RTP_SEC_AttchC-7_PPIP_Template.docx

Attachment 7 – Contractor Program Protection Implementation Plan (PPIP) Template

CLASSIFY or CONTROL and MARK APPROPRIATELY WHEN FILLED OUT/COMPLETED (If classified, plan MUST be created & transmitted on a Classified Information System)

CLASSIFY or CONTROL and MARK APPROPRIATELY WHEN FILLED OUT/COMPLETED (If classified, plan MUST be created & transmitted on a Classified Information System)

PROPOSER NAME

PROGRAM NAME

PROGRAM PROTECTION IMPLEMENTATION PLAN (PPIP)

VERSION #

DATE

Introduction (Instructional; Not for Inclusion in Contractor PPIP) This sample Contractor Program Protection Implementation Plan (PPIP) Template is intended to inform proposers of example best practices that may be tailored to meet proposal-specific requirements. Proposal-specific requirements will dictate which topics and questions are applicable and potentially introduce new ones. This document is not a checklist, but rather is intended to account for a wide range of scenarios in order to formulate appropriate countermeasures throughout the protection process.

If this PPIP supplements a general or overarching corporate security plan (see Security Factor 4: Security Plan), the proposer must submit both documents for government review. If answers to questions within the PPIP template would be duplicative with the corporate security plan, the proposer may opt to consolidate multiple subsections of the PPIP template or cite the section(s) of the corporate security plan that address the question(s) within the PPIP template.

While the PPIP Contract Deliverable Requirements List (CDRL) deliverable must document, at a minimum, (1) critical technology elements and enabling technologies, (2) threats to, and vulnerabilities, of these items, and (3) selected countermeasures to mitigate associated risks, the initial draft of the PPIP submitted with the proposal only needs to demonstrate the proposer’s process for identifying critical technology elements and selecting countermeasures to mitigate threats to, and vulnerabilities of, these items.

The following five sections are required to address these requirements and provide an iterative record of risk management over the program’s lifecycle:

1. Introduction, Updates, and Responsible Points of Contact (POCs)

2. Technology Element Identification and Impact Assessment

3. Identified Threats and Vulnerabilities

4. Countermeasures and Risk Mitigation Plan

5. Response, Recovery, and Support PPIP Update Record Guidance: Update the following table listing PPIP updates, as necessary.

PPIP Update Record

Contents

1. Introduction, Updates, and Responsible POCs

1.0.1 Program Purpose and Description

Enter Text Here Guidance: Provide a brief description and describe the purpose of the program that will be addressed by this Protection Plan.

1.1.0 Responsible POCs for the Program

Enter Text Here Guidance: Identify the lead personnel who will be responsible for implementing countermeasures (as applicable).

Table 1.1-1 Prime Contractor PPIP POCs (sample)

Program Manager

Lead Systems Engineer

Protection Lead

Physical Security Manager

IT Security Manager

Contracting Officer

Table 1.1-2 Subcontractor/Partner PPIP POCs (sample)

Program Manager

Lead Systems Engineer

Protection Lead

IT Security Manager

2. Technology Element Identification and Impact Assessment Guidance: The initial draft of the PPIP shall demonstrate how the proposer plans to provide a Critical Technology Element (CTE) assessment that identifies all CTEs and reasons why technologies are selected as critical, including reasons why other technologies are not selected as critical; function of the CTE; development history; and other pertinent information. After contract award, subsequent versions of the PPIP will identify specific CTEs including the above information.

Critical Technology Elements (CTEs) may include any combination of unclassified, Controlled Unclassified Information (CUI), or classified elements, information (including Controlled Technical Information (CTI) and system data), technology (critical program information (CPI)) and components (mission-critical functionality) (reference DoDI 5000.83 and the DoD Technology and Program Protection (TPP) Guidebook).

A technology element is “critical” if:

1. the system being acquired depends on this technology element to meet operational requirements (within acceptable cost and schedule limits), and if the technology element or its application is either new or novel or in an area that poses major technological risk during detailed design or demonstration;

2. unauthorized disclosure of the element would reduce U.S. technological superiority, and shorten the combat-effective life of the system as the adversary develops and fields comparable capabilities and/or countermeasures;

3. research, development, and acquisition resources would be required to counter the impact of compromise and regain or maintain the advantage;

4. protection measures are required to deter, delay, detect, and respond to attempts to compromise the element;

5. its failure to perform as designed would result in a total mission failure, a significant and/or unacceptable level of degradation of the mission, or a mission compromise; or

6. the element has the potential to contribute to a significant U.S. intelligence, military, or economic advantage over a foreign country of concern.

2.1.0 Critical Technology Element (CTE) Assessment

Enter Text Here Guidance: Describe how the proposer will conduct, validate, and maintain CTE assessments for all development activities throughout the performance period (reference DoDI 5000.83 and the DoD Technology and Program Protection (TPP) Guidebook).

3. Identified Threats and Vulnerabilities

3.1.0 Program-Specific Threats

Enter Text Here Guidance: The initial draft of the PPIP should briefly describe the proposer’s process for identifying and assessing threats (e.g., adversary collection methods) specific to or assessed as more likely given the program’s content or intent. Proposers should consult with corporate security offices, Defense Counterintelligence and Security Agency (DCSA), or Federal Bureau of Investigation (FBI) field offices (as appropriate), while utilizing publicly available resources to determine applicable threats and vulnerabilities. Examples of lists that NGA leverages to assess potential undue foreign influence and adversary targeting of U.S. technology include but are not limited to:

1. Executive Order 13959 “Addressing the Threat From Securities Investments That Finance Communist Chinese Military Companies”: https://www.govinfo.gov/content/pkg/FR-2020-11-17/pdf/2020-25459.pdf

2. The U.S. Department of Education’s College Foreign Gift and Contract Report: College Foreign Gift Reporting (https://sites.ed.gov/foreigngifts/)

3. The U.S. Department of Commerce, Bureau of Industry and Security, List of Parties of Concern: https://www.bis.doc.gov/index.php/policyguidance/lists-of-parties-of-concern

4. Georgetown University’s Center for Security and Emerging Technology (CSET) Chinese Talent Program Tracker: https://chinatalenttracker.cset.tech

5. Director of National Intelligence (DNI) “World Wide Threat Assessment of the US Intelligence Community”: 2021 Annual Threat Assessment of the U.S. Intelligence Community (https://www.dni.gov/)

6. Various Defense Counterintelligence and Security Agency (DCSA) products regarding targeting of US technologies, adversary targeting of academia, and the exploitation of academic experts: https://www.dcsa.mil/

3.2.0 Program-Specific Vulnerabilities

Enter Text Here Guidance: The initial draft of the PPIP should briefly describe the proposer’s process for identifying and assessing vulnerabilities specific to or assessed as more likely given the program’s content or intent. Proposers should consult with corporate security, counter insider threat office, and/or information technology departments in order to describe a comprehensive approach. Upon contract award, subsequent versions of the PPIP will identify specific vulnerabilities, including how the proposer will maintain awareness of emerging threats and vulnerabilities as they relate to the program.

4. Countermeasures and Risk Mitigation Plan

4.1.0 Personnel

4.1.1 Personnel - Access

Enter Text Here Guidance: Describe the process that will be utilized to grant and document access for personnel who will actively work on the program.

4.1.2 Conflicts of Interest (CoI) and Commitment (CoC)

Enter Text Here Guidance: Describe the methods that will be utilized to identify and resolve reported or discovered conflicts of interest and/or commitment.

4.1.3 Foreign Visits Accountability Plan

Enter Text Here Guidance: Describe the process that is being utilized to track and maintain accountability for foreign visitors (if applicable).

4.1.4 Foreign Travel Accountability Plan

Enter Text Here Guidance: Describe the process that is being utilized to track and maintain accountability for foreign travel.

4.2.0 Foreign Involvement

4.2.1 International Cooperative Development Activities

Enter Text Here Guidance: Describe any planned, existing, or anticipated international cooperative development activities related to the program.

4.2.2 Foreign Vendor Engagements and Procurements

Enter Text Here Guidance: Describe how planned, existing, and anticipated foreign vendor engagements and procurements of critical products and services are reviewed for risk (e.g. malicious software, hardware, deemed exports, unauthorized disclosure, etc.)? How are such engagements documented?

4.2.3 International Traffic in Arms Regulations (ITAR) & Export Administration Regulations (EAR) Compliance Enter Text Here Guidance: Describe how ITAR and EAR procedures will be documented and applied to the program, including deemed exports, if applicable.

4.3.0 Training

4.3.1 Security Education, Training, and Awareness Program

Enter Text Here Guidance: Describe the training conducted to inform personnel about safeguarding critical technology elements and export-controlled items. Additionally, identify the resources utilized to develop the training, identify how often each required training is conducted, and describe the process that is in place for tracking the completion of training.

4.3.2 Insider Threat Program

Enter Text Here Guidance: Describe how the proposer plans to respond to information from multiple sources on concerning behaviors and any risks that could potentially harm NGA or proposer personnel, resources, and capabilities.

4.4.0 Information Technology

4.4.1 NIST SP 800-171 Compliance

Enter Text Here Guidance: Identify whether systems that will be utilized over the course of the program are compliant with NIST SP 800-171 requirements.

4.4.2 NIST SP 800-171 Non-Compliance – Risk Mitigation Plan

Enter Text Here Guidance: Identify non-compliant systems, actions taken to mitigate risk and seek compliance, and timelines for compliance.

4.4.3 Personal Electronic Device Policy

Enter Text Here Guidance: Describe what policies are in place regarding the use of personal electronic devices in the vicinity of work sites, if any.

4.4.4 Cybersecurity Policies

Enter Text Here Guidance: Describe the proposer’s cybersecurity policies and whether they address an enterprise level password policy with multifactor authentication, typosquatting mitigation policy, dark web coverage capability, or enrollment in a bug bounty program.

4.5.0 Physical Security

4.5.1 Physical Access to Systems and Information

Enter Text Here Guidance: Describe the measures that are in place to prevent physical access to information and systems by unauthorized personnel, including physical document and electronic media storage, container type, and access controls.

4.5.2 Document and Media Destruction

Enter Text Here Guidance: Describe the measures that will be implemented regarding physical document and media destruction (reference DoDI 5200.48, NIST SP 800-88, and Section 2002.14 of Title 32, CFR).

4.6.0 Supply Chain Risk Management (SCRM)

4.6.1 Supply Chain Risk Management (SCRM) Assessments

Enter Text Here Guidance: Describe how the proposer will manage risks to the software and hardware supply chain from foreign influence and exploitation, including how to conduct, validate, and maintain Supply Chain Risk Assessments (ref. DoDI 5200.44, NIST SP 800-161, and ICD 731) to provide Supply Chain Risk Management (SCRM) transparency through;

1. Software Bill of Materials (SBOM)[footnoteRef:1] using one of the following industry standard formats: [1: Per E.O. 14028, section 4(e)(vii), all software must have a Software Bill of Materials (SBOM) to serve as a formal record containing details and supply chain relationships of various components used in building software. NGA requires engineering teams to produce an SBOM using the CycloneDX, Software Package Data Exchange (SPDX), or Comma Separated Value (CSV) industry standard format and in accordance with the National Telecommunications & Information Administration’s (NTIA) Minimum Elements For a Software Bill of Materials (SBOM) report.

· CycloneDX;

· Software Package Data Exchange (SPDX); or

· Comma Separated Value (CSV) formatted as follows:

· name – The name of the software component. Using the name from a package manager will yield the best results.

· version (optional, but highly recommended) – The version of the software component. Versions should match the package manager’s versioning exactly.

· org (optional) – The supplier of the software component. This is for your use only.

· repository_id (optional) – The URL of the repository. The URL should be the base URL (e.g., https://github.com/lodash/lodash NOT https://github.com/lodash/lodash/tree/4.17.20)

· package_id (optional) – The package URL (pURL) of the package. The pURL should follow the specifications found here.

· product_id (optional) – The CPE of the software component as it exists in the National Vulnerability Database (NVD). The CPE must exist in the database. Dummy CPEs should not be used.

2. Subsidiary and Acquisition Entity Changes

3. NIST Cybersecurity Framework

4.6.2 Subcontractor/Vendor Management Plan

Enter Text Here Guidance: Describe how the proposer will manage the flow down and oversight of requirements in subcontracts for operationally critical support (i.e., mission critical), and for tasks where subcontract performance involves CTE.

4.7.0 Published Work and Communications Planning

4.7.1 Operations Security Requirements

Enter Text Here Guidance: Describe how the proposer will integrate operational security (OPSEC) best practices into contract performance, including sub-contracts, to protect unclassified but sensitive information IAW DoDM 5205.02.

4.7.2 Disclosure Mitigation

Enter Text Here Guidance: Identify any guidelines in place to protect critical technology elements from disclosure through publishing or communications with the public.

4.7.3 Pre-Publication Review

Enter Text Here Guidance: Describe the process that will be utilized for pre-publication review.

4.8.0 Test Planning, Experimentation, and Evaluation Outside of Protected Environments Guidance: An optional Government Test Plan Template is available separately; it sufficiently covers most testing, experimentation, evaluation scenarios and associated risk mitigations.

4.8.1 Exceptions

Enter Text Here Guidance: Identify any portion of the program that involves elements of testing or evaluation that require an exception to outlined protection requirements.

4.8.2 Exceptions – Risk Mitigation

Enter Text Here Guidance: Describe the process that will be utilized to mitigate previously identified threats or vulnerabilities under these conditions.

5. Response, Recovery, and Support

5.1.0 Reporting Requirements

5.1.1 Response Coordination

Enter Text Here Guidance: List the corporate personnel (e.g., Personnel Security (PERSEC) Managers, Information Security (INFOSEC) Managers, Foreign Disclosure Representatives, and Export Control Representatives) who have been identified as POCs for response coordination.

5.1.2 Reporting

Enter Text Here Guidance: Describe the corporate reporting instructions that will be utilized to coordinate with the government regarding breaches of protection policies.

5.2.0 Remediation

5.2.1 Unauthorized Disclosure

Enter Text Here Guidance: Describe the policies that are in place to ensure appropriate action is taken for violation of disclosure requirements.

5.2.2 Safeguarding Information Technology Systems and Cyber Incident Reporting Enter Text Here Guidance: Describe the policies that are in place to respond to intentional penetrations of cyber and physical security systems (reference DFARS 252.204-7008 and DFARS 252.204-7012).