Q A_Posted_12_Feb_2016.pdf

N00024-15-R-6406 BIDDER’S QUESTION & GOVERNMENT RESPONSE

QUESTION #1

Date: 2/12/2016 Topic: Cyber Security Clause

RFP

Reference:

N00024-15-R-6406, Section I, DFAR 252.204-7012

Question:

As a follow up to the Government's response to Question #5, under the amended DFAR 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting (Dec 2015), the Contractor has until 31 December 2017 for full compliance with the NIST SP 800-171 controls, which contain 109 security requirements that are mapped to a set of 188 security controls from NIST SP 800-53r4.

Complying with NIST SP 800-171 is only one of four main components of compliance, the other three being: 1) identifying and marking CDI; 2) reporting cyber incidents within 72 hours; and 3) subcontractor compliance.

Included in this clause is the requirement to flow down this clause without alteration to all subcontractors providing operationally critical support, or for which subcontract performance will involve a covered contractor information system, including subcontracts for commercial items. This provisin requires these subcontractors to rapidly report cyber incidents directly to DoD and the prime Contractor.

To ensure any post RFP submittal cost analysis is based on similar/equal requirements, and per the contracting officer guidance provided within PGI 204.7303-1 pertaining to DFAR 252.204-7012 (Dec 2015); does the Government intend to specifically identify CDI for this solicitation prior to proposal submittal?

Response:

The Government cannot provide a comprehensive list of CDI at this time, as covered information is a fluid list that will change throughout the performance of the contract. In accordance with the Government's prior response, Offerors should bid in accordance with the definition of CDI as stated by DFAR 252.204-7012 (Dec 2015). As general guidance, Offerors should consider all information provided by the Government to be CDI, except for information that is publically available such as technical information related to original equipment manufacturer COTS items. In addition, as stated by DFAR 252.204-7012 (Dec 2015), Offerors should consider all information associated with the performance of the contract that if/when disseminated would be marked with distribution statement B through F to be CDI.

The following list of examples is being provided for guidance purposes only. This list is not all encompassing or binding, and the Government anticipates additional items will fall under the clause throughout the performance of the contract. Examples of CDI include the following:

- Technical specifications, drawings and procedures related to items listed in Attachment 1 - Contract Baseline

- Government Furnished Information listed in Attachment 3 - GFI

- Information generated, stored and/or transmitted pertaining to the engineering, design, manufacture, production or testing of any part of the MK54 LWT Mod 0 kits

- CDRL data generated, stored and/or transmitted during the performance of the contract

- Information that, if disseminated, would be marked FOUO and/or distribution statement B through F