45N_CDRL_A013.doc

CONTRACT DATA REQUIREMENTS LIST

FORM APPROVED

OMB No.0704-0188

Public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instruction, searching existing data sources, gathering and maintaining the data needed and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to, Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188), Washington, DC 20503. Please DO NOT RETURN your form to either of these addresses. Send completed form to the Government Issuing Contract Office for the Contract/PR No. listed in Block E.

1. DATA ITEM NO.

A013

2. TITLE OF DATA ITEM

NAVAIR CYBERSECURITY IMPLEMENTATION PLAN

3. SUBTITLE

4. AUTHORITY (DATA ACQUISITION DOCUMENT NO.)

DI-MGMT-82002A

5. CONTRACT REFERENCE

SOW Para 3.2.10

6. REQUIRING OFFICE

AD4.5.14

7. DD 250 REQ

9. DIST STATEMENT REQUIRED

10. FREQUENCY

One/R

12 DATE OF FIRST SUBMISSION

See BLK 16

14. DISTRIBUTION

b. COPIES

8. APP CODE

A

13. DATE OF SUBSEQUENT SUBMISSION

See BLK 16

Reg Repro

16. REMARKS

BLOCK 4: Contractor format acceptable. Content in accordance with DID.

BLOCK 8: and 13: The Government has 45- working days for review and acceptance or rejection. Contractor has 30-days for re-submittal if accepted with comments or rejected.

BLOCK 9: DISTRIBUTION STATEMENT D, Department of Defense and U.S. DoD contractors only (Critical Technology) (Date). Other requests shall be referred to (Cognizant Program Office assigned at time of award).

BLOCKS 10, 12 and 13: 30 days after contract award, AFTER or any changes or updates.

BLOCK 14: One (1) softcopy (Reg). Softcopy shall be delivered in the original and modifiable application (e.g., MS Word, Excel, AutoCAD, etc.) to:

Building 2185 1130 - B2

22347 Cedar Point Road

Patuxent River, MD 20670

*TBD

DESTRUCTION NOTICE: Follow procedures in DoD 5220.22-M, NISPOM, Section 5-705.

4.5.14 (See Block 16)

7.4 (See Block 16)

15.TOTAL

G. PREPARED BY

H. DATE

21 February 2019

I. APPROVED BY

J. DATE

DD FORM 1423, JUN 90 Previous editions are obsolete Page of Pages

17. PRICE GROUP

18. ESTIMATED

TOTAL PRICE

_1612585403.pdf

DATA ITEM DESCRIPTION

Title: NAVAIR CYBERSECURITY IMPLEMENTATION PLAN

Number: DI-MGMT-82002A Approval Date: 20170523

AMSC Number: N9797 TBD Limitation: TBD

DTIC Applicable: No GIDEP Applicable: No

Preparing Activity: AS Project Number: MGMT-2017-010

Applicable Forms: CSIP Template

Use/relationship: The CSIP will be used to ensure that industry partners are protecting government data set forth by the Cybersecurity Plan (CSP).

This Data Item Description (DID) contains the format, content, and intended use information for the data product resulting from the work task described by the contract.

This DID supersedes DI-MGMT-82002.

Requirements:

1. Reference Documents. The applicable issue of the documents cited herein, including their approval dates and dates of any applicable amendments, notices and revisions, shall be specified in the contract.

2. Format. Contractor’s format acceptance.

3. Content. The content of the CSIP contains the necessary artifacts required by the Authorizing

Official (AO), Functional Authorization Official (FAO), or Program Information System

Security Manager (ISSM) to successfully assess that industry partners are protecting Government data at the required level set forth by the CSP.

3.1 Introduction. This section shall contain a narrative of the CSIP package content.

4. The content of this Cybersecurity Implementation Plan is to document how the contractor proposes to implement the requirements set forth in the Cybersecurity Plan (CSP).

5. Section “G” Assessment & Authorization and section “Q” Software may require additional documentation to validate the requirements set forth in the “G” and “Q” sections of the CSP per

CDRL YYY, Subtitle: Cyber Security System/Software Assurance Report.

A.

CYBERSECURITY . Describe how your company plans on addressing Cyber Security (CS) based on Section

“A” of the CSP. Address all statements in this section. The goal of this section is for the contractor to demonstrate understanding of Information Assurance.

B.

ARCHITECTURE. Describe how your company plans on addressing Information Assurance based on Section

“B” of the CSP. Address all statements in this section. The goal of this section is for the contractor to ensure that the contractor IT infrastructure and the Government IT infrastructure are compatible and interoperable.

Source: http://assist.dla.mil -- Downloaded: 2019-02-05T18:43Z Check the source to verify that this is the current version before use.

C.

CYBERSECURITY PRACTICES. Describe how your company plans on adhering to Cyber Security practices based on Section “C” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will comply with defined IA methodologies for the continual protection of DoN information.

D.

PUBLIC KEY INFRASTRUCTURE (PKI). Describe how your company plans on adhering to Information

Assurance practices based on Section “D” of the CSP. Address all statements in this section. The goal of this section is to articulate how PKI certificates will be acquired and utilized to meet the CSP requirements.

E.

ELECTRONIC MAIL (E-MAIL). Describe how your company plans on adhering to Information Assurance practices based on Section “E” of the CSP. Address all statements in this section. The goal of this section is to articulate how PKI certificates will be utilized with email programs for digital signature and encryption.

F.

DATA AT REST. Describe how your company plans on adhering to Information Assurance practices based on

Section “F” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will fulfil the CSP requirements for securing data at rest.

G.

ASSESSMENT & AUTHORIZATION (A&A). Describe how your company plans on adhering to Cyber

Security practices based on Section “G” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will appropriately support various aspects of the Assessment &

Authorization (A&A) effort. If an Information Technology (IT) system which includes Platform Information

Technology (PIT) systems or a system deemed as a “Control System” is NOT being delivered to the

Government; state that fact and mark the section “not applicable”.

H.

IA POC/IA Workforce. Describe how your company plans on adhering to Information Assurance practices based on Section “H” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will fulfill IA WorkForce requirements. If an IT system is NOT being delivered to the

Government; state that fact and mark the section “not applicable”.

I.

WEB SITES, ELECTRONIC ROOMS (E-ROOMS), & COLLOBORATION TOOLS. Describe how your company plans on adhering to Information Assurance practices based on Section “I” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will appropriately fulfill

CSP requirements to secure the online collaboration and management of government data.

J.

COMMON ACCESS CARDS (CAC) & SAAR-N FORMS. Describe how your company plans on adhering to

Information Assurance practices based on Section “J” of the CSP. Address all statements in this section. The goal of this section is to articulate an understanding of the process and requirements associated with obtaining a

CAC and access to government systems.

K.

CONTRACTOR OWNED UNCLASSIFIED NETWORK SECURITY. Describe how your company plans on adhering to Information Assurance practices based on Section “K” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will protect government-controlled unclassified information while in the contractor’s environment.

L.

INFORMATION SECURITY REQUIREMENTS FOR PROTECTION OF UNCLASSIFIED DOD

INFORMATION ON NON-DOD SYSTEMS. Describe how your company plans on adhering to Information

Assurance practices based on Section “L” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will safeguard unclassified DoD information while stored on non-

DoD information systems. Include any company specific policies and SOP’s currently in place for achieving this goal.

M.

CLASSIFIED SYSTEMS. Describe how your company plans on adhering to Information Assurance practices based on Section “M” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will meet CSP requirements when electronically transmitting classified information. If access to classified information is not a requirement in this contract state that fact and make the section “not applicable”.

N.

CLASSIFIED SPILLAGES. Describe how your company plans on adhering to Information Assurance practices based on Section “N” of the CSP. Address all statements in this section. The goal of this section is for the contractor to acknowledge the CSP requirement to appropriately report all classified spillages within the designated timeframe.

O.

CLASSIFIED RADIOS & TEMPEST CONTROLS. Describe how your company plans on adhering to

Information Assurance practices based on Section “O” of the CSP. Address all statements in this section. The goal of this section is to articulate how the contractor will comply with TEMPEST requirements. If classified radios with TEMPEST controls are NOT being delivered to the Government; state that fact and mark the section “not applicable”.

P.

PROCUREMENT OF CELLULAR TELEPHONES, PDA’S, AIR CARDS AND CALLING CARDS. Describe how your company plans on adhering to Information Assurance practices based on Section “P” of the CSP.

Address all statements in this section. The goal of this section is for the contractor to acknowledge an understanding of relevant procurement instructions and restrictions for use.

Q.

SOFTWARE. Describe in detail how your company plans on adhering to software deliverables based on

Section “Q” of the CSP. Address all statements in this section. The goal of this section is for the contractor to acknowledge an understanding of relevant components of protecting software deliverables. Ensure that each of the subsections are sufficiently explained to determine a software security posture and baseline.

Data Input Validation

Integrity Checking

Software Quality Assurance

Supply Chain Management and Software Assurance

R.

MISC. Describe how your company plans on adhering to requirements in Section “R” Misc. of the CSP.

End of DI-MGMT-82002A