RTP_SEC_AttchC-6-PWS_SOW Unclass w CUI Security Language vSep 2025.docx
DOCX document 38 KB Posted
- Solicitation number
- HM047627XXXX
About this file
This is a Performance Work Statement/Statement of Work security requirements document for an NGA contract covering work at the unclassified level with access to Controlled Unclassified Information (CUI). Uncleared contractor personnel may work on-site at the contractor facility without security clearances, but any personnel requiring access to NGA systems or facilities must obtain a favorable HSPD-12 adjudication within 60 days; failure to meet this timeline results in loss of system/facility access, and denial of HSPD-12 results in removal from the contract. NGA will sponsor required background investigations. Foreign nationals are prohibited from performing unclassified work without prior written Contracting Officer approval. The contracting officer may direct removal and replacement of unauthorized personnel at contractor expense.
Physical security requirements prohibit contractor personnel from bringing weapons, cell phones, cameras, recording devices, laptops, flash drives, or other removable media into NGA installations or secure facilities; exceptions require prior NGA Security approval with documentation. Information security requirements mandate that contractors comply with NGA, DoD, and Intelligence Community policies for marking, handling, processing, storing, and safeguarding unclassified and CUI material; contractors cannot access, download, print, or disseminate unclassified information outside defined contract requirements without written Contracting Officer Representative (COR) approval. Cybersecurity requirements mandate implementation of 10 U.S.C. Sections 391 and 393 plus NIST SP 800-171 standards; cloud service providers must meet FedRAMP Moderate baseline security standards. Contractors must notify the DoD Cyber Crime Center and COR within 72 hours of discovering cyber incidents affecting covered defense information or operationally critical support capabilities, and must conduct comprehensive reviews to identify compromised systems and data.
View the file
Other files
Show all 28
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
UNCLASSIFIED
Security
Unclassified Work Performance Security Requirements Uncleared Contractor personnel are authorized to work on this contract at the Unclassified level only at the Contractor site without the requirement of a security clearance.
Uncleared Personnel Security Requirements
| Any Contractor personnel working with Controlled Unclassified Information (CUI) must receive a favorable HSPD-12 adjudication within 60 days if they require access to NGA systems or facilities. If a favorable HSPD-12 is not obtained within the 60 day timeline the contractor cannot access NGA systems or facilities. If HSPD-12 is denied, the contractor shall be removed from the contract. NGA will sponsor the HSPD-12 background investigation for Contractor personnel as needed. |
| Foreign nationals are not permitted to perform unclassified work under the terms of this contract without prior written approval from the Contracting Officer (CO) or the COR. Should NGA identify the use of unauthorized personnel, the CO may direct the Contractor, at its own expense, to remove and replace any unauthorized Contractors, Subcontractors, or other personnel performing on the contract. Such action may be taken at the NGA's discretion without prejudice to its rights under any other contract provision, e.g., termination for default. |
Uncleared Contractor personnel visiting NGA facilities or other sites may receive the appropriate visitor badge and be escorted, as appropriate. The Contractor will return the visitor badge at the end of each visit day.
Physical Security Requirements
Contractor personnel are forbidden from bringing prohibited or unauthorized items into any NGA installation or other secure facility covered under this contract. These items include weapons, cell phones, cameras, two-way pagers, laptops, recording devices of any kind, flash drives, or any other removable media. Exceptions may be granted by NGA Security upon the Contractor’s request. If granted, Contractor personnel must bring documentation showing approval prior to entering with the item(s). Violations may subject the Contractor and its offending personnel to civil and/or criminal liability IAW applicable laws and regulations governing access to secure Government facilities.
Information Security Requirements NGA shall have the sole authority to determine whether, and to what extent, protected information shall be provided to the Contractor under the terms of the contract. The Contractor shall not access, download, print, or further disseminate any unclassified information outside the execution of the defined contract requirements without the guidance and written permission from the COR.
When the Contractor receives protected information under the terms of this contract, the Contractor will comply with all applicable NGA, DoD, and IC information security policies for the proper marking, handling, processing, storing, and safeguarding of unclassified and CUI material. The Contractor will ensure that document markings are given the lowest possible security classification to maximize dissemination while still maintaining the information’s confidentiality and integrity as necessary.
Access to CUI will be pursuant to DFARS clause 252.204.7012. The prime contractor shall include this clause, including paragraph (m), in subcontracts, or similar contractual instruments, for operationally critical support or for which subcontract performance will involve covered defense information, including subcontracts for commercial items, without alteration, except to identify the parties. The Contractor shall determine if the information required for Subcontractor performance retains its identity as covered defense information and will require protection under this clause. Contractor personnel shall not release any unclassified information, regardless of medium (e.g., film, tape, document), pertaining to any part of this contract or any program related to this contract, unless the COR has given prior written approval or in performance of a project that has been scoped and negotiated by NGA.
NGA will assess and authorize Contractors to process unclassified information on government-owned information systems, conduct oversight of such information system processing, and provide information system security guidelines IAW with FAR clause 52.204-21 and other information system security control policies, standards, and procedures. Contractor will be responsible for executing specific provisions under the contract for the accreditation of classified information systems, and upon request, shall provide the COR a written statement confirming accreditation compliance with the minimum information systems requirements established in the DD254. The Contractor shall include the substance of FAR clause 52.204-21 in subcontracts under this contract (including subcontracts for the acquisition of commercial products or commercial services, other than commercially available off-the-shelf items), in which the Subcontractor may have federal contract information residing in or transiting through its information system.
In accordance with FAR Part 4.7 and FAR clause 52.215-2, the Contractor may retain one archival copy of any Government-furnished information provided to the Contractor during the course of performance of the contract, subject to Contractor following relevant data safeguarding practices and CUI restrictions. The disposition of such Government-furnished information is otherwise solely at the discretion of the Government. As directed by the NGA CO or COR, the Contractor will destroy or return to NGA all Government-furnished information upon contract termination or when no longer required for contract performance.
Cybersecurity Requirements
| The Contractor must, at a minimum, implement 10 U.S.C. Sections 391 and 393 along with National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” requirements. |
| If the Contractor intends to use an external cloud service provider to store, process, or transmit any covered defense information in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/resources/documents/) |
| In the event that the Contractor discovers a cyber incident that affects a covered Contractor information system or covered defense information residing therein, or that affects the Contractor’s ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the Contractor shall— |
1. Notify the DoD Cyber Crime Center (DC3) and the COR in writing within 72 hours of incident discovery
2. Conduct a review for evidence of compromise of covered defense information, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered Contractor information system(s) that were part of the cyber incident, as well as other information systems on the Contractor’s network(s), that may have been accessed as a result of the incident in order to identify compromised covered defense information, or that affect the Contractor’s ability to provide operationally critical support.
In the event the Contractor discovers and isolates malicious software in connection with a reported cyber incident, the Contractor shall submit the malicious software to DC3 in accordance with instructions provided by the COR. The Contractor should NOT send the malicious software to the COR.
File details come from the government source that posted it. Updated .