N0002423R5310 Ser 0253_025 - TOUA.pdf

DEPARTMENT OF THE NAVY

NAVAL SEA SYSTEMS COMMAND

1333 ISAAC HULL AVE SE

WASHINGTON NAVY YARD DC 20376-0001

IN REPLY REFER TO

Ser: 0253/025 1 February 2023

Subj: TERMS OF USE AGREEMENT (TOUA) FOR CONTROLLED UNCLASSIFIED

DATA RELATED TO EGYPT NATION-WIDE MARITIME SURVEILLANCE

SYSTEM (NMSS) RFP N00024-23-R-5310

This letter governs the use of the Government Furnished Information to be provided in solicitation N00024-23-R-5310.

Your company (“Recipient”) must acknowledge and accept the terms described herein as a prerequisite to receiving access to this information. This acknowledgement and acceptance must be made by a company representative with the authority to obligate your company to such terms.

The Recipient acknowledges that it will adhere to DFARS 252.204- 7012, “Safeguarding Covered Defense Information and Cyber Incident Reporting” and C-204-H002, Implementation of Enhanced Security Controls on Select Defense Industrial Base Partner Networks (NAVSEA).

NAVSEA will provide the GFI upon receipt of an executed TOUA and verification of an active DD Form 2345, Militarily Critical Technical Data Agreement. Information on the DD Form 2345 can be found here https://www.dla.mil/Logistics- Operations/Services/JCP/. Interested parties are required to provide a copy of their active DD Form 2345 with their executed TOUA. Subsequent to receipt and review of these items, NAVSEA will transmit the GFI to interested parties via DoDSAFE. The link will be password protected and the password will be emailed separately.

Interested parties may request up to four (4) individuals to receive the GFI information from DoDSAFE. The DoDSAFE link is valid for one-time use only. In the event that the link expires prior to document access, the Recipient shall notify the NAVSEA Points of Contacts (POC) identified below to request a new link.

In order to facilitate your review, you are granted authority to make copies for distribution internal to your company. You shall not distribute this material outside of the company without express written permission from the NAVSEA POCs identified in this letter. Potential teaming partners and/or subcontractors may receive the data either by submitting an executed TOUA and active copy of the DD 2345 directly to the POCs listed below or https://www.dla.mil/Logistics-Operations/Services/JCP/ https://www.dla.mil/Logistics-Operations/Services/JCP/

Subj: TOUA FOR CONTROLLED UNCLASSIFIED DATA RELATED TO EGYPT NMSS

RFP N00024-23-R-5310

any potential prime contractor may submit their teaming partners and/or subcontractors executed TOUA and evidence of an active DD 2345 directly via email to the NAVSEA POCs.

You may NOT:

1. Duplicate, transmit, or post the above documents/data in a manner contrary to the guidance provided herein.

2. Disclose the above documents to anyone without a need to know.

3. Disclose the above documents to foreign nationals or transmit said enclosures outside the geographical bound or custom territory of the United States of America unless a valid Technical Assistance Agreement (TAA)/Export License is in place.

You shall maintain a log of all produced copies, to whom and when the copies were distributed, and date of destruction. You shall furnish these records upon demand of the NAVSEA POCs identified in the SAM.gov posting (Joseph Boyko, joseph.p.boyko2.civ@us.navy.mil and Bebe Minger, bebe.j.minger.civ@us.navy.mil) or other authorized Government security officials.

Within 30 days following the conclusion of your firm’s efforts relating to this requirement, you shall destroy any and all electronic and printed material in any format. You shall notify the Contracting Officer listed below via email of the destruction of all GFI documents. You shall maintain records of destruction available for inspection for a period of five (5) years.

You shall provide a copy of the log, via email, to Bebe Minger, at bebe.j.minger.civ@us.navy.mil, no later than seven (7) days after destruction of the above documents is completed, as specified above.

Bebe J. Minger Contracting Officer, SEA 02533

Enclosures:

(1) TOUA for signature

(2) C-204-H002, Implementation of Enhanced Security Controls on

Select Defense Industrial Base Partner Networks (NAVSEA)

Enclosure 1

As an authorized representative of my company, in exchange for access to the GFI related to Egypt NMSS, I do hereby accept the terms of use governing the use of information as described in this letter.

AUTHORIZED COMPANY REPRESENTATIVE

Company and CAGE/Unique Entity Identifier

Signature Date

Name (Print) Title

Additionally, the following individuals shall be provided the DoDSAFE link:

Name Title Email

Enclosure 2

C-204-H002 IMPLEMENTATION OF ENHANCED SECURITY CONTROLS ON SELECT DEFENSE

INDUSTRIAL BASE PARTNER NETWORKS (NAVSEA) (JAN 2020)

1. System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews

a) Within thirty (30) days of contract award, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the Government at the contractor’s facility. The SSP(s) shall implement the security requirements in Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract. The Contractor shall fully cooperate in the Government’s review of the SSPs at the Contractor’s facility.

b) If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

c) Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor’s facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

d) The Government may, in its sole discretion, conduct subsequent reviews at the Contractor’s site to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) days’ notice to the Contractor.

2. Compliance to NIST 800-171

a) The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

b) Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

(1) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

(4) Audit user privileges on at least an annual basis;

(5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM);

and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

(6) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

(7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

3. Cyber Incident Response

a) The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the 72-hour reporting period), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

b) Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Medi a.docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

c) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten

(10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

4. Naval Criminal Investigative Service (NCIS) Outreach

The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting DON programs and technologies.

5. NCIS/Industry Monitoring https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.docx http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.docx

a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval Criminal Investigative Service (NCIS), which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems;

and the continuous provision of all Contractor, subcontractor or vendor logs that show network activity, including any additional logs the contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets. The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor.

In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.

(End of Text)

C-204-H002 IMPLEMENTATION OF ENHANCED SECURITY CONTROLS ON SELECT DEFENSE INDUSTRIAL BASE PARTNER NETWORKS (NAVSEA) (JAN 2020)