Research and Technology Protection_BIG-ST BAA_20241220.docx

UNCLASSIFIED

BIG-ST BAA Technology and Program Protection Attachment Version Date: 12/04/2024

UNCLASSIFIED

Technology and Program Protection Attachment Version 12/20/2024

Research and Technology Protection Attachment Program Protection Implementation Plan (PPIP) Template Do not submit the PPIP unless you receive a request from NGA.

Guidance on how to fill out the PPIP will be provided with the PPIP request.

Common Disclosure Forms for Fundamental Research Do not submit the following forms unless you receive a request from NGA.

For awards of fundamental research, NGA will request the submission of two (2) Common Disclosure forms for each covered individual after a proposal is selected for award and annually thereafter, coinciding with delivery of the annual Research Performance Progress Report (RPPR).

1) Common Form for Biographical Sketch.

2) Common Form for Current and Pending (Other) Support Information.

The link to these forms is at: NSTC Research Security Subcommittee NSPM-33 Implementation Guidance Requirements & Standardization (nsf.gov)

a. Due Diligence and Research Security Program Requirements Proposals associated with fundamental research (see General Solicitation, Appendix 6 for definition) shall comply with the following requirements:

(a) The proposing institution must establish and maintain a research security program in accordance with National Security Presidential Memorandum 33 (NSPM-33), including disclosure to NGA of any changes to submitted common disclosure forms, change of covered individuals, and any indicators of participation in a Malign Foreign Talent Recruitment Program (MFTRP) meeting any of the criteria in Sec. 10638(4)(A)(i)-(ix) of the CHIPS and Science Act of 2022.

NGA will conduct risk-based security reviews of the required disclosures in accordance with “Countering Unwanted Foreign Influence in Department-Funded Research at Institutions of Higher Education”, dated 29 June 2023, and section 10632(a)(1) of the CHIPS and Science Act of 2022 (Public Law 117-167), to identify practices or behaviors identified in Table 1 of the “DoD Component Decision Matrix to Inform Fundamental Research Proposal Mitigation Decisions.”

Examples of sources that NGA leverages to assess potential undue foreign influence factors include, but are not limited to:

1. Executive Order 13959 “Addressing the Threat From Securities Investments That Finance Communist Chinese Military Companies”: https://www.govinfo.gov/content/pkg/FR-2020-11-17/pdf/2020-25459.pdf

2. The U.S. Department of Education’s College Foreign Gift and Contract Report: College Foreign Gift Reporting (https://sites.ed.gov/foreigngifts/)

3. The U.S. Department of Commerce, Bureau of Industry and Security, List of Parties of Concern: https://www.bis.doc.gov/index.php/policyguidance/lists-of-parties-of-concern

4. Georgetown University’s Center for Security and Emerging Technology (CSET) Chinese Talent Program Tracker: https://chinatalenttracker.cset.tech

5. Director of National Intelligence (DNI) “World Wide Threat Assessment of the US Intelligence Community”: 2021 Annual Threat Assessment of the U.S. Intelligence Community (https://www.dni.gov/)

6. Various Defense Counterintelligence and Security Agency (DCSA) products regarding targeting of US technologies, adversary targeting of academia, and the exploitation of academic experts: https://www.dcsa.mil/

7. Lists Published in Response to Section 1286 of the National Defense Authorization Act for Fiscal Year 2019 (Public Law 115-232), as amended.

8. Entities Identified as Chinese Military Companies Operating in the United States in accordance with Section 1260H of the William M. (“Mac”) Thornberry National Defense Authorization Act for Fiscal Year 2021 (Public Law 116-283)

9. Department of Commerce International Trade Administration Consolidated Screening List

(b) NGA’s analysis and assessment of affiliations and associations of covered individuals is compliant with Title VI of the Civil Rights Act of 1964. Information regarding race, color, or national origin is not collected and does not have bearing in NGA’s assessment.

(c) Proposing institutions with proposals selected for negotiation that have been assessed as having undue foreign influence risk may be given an opportunity during the negotiation process to mitigate the risk. NGA reserves the right to request any follow-up information needed to assess risk or mitigation strategies.

i. Upon conclusion of the negotiations, if NGA determines, despite any proposed mitigation terms (e.g. mitigation plan, alternative research personnel), the participation of any covered individuals still represents unacceptable risk to the program, or proposed mitigation affects the Government’s confidence in the proposer’s capability to successfully complete the research (e.g., less qualified covered individuals) the Government may determine not to award the proposed effort. Any decision not to award will be predicated upon reasonable disclosure of the pertinent facts and reasonable discussion of any possible alternatives while balancing program award timeline requirements.

(d) Failure of the proposing institution to reasonably exercise due diligence to discover or disclose indicators of participation in a Malign Foreign Talent Recruitment Program (MFTRP), or other disclosures required by NSPM-33, may result in the Government exercising remedies in accordance with federal law and regulation.

i. The performer or recipient must flow down this provision to any subtier contracts or agreements involving direct participation in the performance of the research.

UNCLASSIFIED

UNCLASSIFIED

PPIP_Template.docx Attachment 7 – Contractor Program Protection Implementation Plan (PPIP) Template

CLASSIFY or CONTROL and MARK APPROPRIATELY WHEN FILLED OUT/COMPLETED

(If classified, plan MUST be created & transmitted on a Classified Information System)

CLASSIFY or CONTROL and MARK APPROPRIATELY WHEN FILLED OUT/COMPLETED

(If classified, plan MUST be created & transmitted on a Classified Information System)

PROPOSER NAME

PROGRAM NAME

PROGRAM PROTECTION IMPLEMENTATION PLAN (PPIP)

VERSION #

DATE

Introduction (Instructional; Not for Inclusion in Contractor PPIP)

This sample Contractor Program Protection Implementation Plan (PPIP) Template is intended to inform proposers of example best practices that may be tailored to meet proposal-specific requirements. Proposal-specific requirements will dictate which topics and questions are applicable and potentially introduce new ones. This document is not a checklist, but rather is intended to account for a wide range of scenarios in order to formulate appropriate countermeasures throughout the protection process.

If this PPIP supplements a general or overarching corporate security plan (see Security Factor 4: Security Plan), the proposer must submit both documents for government review. If answers to questions within the PPIP template would be duplicative with the corporate security plan, the proposer may opt to consolidate multiple subsections of the PPIP template or cite the section(s) of the corporate security plan that address the question(s) within the PPIP template.

While the PPIP Contract Deliverable Requirements List (CDRL) deliverable must document, at a minimum, (1) critical technology elements and enabling technologies, (2) threats to, and vulnerabilities, of these items, and (3) selected countermeasures to mitigate associated risks, the initial draft of the PPIP submitted with the proposal only needs to demonstrate the proposer’s process for identifying critical technology elements and selecting countermeasures to mitigate threats to, and vulnerabilities of, these items.

The following five sections are required to address these requirements and provide an iterative record of risk management over the program’s lifecycle:

1. Introduction, Updates, and Responsible Points of Contact (POCs)

2. Technology Element Identification and Impact Assessment

3. Identified Threats and Vulnerabilities

4. Countermeasures and Risk Mitigation Plan

5. Response, Recovery, and Support

PPIP Update Record

Guidance: Update the following table listing PPIP updates, as necessary.

PPIP Update Record

Revision Number

Date

Changes

Approved By

Contents

1. Introduction, Updates, and Responsible POCs

1.0.1 Program Purpose and Description

Enter Text Here

Guidance: Provide a brief description and describe the purpose of the program that will be addressed by this Protection Plan.

1.1.0 Responsible POCs for the Program

Enter Text Here

Guidance: Identify the lead personnel who will be responsible for implementing countermeasures (as applicable).

Table 1.1-1 Prime Contractor PPIP POCs (sample)

Title/Role

Name

Contact Info

Citizenship

Program Manager

Lead Systems Engineer

Protection Lead

Physical Security Manager

IT Security Manager

Contracting Officer

Table 1.1-2 Subcontractor/Partner PPIP POCs (sample)

Title/Role

Name

Contact Info

Citizenship

Program Manager

Lead Systems Engineer

Protection Lead

IT Security Manager

2. Technology Element Identification and Impact Assessment

Guidance: The initial draft of the PPIP shall demonstrate how the proposer plans to provide a Critical Technology Element (CTE) assessment that identifies all CTEs and reasons why technologies are selected as critical, including reasons why other technologies are not selected as critical; function of the CTE; development history; and other pertinent information. After contract award, subsequent versions of the PPIP will identify specific CTEs including the above information.

Critical Technology Elements (CTEs) may include any combination of unclassified, Controlled Unclassified Information (CUI), or classified elements, information (including Controlled Technical Information (CTI) and system data), technology (critical program information (CPI)) and components (mission-critical functionality) (reference DoDI 5000.83 and the DoD Technology and Program Protection (TPP) Guidebook).

A technology element is “critical” if:

1. the system being acquired depends on this technology element to meet operational requirements (within acceptable cost and schedule limits), and if the technology element or its application is either new or novel or in an area that poses major technological risk during detailed design or demonstration;

2. unauthorized disclosure of the element would reduce U.S. technological superiority, and shorten the combat-effective life of the system as the adversary develops and fields comparable capabilities and/or countermeasures;

3. research, development, and acquisition resources would be required to counter the impact of compromise and regain or maintain the advantage;

4. protection measures are required to deter, delay, detect, and respond to attempts to compromise the element;

5. its failure to perform as designed would result in a total mission failure, a significant and/or unacceptable level of degradation of the mission, or a mission compromise; or

6. the element has the potential to contribute to a significant U.S. intelligence, military, or economic advantage over a foreign country of concern.

2.1.0 Critical Technology Element (CTE) Assessment

Enter Text Here

Guidance: Describe how the proposer will conduct, validate, and maintain CTE assessments for all development activities throughout the performance period (reference DoDI 5000.83 and the DoD Technology and Program Protection (TPP) Guidebook).

3. Identified Threats and Vulnerabilities

3.1.0 Program-Specific Threats

Enter Text Here

Guidance: The initial draft of the PPIP should briefly describe the proposer’s process for identifying and assessing threats (e.g., adversary collection methods) specific to or assessed as more likely given the program’s content or intent. Proposers should consult with corporate security offices, Defense Counterintelligence and Security Agency (DCSA), or Federal Bureau of Investigation (FBI) field offices (as appropriate), while utilizing publicly available resources to determine applicable threats and vulnerabilities. Examples of lists that NGA leverages to assess potential undue foreign influence and adversary targeting of U.S. technology include but are not limited to:

1. Executive Order 13959 “Addressing the Threat From Securities Investments That Finance Communist Chinese Military Companies”: https://www.govinfo.gov/content/pkg/FR-2020-11-17/pdf/2020-25459.pdf

2. The U.S. Department of Education’s College Foreign Gift and Contract Report: College Foreign Gift Reporting (https://sites.ed.gov/foreigngifts/)

3. The U.S. Department of Commerce, Bureau of Industry and Security, List of Parties of Concern: https://www.bis.doc.gov/index.php/policyguidance/lists-of-parties-of-concern

4. Georgetown University’s Center for Security and Emerging Technology (CSET) Chinese Talent Program Tracker: https://chinatalenttracker.cset.tech

5. Director of National Intelligence (DNI) “World Wide Threat Assessment of the US Intelligence Community”: 2021 Annual Threat Assessment of the U.S. Intelligence Community (https://www.dni.gov/)

6. Various Defense Counterintelligence and Security Agency (DCSA) products regarding targeting of US technologies, adversary targeting of academia, and the exploitation of academic experts: https://www.dcsa.mil/

3.2.0 Program-Specific Vulnerabilities

Guidance: The initial draft of the PPIP should briefly describe the proposer’s process for identifying and assessing vulnerabilities specific to or assessed as more likely given the program’s content or intent. Proposers should consult with corporate security, counter insider threat office, and/or information technology departments in order to describe a comprehensive approach. Upon contract award, subsequent versions of the PPIP will identify specific vulnerabilities, including how the proposer will maintain awareness of emerging threats and vulnerabilities as they relate to the program.

4. Countermeasures and Risk Mitigation Plan

4.1.0 Personnel

4.1.1 Personnel - Access

Guidance: Describe the process that will be utilized to grant and document access for personnel who will actively work on the program.

4.1.2 Conflicts of Interest (CoI) and Commitment (CoC)

Enter Text Here

Guidance: Describe the methods that will be utilized to identify and resolve reported or discovered conflicts of interest and/or commitment.

4.1.3 Foreign Visits Accountability Plan

Enter Text Here

Guidance: Describe the process that is being utilized to track and maintain accountability for foreign visitors (if applicable).

4.1.4 Foreign Travel Accountability Plan

Enter Text Here

Guidance: Describe the process that is being utilized to track and maintain accountability for foreign travel.

4.2.0 Foreign Involvement

4.2.1 International Cooperative Development Activities

Guidance: Describe any planned, existing, or anticipated international cooperative development activities related to the program.

4.2.2 Foreign Vendor Engagements and Procurements

Enter Text Here

Guidance: Describe how planned, existing, and anticipated foreign vendor engagements and procurements of critical products and services are reviewed for risk (e.g. malicious software, hardware, deemed exports, unauthorized disclosure, etc.)? How are such engagements documented?

4.2.3 International Traffic in Arms Regulations (ITAR) & Export Administration Regulations (EAR) Compliance

Enter Text Here

Guidance: Describe how ITAR and EAR procedures will be documented and applied to the program, including deemed exports, if applicable.

4.3.0 Training

4.3.1 Security Education, Training, and Awareness Program

Guidance: Describe the training conducted to inform personnel about safeguarding critical technology elements and export-controlled items. Additionally, identify the resources utilized to develop the training, identify how often each required training is conducted, and describe the process that is in place for tracking the completion of training.

4.3.2 Insider Threat Program

Guidance: Describe how the proposer plans to respond to information from multiple sources on concerning behaviors and any risks that could potentially harm NGA or proposer personnel, resources, and capabilities.

4.4.0 Information Technology

4.4.1 NIST SP 800-171 Compliance

Guidance: Identify whether systems that will be utilized over the course of the program are compliant with NIST SP 800-171 requirements.

4.4.2 NIST SP 800-171 Non-Compliance – Risk Mitigation Plan

Enter Text Here

Guidance: Identify non-compliant systems, actions taken to mitigate risk and seek compliance, and timelines for compliance.

4.4.3 Personal Electronic Device Policy

Enter Text Here

Guidance: Describe what policies are in place regarding the use of personal electronic devices in the vicinity of work sites, if any.

4.4.4 Cybersecurity Policies

Guidance: Describe the proposer’s cybersecurity policies and whether they address an enterprise level password policy with multifactor authentication, typosquatting mitigation policy, dark web coverage capability, or enrollment in a bug bounty program.

4.5.0 Physical Security

4.5.1 Physical Access to Systems and Information

Guidance: Describe the measures that are in place to prevent physical access to information and systems by unauthorized personnel, including physical document and electronic media storage, container type, and access controls.

4.5.2 Document and Media Destruction

Enter Text Here

Guidance: Describe the measures that will be implemented regarding physical document and media destruction (reference DoDI 5200.48, NIST SP 800-88, and Section 2002.14 of Title 32, CFR).

4.6.0 Supply Chain Risk Management (SCRM)

4.6.1 Supply Chain Risk Management (SCRM) Assessments

Guidance: Describe how the proposer will manage risks to the software and hardware supply chain from foreign influence and exploitation, including how to conduct, validate, and maintain Supply Chain Risk Assessments (ref. DoDI 5200.44, NIST SP 800-161, and ICD 731) to provide Supply Chain Risk Management (SCRM) transparency through;

1. Software Bill of Materials (SBOM)[footnoteRef:1] using one of the following industry standard formats: [1: Per E.O. 14028, section 4(e)(vii), all software must have a Software Bill of Materials (SBOM) to serve as a formal record containing details and supply chain relationships of various components used in building software. NGA requires engineering teams to produce an SBOM using the CycloneDX, Software Package Data Exchange (SPDX), or Comma Separated Value (CSV) industry standard format and in accordance with the National Telecommunications & Information Administration’s (NTIA) Minimum Elements For a Software Bill of Materials (SBOM) report.

· CycloneDX;

· Software Package Data Exchange (SPDX); or

· Comma Separated Value (CSV) formatted as follows:

· name – The name of the software component. Using the name from a package manager will yield the best results.

· version (optional, but highly recommended) – The version of the software component. Versions should match the package manager’s versioning exactly.

· org (optional) – The supplier of the software component. This is for your use only.

· repository_id (optional) – The URL of the repository. The URL should be the base URL (e.g., https://github.com/lodash/lodash NOT https://github.com/lodash/lodash/tree/4.17.20)

· package_id (optional) – The package URL (pURL) of the package. The pURL should follow the specifications found here.

· product_id (optional) – The CPE of the software component as it exists in the National Vulnerability Database (NVD). The CPE must exist in the database. Dummy CPEs should not be used.

2. Subsidiary and Acquisition Entity Changes

3. NIST Cybersecurity Framework

4.6.2 Subcontractor/Vendor Management Plan

Enter Text Here

Guidance: Describe how the proposer will manage the flow down and oversight of requirements in subcontracts for operationally critical support (i.e., mission critical), and for tasks where subcontract performance involves CTE.

4.7.0 Published Work and Communications Planning

4.7.1 Operations Security Requirements

Guidance: Describe how the proposer will integrate operational security (OPSEC) best practices into contract performance, including sub-contracts, to protect unclassified but sensitive information.

4.7.2 Disclosure Mitigation

Enter Text Here

Guidance: Identify any guidelines in place to protect critical technology elements from disclosure through publishing or communications with the public.

4.7.3 Pre-Publication Review

Enter Text Here

Guidance: Describe the process that will be utilized for pre-publication review.

5. Response, Recovery, and Support

5.1.0 Reporting Requirements

5.1.1 Response Coordination

Guidance: List the corporate personnel (e.g., Personnel Security (PERSEC) Managers, Information Security (INFOSEC) Managers, Foreign Disclosure Representatives, and Export Control Representatives) who have been identified as POCs for response coordination.

5.1.2 Reporting

Enter Text Here

Guidance: Describe the corporate reporting instructions that will be utilized to coordinate with the government regarding breaches of protection policies.

5.2.0 Remediation

5.2.1 Unauthorized Disclosure

Guidance: Describe the policies that are in place to ensure appropriate action is taken for violation of disclosure requirements.

5.2.2 Safeguarding Information Technology Systems and Cyber Incident Reporting

Guidance: Describe the policies that are in place to respond to intentional penetrations of cyber and physical security systems (reference DFARS 252.204-7008 and DFARS 252.204-7012).

image1.emf