SCRM Evaluation Criteria.pdf

Continuity of Operations

1. Contractor shall provide a COOP plan in the event an emergency shutdown takes place due to natural and/or manmade causes. A well-developed plan will ensure continued operations with minimal impacts during the time of unplanned interruptions with personnel, equipment, facility, networks, information, Information Technology (IT) Systems, and infrastructure critical to the execution of the Company daily productivity. To be acceptable, the contractor’s COOP shall provide the following:

a. Sufficient overview of what information is included in the COOP; definition of COOP;

overview/background of what plan encompasses; general statement of internal/external impact of emergency/disaster on company, overview of efforts to be taken to minimize effects on day-to-day operations; supporting documents reference; identification of how plan is communicated within the company

b. Definitions of responsibilities of management; outline basic strategies/emergency management responsibilities of company and its subsidiaries; delegation of decision-making authority and limitations

c. Clear description of a continuity environment within the company; identifies and analyzes potential scenarios from the risk assessment

d. Outline of the expectations used for the planning process based on planning, research, and real-life events; what the agency can expect to experience when entering the continuity environment, expected impact and operational challenges; identifies operational adjustments; identifies the need to delegate functions; identifies unique needs of the company and anticipated effects on customers

e. Identification of the logic/process in assessing workload/services in order of priority, uses a recognized methodology to assess, rank, and steps taken to prevent/mitigate internal/external risks

f. Identification of any resources that may be necessary to ensure the Company can continue to operate at its continuity site

g. Demonstrate safe practices are in place that are efficient, effective, and ethical in implementing potential impact of the loss of essential, critical functions on the organization.

h. Identification of the ability to facilitate workload/services internally, moving to other worksites, subsidiaries, and or leverage established partnership relationships to promote continuity of daily operations without incurring any additional cost. Any changes to contractual agreement must be pursued through the applicable contracting officers

i. Identification of the use of redundancy/backup/secondary networks, IT structure

j. Outline of potential training policy and its implementation if required due to redistribution of workload/services internally and/or externally

k. Logistics plan for receiving of materials without interruption for parts, workload and services and its end delivery to the customer in a timely, efficient manner

l. Consideration to internal and external contracts in place to satisfy customer requirements ensuring COOP processes are in place within each of those entities in case of disruption to their locations

m. Sound processes in place for the safeguarding of critical systems, applications, data, technology, technical data, processes, material, parts, equipment, and/or sensitive areas/facility during the disruption at facility

n. Sound communication channels in place to communicate with customers and provide regular, timely updates of disruption impacts and progress

Cyber Security

1. Contractor shall provide System Security Plan (SSP) or equivalent that adequately describes network/system framework, system boundaries, system environments of operation, relationships with or connections to other systems, software patches & updates practices, security requirements in place to protect system(s) from compromise and how they are implemented, incident mitigation & reporting, a sound audit process, and communication plan in accordance with

DFARS 252-204-7008, 252.204-7012, 252.239-7018 and/or FAR Clause 52.204-21, and security requirements from NIST SP 80-171 and NIST 800-53. The SSP shall:

a. Clearly demonstrate utilization of best practices in their network/system framework, operations, security/protections measures, systems isolation (connections to shared networks, systems), Incident mitigation, & reporting, auditing tools, and customer communications plans in accordance with DoD guidelines and regulations;

b. Safeguard Critical Defense Information (CDI) and to report to the DoD the possible exfiltration, manipulation, or other loss or compromise of unclassified CDI: or other activities that allow unauthorized access to the contractor’s unclassified information system on which unclassified CDI is resident or transiting;

c. Identify sufficient processes in place for company to provide adequate security for covered defense information that is processed, stored, or transmitted on the contractor's internal information system or network per DFARS Clause 252.204-7012;

d. Identify systems/networks that are accessed by alternate sites, subsidiaries and partners and describes the need for access. Describes whether systems are unclassified/classified.

Describes whether Domestic or Foreign owned;

e. Demonstrate that the contractor’s information system, system component, or information system service prior to selection, acceptance, or updates comply with DoD guidelines and regulations.

2. Contractor shall implement and conduct SCRM, to include Cyber-SCRM in compliance with

DoDI 5000.90. These cybersecurity requirements are to be considered throughout all aspects of planning, maintaining, development, production, and distribution. Contractor shall conduct early and continuous monitoring to prevent or reduce impacts of cyber vulnerabilities where adversaries are able to exploit, steal, alter, manipulate, interrupt, or destroy system functionality, information, or technology. Cyber-SCRM shall include, at a minimum, internal monitoring as well as screening potential vendors and suppliers to determine if they:

a. Provide products and components, or subcomponents, sourced through original equipment manufacturers or government authorized resellers;

b. Have previously incurred any findings of malicious network intrusions, data breaches, loss of client data or intellectual property;

c. Have obtained a CMMC certification level or similar indicating that they practice, at least basic cyber hygiene (e.g., access management, timely patch management, identity management, and password management);

d. Maintains continuous situational awareness of risks and vulnerabilities with considerations to new emerging threats and technologies;

e. Manage supply chain risks including those associated with foreign ownership, control, or influence concerns. This includes companies that currently do, or potentially will, supply

(hardware, software, or firmware) components to the programs. Companies that possess technology relationships with other suppliers or vendors that are known to already be under the influence or control of threat actors.

Foreign Influence

1. Contractor shall ensure security measures are in place to prevent any instance of which foreign interest has the power, direct or indirect, whether or not exercised, and whether or not exercisable through the ownership of the U.S. company's securities, by contractual arrangements or other means, to direct or decide matters affecting the management or operations of that company in a manner which may result in unauthorized access to classified information or may adversely affect the performance of classified contracts.in accordance with DOD 5220.22-M. The Contractors foreign influence plan shall:

a. Identify policies, practices, processes, training and other key elements in place to ensure that foreign firms cannot undermine U.S. security and export controls.

b. Prevent unauthorized access to critical technology, classified information, and special classes of classified information supporting national security.

c. Describe the source, nature and extent of Foreign Ownership Control or Influence

(FOCI), including whether foreign interests hold a majority or substantial minority position in the company, taking into consideration the immediate, intermediate, and ultimate parent companies.

d. Provide information for any/all existing, pending, or upcoming negotiations of mergers, consolidations, reorganizations, partnerships, acquisitions or takeovers by a foreign interest.

e. Describe all bilateral and multilateral security and information exchange agreements.