CDRL_A005_SW_Assurance_Report.pdf

DD FORM 1423-1, FEB 2001

CONTRACT DATA REQUIREMENTS LIST

(1 Data Item)

PREVIOUS EDITION MAY BE USED.

Form Approved OMB No. 0704-0188

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services and Communications Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the Government Issuing Contracting Officer for the Contract/PR No. listed in Block E.

A. CONTRACT LINE ITEM NO. B. EXHIBIT C. CATEGORY:

TDP ________ TM _______ OTHER

D. SYSTEM/ITEM E. CONTRACT/PR NO. F. CONTRACTOR

1. DATA ITEM NO. 2. TITLE OF DATA ITEM 3. SUBTITLE

4. AUTHORITY (Data Acquisition Document No.) 5. CONTRACT REFERENCE 6. REQUIRING OFFICE

7. DD 250 REQ

8. APP CODE

9. DIST STATEMENT

REQUIRED

10. FREQUENCY

11. AS OF DATE

12. DATE OF FIRST SUBMISSION

13. DATE OF SUBSEQUENT

SUBMISSION

14. DISTRIBUTION

a. ADDRESSEE

b. COPIES

Draft Final

Reg Repro

15. TOTAL

16. REMARKS

17. PRICE GROUP

18. ESTIMATED

TOTAL PRICE

G. PREPARED BY H. DATE I. APPROVED BY J. DATE

Page of Pages

CONTRACT DATA REQUIREMENTS LIST

(1 Data Item)

A. CONTRACT LINE ITEM NO. B. EXHIBIT C. CATEGORY:

TDP ________ TM _______ OTHER

D. SYSTEM/ITEM E. CONTRACT/PR NO. F. CONTRACTOR

16. REMARKS (Continued)

DD FORM 1423-1, FEB 2001 Page of Pages

INSTRUCTIONS FOR COMPLETING DD FORM 1423

(See DoD 5010.12-M for detailed instructions.)

FOR GOVERNMENT PERSONNEL

Item A. Self-explanatory.

Item B. Self-explanatory.

Item C. Mark (X) appropriate category: TDP - Technical Data Package;

TM - Technical Manual; Other - other category of data, such as "Provisioning,""Configuration Management," etc.

Item D. Enter name of system/item being acquired that data will support.

Item E. Self-explanatory (to be filled in after contract award).

Item F. Self-explanatory (to be filled in after contract award).

Item G. Signature of preparer of CDRL.

Item H. Date CDRL was prepared.

Item I. Signature of CDRL approval authority.

Item J. Date CDRL was approved.

Item 1. See DoD FAR Supplement Subpart 4.71 for proper numbering.

Item 2. Enter title as it appears on data acquisition document cited in Item 4.

Item 3. Enter subtitle of data item for further definition of data item (optional entry).

Item 4. Enter Data Item Description (DID) number, military specification number, or military standard number listed in DoD 5010.12-L (AMSDL), or one-time DID number, that defines data content and format requirements.

Item 5. Enter reference to tasking in contract that generates requirement for the data item (e.g., Statement of Work paragraph number).

Item 6. Enter technical office responsible for ensuring adequacy of the data item.

Item 7. Specify requirement for inspection/acceptance of the data item by the Government.

Item 8. Specify requirement for approval of a draft before preparation of the final data item.

Item 9. For technical data, specify requirement for contractor to mark the appropriate distribution statement on the data (ref. DoDD 5230.24).

Item 10. Specify number of times data items are to be delivered.

Item 11. Specify as-of date of data item, when applicable.

Item 12. Specify when first submittal is required.

Item 13. Specify when subsequent submittals are required, when applicable.

Item 14. Enter addressees and number of draft/final copies to be delivered to each addressee. Explain reproducible copies in Item 16.

Item 15. Enter total number of draft/final copies to be delivered.

Item 16. Use for additional/clarifying information for Items 1 through 15.

Examples are: Tailoring of documents cited in Item 4; Clarification of submittal dates in Items 12 and 13; Explanation of reproducible copies in Item 14.; Desired medium for delivery of the data item.

FOR THE CONTRACTOR

Item 17. Specify appropriate price group from one of the following groups of effort in developing estimated prices for each data item listed on the DD Form 1423.

a. Group I. Definition - Data which is not otherwise essential to the contractor's performance of the primary contracted effort (production, development, testing, and administration) but which is required by DD Form 1423.

Estimated Price - Costs to be included under Group I are those applicable to preparing and assembling the data item in conformance with Government requirements, and the administration and other expenses related to reproducing and delivering such data items to the Government.

b. Group II. Definition - Data which is essential to the performance of the primary contracted effort but the contractor is required to perform additional work to conform to Government requirements with regard to depth of content, format, frequency of submittal, preparation, control, or quality of the data item.

Estimated Price - Costs to be included under Group II are those incurred over and above the cost of the essential data item without conforming to Government requirements, and the administrative and other expenses related to reproducing and delivering such data item to the Government.

c. Group III. Definition - Data which the contractor must develop for his internal use in performance of the primary contracted effort and does not require any substantial change to conform to Government requirements with regard to depth of content, format, frequency of submittal, preparation, control, and quality of the data item.

Estimated Price - Costs to be included under Group III are the administrative and other expenses related to reproducing and delivering such data item to the Government.

d. Group IV. Definition - Data which is developed by the contractor as part of his normal operating procedures and his effort in supplying these data to the Government is minimal.

Estimated Price - Group IV items should normally be shown on the DD Form 1423 at no cost.

Item 18. For each data item, enter an amount equal to that portion of the total price which is estimated to be attributable to the production or development for the Government of that item of data.

These estimated data prices shall be developed only from those costs which will be incurred as a direct result of the requirement to supply the data, over and above those costs which would otherwise be incurred in performance of the contract if no data were required. The estimated data prices shall not include any amount for rights in data. The Government's right to use the data shall be governed by the pertinent provisions of the contract.

DD FORM 1423-1 (BACK), FEB 2001

Block 5: SOW CS Paragraph 3.2.8.2 and Attachment 6, CSP (System).

The Contractor shall provide the following existing support documents, that were created as a result of the system development effort, to the Government to coincide with the current system version change:

• Applicable results of the Security Technical Implementation Guide(s) (STIG(s).

• Applicable supporting documentation for Cyber Security controls to include the following RMF standards:

o Applicable Assess and Authorize Artifact* o Applicable System Categorization Form* o Applicable Security Assessment Plan (SAP)* o Applicable Information Security Continuous Monitoring (ISCM) Strategy* o Applicable Privacy Impact Assessment (PIA)* o Applicable PIT Determination Checklist* o Applicable Software Assurance Plan/Report* o Applicable Assured Compliance Assessment Solution (ACAS) scan results o Applicable Security Content Automation Protocol (SCAP) scan results o Applicable POA&M/RAR (with completed mitigations for known vulnerabilities) o Applicable Supply Chain Risk Management (SCRM) Plan* o Applicable Security Control Traceability Matrix (SCTM)* o Applicable Security Test Report (STR)*

The applicable controls and documentation for the system will be jointly determined by the contractor and the Government during an initial Cyber Security Kickoff meeting to take place 45 days after contract award. Applicable supporting documentation includes any system-specific documentation that is referenced when defining CS controls.

Block 5: SOW CS Paragraph 3.2.8.2 and Attachment 6, CSP (Software).

The Contractor shall provide the following existing support documents, that were created as a result of the software development effort, to the Government to coincide with the current software version change:

• Applicable source code scanning results

• Applicable Application Security and Development Security Technical Implementation Guide (STIG) results.

• Applicable Assured Compliance Assessment Solution (ACAS) scan results

• Applicable Security Content Automation Protocol (SCAP) scan results

• Applicable POA&M/RAR (with completed mitigations for known vulnerabilities)

• Applicable Software Assurance Plan/Report*

• Applicable Assess and Authorize Artifact*

• Applicable System Categorization Form*

In instances where a document is required to be submitted for both system and software delivery, submission of a single artifact in support of both is acceptable. The Government shall supply the following tools/licenses to the contractor as appropriate: ACAS, SCAP, STIG Viewer, Vulnerator and HP Fortify.

The contractor shall determine with Government concurrence and apply the appropriate STIG's utilizing the DISA Security Requirements Guide (SRG) / STIG Applicability Guide and Collection Tool. All STIG results must be generated using the DISA STIG Viewer tool and provided in the .CKL file format. The contractor shall utilize the Security Content Automation Protocol (SCAP) Tool to verify STIG compliance status. All STIG's, the STIG Collection tool, the STIG viewer and the SCAP Tool are available for download at: http://iase.disa.mil. The contractor shall utilize the Assured Compliance Assessment Solution (ACAS) Tool to scan a representative system to identify vulnerabilities associated with the product being delivered to the Government. The ACAS Tool is available for download at https://patches.csd.disa.mil/ and the associated license will be provided separately by the Government. The contractor shall utilize the Government provided Vulnerator Tool to import test results and generate a POA&M/RAR.

The contractor shall utilize the Government provided source code scanning software, HP Fortify, to ascertain the cyber security posture of all software delivered to the Government. The Government will review and approve the source code scanning results prior to any official software release. If a Fortify Scan is not possible because of a documented technical incompatibility between the source code programming language and the HP Fortify software then a substitute source code scanning tool may be utilized with Government approval. The results of the substitute source code scanning report will be acceptable. The Fortify software and license key will be made available to the contractor via the Government External SharePoint site on an as needed basis.

Blocks 7, 8, 10-13: Delivery date and content for all documents will determined during the initial Cyber Security Kickoff meeting, to take place prior to System Requirements Review (SRR) or 45 days after contract award which ever occurs first. The Government will review and provide comments to all documents within 10 business days. The Contractor shall resubmit the modified documents within 15 business days after receipt of Government comments if applicable. Existing software supporting documentation (Block 5 above) submission shall occur 60 days prior of production release to the Government with no residual Category 1 vulnerabilities.

Non-response from the Government shall not constitute approval.

Block 9: Distribution authorized to the Department of Defense and U.S. DoD contractors only (Critical Technology). Other requests shall be referred to Department of the Navy, Program Executive Officer XXX PMA-xxx, Program Security Manager, 47123 Buse Road B2272 RM445, Patuxent River, MD 20670-1547.

The CDRL deliverable content shall be marked in accordance with the Security Classification Guide(s) listed within the DD Form 254 and marked with appropriate Distribution and Destruction Statements if applicable.

Block 14: Delivery

The delivered documents contain details of potential vulnerabilities and/or attack vectors that require extra safekeeping. For that reason the delivered document submission must utilize one of the following options in the following order:

1. Via encrypted email to PMA-XXX Cyber Security Manager/Program Information System Security Manager ONLY at: ISSM-Name-Here@navy.mil. Confirmation of this deliverable should be emailed to the contract PCO and TPOC via encrypted email. If file(s) are too large to email then;

2. Via Government External SharePoint site; the URL will be provided by the Government. The Government shall approve and provide external SharePoint accounts for this effort. If the Government external SharePoint site is unavailable then;

3. Via compact disc (CD) and registered commercial carrier with prior PISSM approval.

All electronic email messages containing Controlled Unclassified Information (CUI) for delivery to the Government shall be digitally signed and ENCRYPTED FOR TRANSMISSION using a DoD approved External Certificate Authority (ECA) or Government issued PKI certificate. CUI is defined as information that has NOT been publicly released by a Public Affairs Officer (PAO) or FOIA.

All unclassified information on the contract is considered Controlled Unclassified Information (CUI). Per DFARS 252.204-7012, Covered Defense Information (CDI) is considered unclassified information. Per Presidential Directive Order 13556, November 2010 Controlled Unclassified Information (CUI) replaces categories and terms of unclassified information such as For Official Use Only (FOUO), Sensitive But Unclassified (SBU) and Law Enforcement Sensitive (LES) with the intent of utilizing a single term to improve uniformity across all Federal agencies. As CDI is a term for unclassified information it falls under the definition of CUI. CDI then must be treated as CUI. All data requested, provided and/or generated during performance of this requirement is considered Controlled Unclassified Information (CUI)/Covered Defense Information (CDI).

If the aggregate of any of these documents is deemed to be CLASSIFIED then that information must be distributed utilizing the National Industrial Security Program Operating Manual (NISPOM/DoD 5220.22-M) guidance.