CDRL A210 EUHW_System Security Plan.docx

CONTRACT DATA REQUIREMENTS LIST

(1 Data Item) Form Approved OMB No. 0704-0188

Public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188), Washington, DC 20503. Please DO NOT RETURN your form to either of these addresses. Send completed form to the Government Issuing Contracting Officer for the Contract/PR No. listed in Block E.

A. CONTRACT LINE ITEM NO.

B. EXHIBIT

C. CATEGORY:

TDP ____ TM ____ OTHER __X_______

D. SYSTEM/ITEM

Next Generation Enterprise Network Recompete (NGEN-R)

E. CONTRACT/PR NO.

NGEN-R/EUHW

F. CONTRACTOR

TBD

1. DATA ITEM NO

A210

2. TITLE OF DATA ITEM

Contractor’s Systems Security Plan and Associated Plans of Action to Implement NIST SP 800-171 on a Contractor’s Internal Unclassified Information System

3. SUBTITLE

4. AUTHORITY (Data Acquisition Document No.)

DI-MGMT-82247

5. CONTRACT REFERENCE

See Block 16.

6. REQUIRING OFFICE

PMW 205/Program Security

7. DD250 REQ

Yes

9. DIST. STATEMENT

REQUIRED

F

10. FREQUENCY

Once, Initial

12. DATE OF FIRST SUBMISSION

See Block 16.

14. DISTRIBUTION

a. ADDRESSEE

b. COPIES

8. APP CODE

11. AS OF DATE

13. DATE OF SUBSEQUENT

SUBMISSION

Updated as Required

DRAFT

FINAL

16. REMARKS:

The Contractor shall develop a System Security Plan (SSP) per Data Item Description DI-MGMT-82247.

This SSP will address contractor’s internal unclassified information system(s) and existing and planned actions (including any associated plans of action);

in accordance with the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations.

Security Requirement 3.12.2 of the NIST SP 800-171 requires that plans of action describe how the Contractor will correct deficiencies and reduce or eliminate vulnerabilities in the Contractor’s unclassified information system. The system security plan (or extracts thereof) and any associated plans of action may be used by the government as input to an overall risk management decision to process, store, or transmit covered defense information on an unclassified information system that is owned, or operated by or for, the Contractor (i.e., Contractor's internal unclassified information system).

Portions of, or the entire plan may be used to satisfy applicable portions of the Program Protection Implementation Plan (CDRL 205).

This document must contain appropriate classification markings including paragraphs (Refer to PPP Appendix D Security Classification Guide (SCG)).

Block 14: N/A

Block 5: PWS reference 3.6.n.

Block 12: Plan should be prepared DAC 45; available on request by the government thereafter.

15. TOTAL

G. PREPARED BY

H. DATE

I. APPROVED BY

J. DATE