Bidders_Questions_Amendment_0011.pdf

N00024-19-R-5503 Bidder's Questions

7 Sept 17 1 of 1

Question Number:

Question Source: (RFP, attachment #, GFI title, etc.)

Page number and paragraph header from source:

Question: Response: Amendment:

31 RFP Section C, 3.10.4 Page 29

In subsection 3.10.4, the provision provides as follows: “Covered Defense Information (CDI) and Covered Contractor Information Systems (CCIS) are defined within clause 252.204-7012. Information at rest is defined as the state of information when it is not in process or in transit and is located on storage devices as specific components of systems. On all CCISs, the contractor shall encrypt CDI at rest in accordance with NIST 800-171.”

Within NIST 800-171, requirement 3.1.19 provides that CUI “at rest” shall be encrypted on mobile devices and mobile computing platforms only. Please confirm that the requirement above for encryption of data “at rest” applies only to mobile devices and mobile computing platforms.

Recommend the third sentence is changed to remove “all CCISs,” and replaced with “mobile devices and mobile computing platforms,”. See amendment 0011 for updated language. 0011

Sheet1