasonable and appropriate steps to preserve any and all evidence, information, data, logs, electronic files and similar type information (reference NIST Special Publication 800-61: Computer Security Incident Handling Guide, current version) related to the intrusion for subsequent forensic analysis so that an accurate and complete damage assessment can be accomplished by the government. The contractor is not required to maintain an organic forensic capability, but must ensure data is preserved until forensic analysis can be performed by the government (e.g. removing an affected system, while still powered on, from the network meets the intent of this requirement). Any follow-on actions will be coordinated with the contractor via the Contracting Officer

3.J.4. Law Enforcement/Counterintelligence

In the event of a known or potential intrusion, the contractor shall at no additional cost to the Government cooperate with counterintelligence or law enforcement investigative agency requests to apply forensic analysis tools to contractor information systems affected by the intrusion, including monitoring tools, imaging tools, and any other techniques that the agency seeks to apply to effectively analyze the intrusion. Nothing in this contract shall limit the ability of the Government to conduct law enforcement or counterintelligence activities, or other activities in the interest of national security.

3.J.5. Information Sharing

The Contractor agrees that the Government may use and disclose reported information (e.g., information regarding threats, vulnerabilities, incidents, or best practices) and related information developed by investigation, forensic analysis, etc. that does not include attribution information at its discretion to assist entities in protecting information or information systems (e.g. threat information products, threat assessment reports); provided that such discretionary use or disclosure is otherwise authorized in accordance with applicable statutes, regulations, and policies.

3.J.6. Confidentiality and Non-Attribution Statement

The Government shall take reasonable steps, by controlled access and need-to-know procedures, to protect against public release of attribution information of the contractor. The government may use and disclose reported information that includes attribution information only on a need-to-know basis to authorized persons for cyber security and related purposes (e.g., in support of forensic analysis, incident response, compromise or damage assessments, law enforcement, counter intelligence, threat reporting, and trend analysis). The Government may disclose attribution information to support contractors that are supporting the Government's cyber security and related activities if the support contractor is subject to confidentiality requirements that prevent any further use or voluntary disclosure of the attribution information. The Government agrees to consider available exemptions of the Freedom of Information Act to protect against disclosure of attribution information of the contractor to unauthorized persons. Within a reasonable period necessary to perform an analysis after completion of the assessment, all contractor proprietary information or third party proprietary information in the possession of the Government as a result of the assessment will be destroyed unless other disposition is agreed upon in writing by the Parties or is required by law, Executive Order or regulation.