PWS Atch 6_NIST SP 800-171 Compliance (20260804).pdf

PWS Atch (6)

National Institute of Standards and Technology (NIST) Specified (SP) 800-171 Compliance

In accordance with DFARS clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, the contractor shall provide adequate security on all covered contractor information systems.

Solicitation Number: N6264926QE0025 Contract Number: N6264926xxxx (TBD) Job Title: Oily Wastewater (OWW) Treatment, Recycling, and Disposal Services

1.0 Controlled Unclassified Information (CUI)

Performance of this contract will involve CUI. Specifically, the contractor will receive, generate, and store Operations Security (OPSEC) information, consisting of Navy vessel schedules, arrival/departure dates, and movement details provided for service scheduling.

2.0 CUI Registry Alignment

Because ship schedules are highly sensitive operational data, the contractor must follow the practical rules below to remain compliant:

CUI Handling Rule: All vessel schedules and movement details provided under this contract are designated as CUI//SP-OPSEC. The contractor shall:

a Mark all communications containing this data with the header CUI//SP-OPSEC.

b Transmit schedules exclusively via encrypted email or approved secure government transfer systems.

C Store digital schedules only on systems compliant with NIST SP 800-171.

d Destroy physical copies via cross-cut shredding immediately after service delivery."

3.0 Information Flow Map OWW Vessel Scheduling (CUI//SP-OPSEC)

The purpose of this mapping is to trace the lifecycle of the sensitive ship schedules (CUI//SP-OPSEC) from the moment the Navy sends them to the final destruction of the data, defining exactly which parts of the contractor's network fall under NIST SP 800-171 scope.

Objective: To define the secure lifecycle, transmission pathways, and system boundaries for Controlled Unclassified Information (CUI) generated during OWW service coordination.

Data Types in Scope: Vessel names, hull numbers, arrival/departure dates, specific pier/berth locations, and estimated OWW offload volumes.

3.1 Ingress & Receipt (Government to Contractor)

a Flow: The Technical POC generates the OWW schedule and transmits it to the Contractorʼs designated scheduling POC.

b Transmission Method: End-to-end encrypted email (e.g., DoD Enterprise Email to Contractor secure email) or via DoD SAFE.

c In-Scope Infrastructure: The Contractorʼs external-facing email gateway, firewalls, and the primary email server receiving the CUI.

3.2 Internal Processing & Storage (Contractor Network)

a Flow: The Contractorʼs scheduling POC extracts the OWW requirements to build a daily dispatch log or master schedule.

b Storage Location: The data resides on the Contractor's internal scheduling database, local hard drives of authorized users, and backup servers.

c In-Scope Infrastructure: The specific local area network (LAN) segment, servers, and endpoints (laptops/desktops) used by the scheduling team. Note: If the contractor uses a segmented network, PWS Atch (6) only the enclave handling this data requires NIST SP 800-171 compliance; the rest of their corporate network (e.g., HR, public marketing) remains out of scope.

3.3 Operational Edge Transmission (Dispatch to Operators)

a Flow: The scheduler transmits specific service details (vessel, time, pier) to the physical operators (truck drivers, barge captains, or field technicians) executing the OWW offload.

b Transmission Method:

b.1 Digital: Secure, encrypted company mobile applications or encrypted mobile email. (Standard, unencrypted SMS text messaging of ship schedules is prohibited).

b.2 Physical: Any printed manifests containing ship names and times are cross-cut shredded reducing paper into tiny particles no larger than 1mm X 5mm.

c In-Scope Infrastructure: Company-issued mobile devices (smartphones/tablets) managed via Mobile

Device Management (MDM) software, or secure physical lockboxes in the transport vehicles.

3.4 Egress & Destruction (End of Lifecycle)

a Flow: Upon completion of the OWW offload, the scheduling data is retained only as long as necessary for invoicing, then destroyed.

b Destruction Method:

b.1 Digital: Data is wiped/purged from active dispatch databases and mobile devices in accordance with NIST 800-88 (Guidelines for Media Sanitization).

b.2 Physical: Any printed manifests containing ship names and times are cross-cut shredded.

c In-Scope Infrastructure: Data retention servers, physical shredders, and billing systems (if the billing system retains specific vessel movement data alongside pricing).

System Scope Boundary (NIST SP 800-171 Applicability) Based on this flow map, the Covered Contractor Information System (CCIS) requiring NIST SP 800-171 compliance includes:

1. The email server/tenant receiving the Navy emails.

2. The file servers/databases storing the dispatch schedules.

3. The workstations (laptops/PCs) used by the scheduling staff.

4. The mobile devices used by field operators to receive the schedules.

(End of NIST SP 800-171 Compliance)