PWS Atch 6_NIST SP 800-171 Compliance.pdf
PDF 128 KB Posted
- Solicitation number
- N6264926QE025
About this file
This is a Performance Work Statement (PWS) attachment detailing NIST SP 800-171 compliance requirements for an Oily Wastewater (OWW) Treatment, Recycling, and Disposal Services contract with the Navy (Solicitation Number: N6264925QE0025, Contract Number: N6264926xxxx). The contractor must implement cybersecurity controls to protect Controlled Unclassified Information (CUI) in the form of Operations Security (OPSEC) data, specifically Navy vessel schedules, arrival/departure dates, and movement details used for service scheduling. All communications containing this sensitive data must be marked with the header CUI//SP-OPSEC, transmitted exclusively through encrypted email or approved secure government transfer systems, and stored only on NIST SP 800-171 compliant systems.
The PWS establishes a comprehensive information flow map tracing the lifecycle of vessel scheduling data from government transmission through contractor receipt, internal processing, operational dispatch, and final destruction. The Covered Contractor Information System (CCIS) requiring NIST SP 800-171 compliance encompasses the email server receiving Navy communications, file servers and databases storing dispatch schedules, contractor workstations used by scheduling staff, and mobile devices issued to field operators. Transmission to field operators must utilize encrypted company mobile applications or encrypted mobile email; standard unencrypted SMS messaging is prohibited. Data destruction requirements include digital wiping of databases and mobile devices per NIST 800-88 guidelines and cross-cut shredding of physical manifests. If the contractor uses a segmented network, only the enclave handling CUI requires compliance; other corporate functions remain out of scope.
View the file
Other files
Show all 32
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
PWS Atch (6)
NaƟonal InsƟtute of Standards and Technology (NIST) Specified (SP) 800-171 Compliance
In accordance with DFARS clause 252.204-7012, Safeguarding Covered Defense InformaƟon and Cyber Incident ReporƟng, the contractor shall provide adequate security on all covered contractor informaƟon systems.
SolicitaƟon Number: N6264925QE0025 Contract Number: N6264926xxxx (TBD) Job Title: Oily Wastewater (OWW) Treatment, Recycling, and Disposal Services
1. Controlled Unclassified InformaƟon (CUI)
Performance of this contract will involve CUI. Specifically, the contractor will receive, generate, and store OperaƟons Security (OPSEC) informaƟon, consisƟng of Navy vessel schedules, arrival/departure dates, and movement details provided for service scheduling.
2. CUI Registry Alignment
Because ship schedules are highly sensiƟve operaƟonal data, the contractor must follow the pracƟcal rules below to remain compliant:
CUI Handling Rule: All vessel schedules and movement details provided under this contract are designated as CUI//SP-OPSEC. The contractor shall:
- Mark all communicaƟons containing this data with the header CUI//SP-OPSEC.
- Transmit schedules exclusively via encrypted email or approved secure government transfer systems.
- Store digital schedules only on systems compliant with NIST SP 800-171.
- Destroy physical copies via cross-cut shredding immediately aŌer service delivery."
3. InformaƟon Flow Map OWW Vessel Scheduling (CUI//SP-OPSEC)
The purpose of this mapping is to trace the lifecycle of the sensiƟve ship schedules (CUI//SP-OPSEC) from the moment the Navy sends them to the final destrucƟon of the data, defining exactly which parts of the contractor's network fall under NIST SP 800-171 scope.
ObjecƟve: To define the secure lifecycle, transmission pathways, and system boundaries for Controlled Unclassified InformaƟon (CUI) generated during OWW service coordinaƟon.
Data Types in Scope: Vessel names, hull numbers, arrival/departure dates, specific pier/berth locaƟons, and esƟmated OWW offload volumes.
1. Ingress & Receipt (Government to Contractor)
- Flow: The Technical POC generates the OWW schedule and transmits it to the Contractorʼs designated scheduling POC.
- Transmission Method: End-to-end encrypted email (e.g., DoD Enterprise Email to Contractor secure email) or via DoD SAFE.
- In-Scope Infrastructure: The Contractorʼs external-facing email gateway, firewalls, and the primary email server receiving the CUI.
2. Internal Processing & Storage (Contractor Network)
- Flow: The Contractorʼs scheduling POC extracts the OWW requirements to build a daily dispatch log or master schedule.
- Storage LocaƟon: The data resides on the Contractor's internal scheduling database, local hard drives of authorized users, and backup servers.
- In-Scope Infrastructure: The specific local area network (LAN) segment, servers, and endpoints
(laptops/desktops) used by the scheduling team. Note: If the contractor uses a segmented network, PWS Atch (6) only the enclave handling this data requires NIST SP 800-171 compliance; the rest of their corporate network (e.g., HR, public markeƟng) remains out of scope.
3. OperaƟonal Edge Transmission (Dispatch to Operators)
- Flow: The scheduler transmits specific service details (vessel, Ɵme, pier) to the physical operators (truck drivers, barge captains, or field technicians) execuƟng the OWW offload.
- Transmission Method:
- Digital: Secure, encrypted company mobile applicaƟons or encrypted mobile email. (Standard, unencrypted SMS text messaging of ship schedules is prohibited).
- Physical: Hard-copy printouts (manifests/work orders) physically handed to the driver.
- In-Scope Infrastructure: Company-issued mobile devices (smartphones/tablets) managed via Mobile Device Management (MDM) soŌware, or secure physical lockboxes in the transport vehicles.
4. Egress & DestrucƟon (End of Lifecycle)
- Flow: Upon compleƟon of the OWW offload, the scheduling data is retained only as long as necessary for invoicing, then destroyed.
- DestrucƟon Method:
- Digital: Data is wiped/purged from acƟve dispatch databases and mobile devices in accordance with NIST 800-88 (Guidelines for Media SaniƟzaƟon).
- Physical: Any printed manifests containing ship names and Ɵmes are cross-cut shredded.
- In-Scope Infrastructure: Data retenƟon servers, physical shredders, and billing systems (if the billing system retains specific vessel movement data alongside pricing).
System Scope Boundary (NIST SP 800-171 Applicability) Based on this flow map, the Covered Contractor InformaƟon System (CCIS) requiring NIST SP 800-171 compliance includes:
1. The email server/tenant receiving the Navy emails.
2. The file servers/databases storing the dispatch schedules.
3. The workstaƟons (laptops/PCs) used by the scheduling staff.
4. The mobile devices used by field operators to receive the schedules.
(End of NIST SP 800-171 Compliance)
File details come from the government source that posted it. Updated .