USDA Security Language.pdf

52.204-28 Federal Acquisition Supply Chain Security Act Orders—Federal Supply Schedules, Governmentwide Acquisition Contracts, and Multi-Agency Contracts.

FEDERAL ACQUISITION SUPPLY CHAIN SECURITY ACT ORDERS—FEDERAL SUPPLY SCHEDULES,

GOVERNMENTWIDE ACQUISITION CONTRACTS, AND MULTI-AGENCY CONTRACTS (DEC 2023)

(a) Definitions. As used in this clause—

Covered article as defined in 41 U.S.C. 4713(k), means—

(1) Information technology, as defined in 40 U.S.C. 11101, including cloud computing services of all types;

(2) Telecommunications equipment or telecommunications service, as those terms are defined in section

3 of the Communications Act of 1934 ( 47 U.S.C. 153);

(3) The processing of information on a Federal or non-Federal information system, subject to the requirements of the Controlled Unclassified Information program (see 32 CFR part 2002); or

(4) Hardware, systems, devices, software, or services that include embedded or incidental information technology.

FASCSA order, means any of the following orders issued under the Federal Acquisition Supply Chain

Security Act (FASCSA) requiring the removal of covered articles from executive agency information systems or the exclusion of one or more named sources or named covered articles from executive agency procurement actions, as described in 41 CFR 201–1.303(d) and (e):

(1) The Secretary of Homeland Security may issue FASCSA orders applicable to civilian agencies, to the extent not covered by paragraph (2) or (3) of this definition. This type of FASCSA order may be referred to as a Department of Homeland Security (DHS) FASCSA order.

(2) The Secretary of Defense may issue FASCSA orders applicable to the Department of Defense (DoD) and national security systems other than sensitive compartmented information systems. This type of FASCSA order may be referred to as a DoD FASCSA order.

(3) The Director of National Intelligence (DNI) may issue FASCSA orders applicable to the intelligence community and sensitive compartmented information systems, to the extent not covered by paragraph (2) of this definition. This type of FASCSA order may be referred to as a DNI FASCSA order.

Intelligence community, as defined by 50 U.S.C. 3003(4), means the following—

(1) The Office of the Director of National Intelligence;

(2) The Central Intelligence Agency;

(3) The National Security Agency;

(4) The Defense Intelligence Agency;

(5) The National Geospatial-Intelligence Agency;

(6) The National Reconnaissance Office;

(7) Other offices within the Department of Defense for the collection of specialized national intelligence through reconnaissance programs;

(8) The intelligence elements of the Army, the Navy, the Air Force, the Marine Corps, the Coast Guard, the Federal Bureau of Investigation, the Drug Enforcement Administration, and the Department of Energy

(9) The Bureau of Intelligence and Research of the Department of State;

(10) The Office of Intelligence and Analysis of the Department of the Treasury;

(11) The Office of Intelligence and Analysis of the Department of Homeland Security; or

(12) Such other elements of any department or agency as may be designated by the President, or designated jointly by the Director of National Intelligence and the head of the department or agency concerned, as an element of the intelligence community.

National security system, as defined in 44 U.S.C. 3552, means any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency—

(1) The function, operation, or use of which involves intelligence activities; involves cryptologic activities related to national security; involves command and control of military forces; involves equipment that is an integral part of a weapon or weapons system; or is critical to the direct fulfillment of military or intelligence missions, but does not include a system that is to be used for routine administrative and business applications (including payroll, finance, logistics, and personnel management applications); or

(2) Is protected at all times by procedures established for information that have been specifically authorized under criteria established by an Executive order or an Act of Congress to be kept classified in the interest of national defense or foreign policy

Sensitive compartmented information means classified information concerning or derived from intelligence sources, methods, or analytical processes, which is required to be handled within formal access control systems established by the Director of National Intelligence.

Sensitive compartmented information system means a national security system authorized to process or store sensitive compartmented information.

Source means a non-Federal supplier, or potential supplier, of products or services, at any tier.

(b) Notice. During contract performance, the Contractor shall be required to comply with any of the following that apply: DHS FASCSA orders, DoD FASCSA orders, or DNI FASCSA orders. The applicable

FASCSA order(s) will be identified in the request for quotation (see 8.405-2), or in the notice of intent to place an order (see 16.505(b)). FASCSA orders will be identified in paragraph (b)(1) of FAR 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition, with its Alternate II.

(c) Removal. Upon notification from the contracting officer, during the performance of the contract, the

Contractor shall promptly make any necessary changes or modifications to remove any covered article or any product or service produced or provided by a source that is subject to an applicable Governmentwide FASCSA order (see FAR 4.2303(b)).

52.204-30 Federal Acquisition Supply Chain Security Act Orders—Prohibition.

As prescribed in 4.2306(c), insert the following clause:

FEDERAL ACQUISITION SUPPLY CHAIN SECURITY ACT ORDERS—PROHIBITION (DEC 2023)

(a) Definitions. As used in this clause—

Covered article, as defined in 41 U.S.C. 4713(k), means—

(1) Information technology, as defined in 40 U.S.C. 11101, including cloud computing services of all types;

(2) Telecommunications equipment or telecommunications service, as those terms are defined in section

3 of the Communications Act of 1934 ( 47 U.S.C. 153);

(3) The processing of information on a Federal or non-Federal information system, subject to the requirements of the Controlled Unclassified Information program (see 32 CFR part 2002); or

(4) Hardware, systems, devices, software, or services that include embedded or incidental information technology.

FASCSA order means any of the following orders issued under the Federal Acquisition Supply Chain

Security Act (FASCSA) requiring the removal of covered articles from executive agency information systems or the exclusion of one or more named sources or named covered articles from executive agency procurement actions, as described in 41 CFR 201–1.303(d) and (e):

(1) The Secretary of Homeland Security may issue FASCSA orders applicable to civilian agencies, to the extent not covered by paragraph (2) or (3) of this definition. This type of FASCSA order may be referred to as a Department of Homeland Security (DHS) FASCSA order.

(2) The Secretary of Defense may issue FASCSA orders applicable to the Department of Defense (DoD) and national security systems other than sensitive compartmented information systems. This type of FASCSA order may be referred to as a DoD FASCSA order.

(3) The Director of National Intelligence (DNI) may issue FASCSA orders applicable to the intelligence community and sensitive compartmented information systems, to the extent not covered by paragraph (2) of this definition. This type of FASCSA order may be referred to as a DNI FASCSA order.

Intelligence community, as defined by 50 U.S.C. 3003(4), means the following—

(1) The Office of the Director of National Intelligence;

(2) The Central Intelligence Agency;

(3) The National Security Agency;

(4) The Defense Intelligence Agency;

(End of clause)

(5) The National Geospatial-Intelligence Agency;

(6) The National Reconnaissance Office;

(7) Other offices within the Department of Defense for the collection of specialized national intelligence through reconnaissance programs;

(8) The intelligence elements of the Army, the Navy, the Air Force, the Marine Corps, the Coast Guard, the Federal Bureau of Investigation, the Drug Enforcement Administration, and the Department of Energy;

(9) The Bureau of Intelligence and Research of the Department of State;

(10) The Office of Intelligence and Analysis of the Department of the Treasury;

(11) The Office of Intelligence and Analysis of the Department of Homeland Security; or

(12) Such other elements of any department or agency as may be designated by the President, or designated jointly by the Director of National Intelligence and the head of the department or agency concerned, as an element of the intelligence community.

National security system, as defined in 44 U.S.C. 3552, means any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency—

(1) The function, operation, or use of which involves intelligence activities; involves cryptologic activities related to national security; involves command and control of military forces; involves equipment that is an integral part of a weapon or weapons system; or is critical to the direct fulfillment of military or intelligence missions, but does not include a system that is to be used for routine administrative and business applications (including payroll, finance, logistics, and personnel management applications); or

(2) Is protected at all times by procedures established for information that have been specifically authorized under criteria established by an Executive order or an Act of Congress to be kept classified in the interest of national defense or foreign policy.

Reasonable inquiry means an inquiry designed to uncover any information in the entity's possession about the identity of any covered articles, or any products or services produced or provided by a source. This applies when the covered article or the source is subject to an applicable FASCSA order. A reasonable inquiry excludes the need to include an internal or third-party audit.

Sensitive compartmented information means classified information concerning or derived from intelligence sources, methods, or analytical processes, which is required to be handled within formal access control systems established by the Director of National Intelligence.

Sensitive compartmented information system means a national security system authorized to process or store sensitive compartmented information.

Source means a non-Federal supplier, or potential supplier, of products or services, at any tier.

(b) Prohibition.

(1) Unless an applicable waiver has been issued by the issuing official, Contractors shall not provide or use as part of the performance of the contract any covered article, or any products or services produced or provided by a source, if the covered article or the source is prohibited by an applicable FASCSA orders as follows:

(i) For solicitations and contracts awarded by a Department of Defense contracting office, DoD

FASCSA orders apply.

(ii) For all other solicitations and contracts DHS FASCSA orders apply.

(2) The Contractor shall search for the phrase “FASCSA order” in the System for Award Management

(SAM) at https://www.sam.gov to locate applicable FASCSA orders identified in paragraph (b)(1).

(3) The Government may identify in the solicitation additional FASCSA orders that are not in SAM, which are effective and apply to the solicitation and resultant contract.

(4) A FASCSA order issued after the date of solicitation applies to this contract only if added by an amendment to the solicitation or modification to the contract (see FAR 4.2304(c)). However, see paragraph (c) of this clause.

(5)

(i) If the contractor wishes to ask for a waiver of the requirements of a new FASCSA order being applied through modification, then the Contractor shall disclose the following:

(A) Name of the product or service provided to the Government;

(B) Name of the covered article or source subject to a FASCSA order;

(C) If applicable, name of the vendor, including the Commercial and Government Entity code and unique entity identifier (if known), that supplied or supplies the covered article or the product or service to the Offeror;

(D) Brand;

(E) Model number (original equipment manufacturer number, manufacturer part number, or wholesaler number);

(F) Item description;

(G) Reason why the applicable covered article or the product or service is being provided or used;

(ii) Executive agency review of disclosures. The contracting officer will review disclosures provided in paragraph (b)(5)(i) to determine if any waiver is warranted. A contracting officer may choose not to pursue a waiver for covered articles or sources otherwise covered by a FASCSA order and to instead pursue other appropriate action.

(c) Notice and reporting requirement.

(1) During contract performance, the Contractor shall review SAM.gov at least once every three months, or as advised by the Contracting Officer, to check for covered articles subject to FASCSA order(s), or http://www.sam.gov/ for products or services produced by a source subject to FASCSA order(s) not currently identified under paragraph (b) of this clause.

(2) If the Contractor identifies a new FASCSA order(s) that could impact their supply chain, then the

Contractor shall conduct a reasonable inquiry to identify whether a covered article or product or service produced or provided by a source subject to the FASCSA order(s) was provided to the Government or used during contract performance.

(3)

(i) The Contractor shall submit a report to the contracting office as identified in paragraph (c)(3)(ii) of this clause, if the Contractor identifies, including through any notification by a subcontractor at any tier, that a covered article or product or service produced or provided by a source was provided to the Government or used during contract performance and is subject to a FASCSA order(s) identified in paragraph (b) of this clause, or a new FASCSA order identified in paragraph (c)(2) of this clause. For indefinite delivery contracts, the

Contractor shall report to both the contracting office for the indefinite delivery contract and the contracting office for any affected order.

(ii) If a report is required to be submitted to a contracting office under (c)(3)(i) of this clause, the

Contractor shall submit the report as follows:

(A) If a Department of Defense contracting office, the Contractor shall report to the website at https://dibnet.dod.mil.

(B) For all other contracting offices, the Contractor shall report to the Contracting Officer.

(4) The Contractor shall report the following information for each covered article or each product or service produced or provided by a source, where the covered article or source is subject to a FASCSA order, pursuant to paragraph (c)(3)(i) of this clause:

(i) Within 3 business days from the date of such identification or notification:

(A) Contract number;

(B) Order number(s), if applicable;

(C) Name of the product or service provided to the Government or used during performance of the contract;

(D) Name of the covered article or source subject to a FASCSA order;

(E) If applicable, name of the vendor, including the Commercial and Government Entity code and unique entity identifier (if known), that supplied the covered article or the product or service to the

Contractor;

(F) Brand;

(G) Model number (original equipment manufacturer number, manufacturer part number, or wholesaler number);

(H) Item description; and

(I) Any readily available information about mitigation actions undertaken or recommended.

(ii) Within 10 business days of submitting the information in paragraph (c)(4)(i) of this clause:

(A) Any further available information about mitigation actions undertaken or recommended.

(B) In addition, the Contractor shall describe the efforts it undertook to prevent submission or use of the covered article or the product or service produced or provided by a source subject to an applicable

FASCSA order, and any additional efforts that will be incorporated to prevent future submission or use of the covered article or the product or service produced or provided by a source that is subject to an applicable

FASCSA order.

(d) Removal. For Federal Supply Schedules, Governmentwide acquisition contracts, multi-agency contracts or any other procurement instrument intended for use by multiple agencies, upon notification from the Contracting Officer, during the performance of the contract, the Contractor shall promptly make any necessary changes or modifications to remove any product or service produced or provided by a source that is subject to an applicable FASCSA order.

(e) Subcontracts.

(1) The Contractor shall insert the substance of this clause, including this paragraph (e) and excluding paragraph (c)(1) of this clause, in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial products and commercial services.

(2) The Government may identify in the solicitation additional FASCSA orders that are not in SAM, which are effective and apply to the contract and any subcontracts and other contractual instruments under the contract. The Contractor or higher-tier subcontractor shall notify their subcontractors, and suppliers under other contractual instruments, that the FASCSA orders in the solicitation that are not in SAM apply to the contract and all subcontracts.

SERVICES

Alternate I (DEC 2023). As prescribed in 4.2306(c), substitute the following paragraph (b)(1) for paragraph

(b)(1) of the basic clause:

(b) Prohibition. (1) Contractors are prohibited from providing or using as part of the performance of the contract any covered article, or any products or services produced or provided by a source, if the covered article or the source is prohibited by any applicable FASCSA orders identified by the checkbox(es) in this paragraph

(b)(1).

[ Contracting Officer must select either “yes” or “no” for each of the following types of FASCSA orders:]

Yes X No DHS FASCSA Order

Yes No DoD FASCSA Order

(End of clause)

Yes No DNI FASCSA Order

Alternate II (DEC 2023). As prescribed in 4.2306(c)(2)(ii), substitute the following paragraph (b) in place of paragraph (b) of the basic clause. This clause applies to each order as identified by the Contracting Officer.

(b) Prohibition. (1) Contractors are prohibited from providing or using as part of the performance of the contract any covered article, or any products or services produced or provided by a source, if the covered article or the source is prohibited by any applicable FASCSA orders identified by the checkbox(es) in this paragraph

(b)(1).

[ Contracting Officer must select either “yes” or “no” for each of the following types of FASCSA orders:]

Yes X No DHS FASCSA order

Yes No DoD FASCSA order

Yes No DNI FASCSA order

(2) The Contractor shall search for the phrase “FASCSA order” in the System for Award Management

(SAM) at https://www.sam.gov to locate applicable FASCSA orders identified in paragraph (b)(1) of this clause.

(3) The Government may identify in the request for quotation (RFQ) or in the notice of intent to place an order additional FASCSA orders that are not in SAM, but are effective and apply to the order.

(4) A FASCSA order issued after the date of the RFQ or the notice of intent to place an order applies to this contract only if added by an amendment to the RFQ or in the notice of intent to place an order or added by modification to the order (see FAR 4.2304(c)). However, see paragraph (c) of this clause.

(5)(i) If the contractor wishes to ask for a waiver, the Contractor shall disclose the following:

(A) Name of the product or service provided to the Government;

(B) Name of the covered article or source subject to a FASCSA order;

(C) If applicable, name of the vendor, including the Commercial and Government Entity code and unique entity identifier (if known), that supplied the covered article or the product or service to the Offeror;

(D) Brand;

(E) Model number (original equipment manufacturer number, manufacturer part number, or wholesaler number);

(F) Item description;

(G) Reason why the applicable covered article or the product or service is being provided or used;

52.204-29 Federal Acquisition Supply Chain Security Act Orders—Representation and Disclosures.

(ii) Executive agency review of disclosures. The contracting officer will review disclosures provided in paragraph (b)(5)(i) of this clause to determine if any waiver may be sought. A contracting officer may choose not to pursue a waiver for covered articles or sources otherwise covered by a FASCSA order and may instead make award to an offeror that does not require a waiver.

http://www.sam.gov/

As prescribed in 4.2306(b), insert the following provision:

FEDERAL ACQUISITION SUPPLY CHAIN SECURITY ACT ORDERS—REPRESENTATION AND DISCLOSURES (DEC 2023)

(a) Definitions. As used in this provision, Covered article, FASCSA order, Intelligence community, National security system, Reasonable inquiry, Sensitive compartmented information, Sensitive compartmented information system, and Source have the meaning provided in the clause 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition.

(b) Prohibition. Contractors are prohibited from providing or using as part of the performance of the contract any covered article, or any products or services produced or provided by a source, if the prohibition is set out in an applicable Federal Acquisition Supply Chain Security Act (FASCSA) order, as described in paragraph (b)(1) of FAR 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition.

(c) Procedures.

(1) The Offeror shall search for the phrase “FASCSA order” in the System for Award Management (SAM)( https://www.sam.gov) for any covered article, or any products or services produced or provided by a source, if there is an applicable FASCSA order described in paragraph (b)(1) of FAR 52.204-30, Federal Acquisition Supply Chain Security Act Orders—Prohibition.

(2) The Offeror shall review the solicitation for any FASCSA orders that are not in SAM, but are effective and do apply to the solicitation and resultant contract (see FAR 4.2303(c)(2)).

(3) FASCSA orders issued after the date of solicitation do not apply unless added by an amendment to the solicitation.

(d) Representation. By submission of this offer, the offeror represents that it has conducted a reasonable inquiry, and that the offeror does not propose to provide or use in response to this solicitation any covered article, or any products or services produced or provided by a source, if the covered article or the source is prohibited by an applicable FASCSA order in effect on the date the solicitation was issued, except as waived by the solicitation, or as disclosed in paragraph (e).

(e) Disclosures. The purpose for this disclosure is so the Government may decide whether to issue a waiver. For any covered article, or any products or services produced or provided by a source, if the covered article or the source is subject to an applicable FASCSA order, and the Offeror is unable to represent compliance, then the Offeror shall provide the following information as part of the offer:

(1) Name of the product or service provided to the Government;

(2) Name of the covered article or source subject to a FASCSA order;

(3) If applicable, name of the vendor, including the Commercial and Government Entity code and unique entity identifier (if known), that supplied the covered article or the product or service to the Offeror;

(4) Brand;

(5) Model number (original equipment manufacturer number, manufacturer part number, or wholesaler number);

(6) Item description;

(7) Reason why the applicable covered article or the product or service is being provided or used;

(f) Executive agency review of disclosures. The contracting officer will review disclosures provided in paragraph

(e) to determine if any waiver may be sought. A contracting officer may choose not to pursue a waiver for covered articles or sources otherwise subject to a FASCSA order and may instead make an award to an offeror that does not require a waiver.

https://www.acquisition.gov/far/4.2306#FAR_4_2306 https://www.acquisition.gov/far/52.204-30#FAR_52_204_29 https://www.acquisition.gov/far/52.204-30#FAR_52_204_29 https://www.sam.gov/ https://www.acquisition.gov/far/52.204-30#FAR_52_204_29 https://www.acquisition.gov/far/4.2303#FAR_4_2303

C-SCRM Contract Language

USDA Cyber Supply Chain

Risk Management

(C-SCRM)

Contract Language Version 1.0

Approved: Nov 04, 2020

Document Control Information

Version # Author Revision Date

Approval Date

Description of change

1.0 ISC SMD 10/28/2020 11/04/2020 Initial Document

The information contained herein is property of USDA OCIO. Unauthorized reproduction or disclosure of this information in whole or in part is prohibited. Limit distribution accordingly

Table of Contents

1 USDA CYBER SUPPLY CHAIN RISK MANAGEMENT (C-SCRM)

1.1 USDA SCRM Policy

1.2 USDA Supply Chain Risk Review Team

1.3 C-SCRM Methodology

2 COUNTRY OF ORIGIN (COO)

3 PERSONNEL AND CERTIFICATION REQUIREMENTS

3.1 Personnel

3.2 Cybersecurity Certification and Training

4 INFORMATION AND COMMUNICATIONS TECHNOLOGY (ICT) SUPPLY CHAIN RISK MANAGEMENT

(SCRM) SOFTWARE DEVELOPMENT LIFECYCLE (SDLC)

4.1 Continuous Diagnostic and Mitigation (CDM) Approved Products List (APL) Supply Chain Risk Management Plan

4.2 SCRM Plan Submittal and Review

4.3 Manufacturing (Original Equipment Manufacturer (OEM))

4.4 End of Life/Support Products

4.5 Transport/Shipping

4.6 Pre-Deployment

4.7 Deployment

4.8 Operation and Maintenance

4.9 Return USDA Government Furnished Property

5 ALL-INCLUSIVE AREAS WITHIN ICT SCRM SDLC

5.1 Chain of Custody

5.2 Tamper Resistance and Detection

5.3 Incidents

5.4 Vulnerabilities

5.5 USDA’s Audit Rights

5.6 Covered Telecommunication Equipment or Services (Section 889(a)(1)(B))

5.7 Environmental Risks

6 APPENDICES

6.1 [Contractor/Sub-Contractor] Cybersecurity Policy / System Security Plan

6.2 Cybersecurity & Supply Chain Risk Management (SCRM) References

6.3 DEFINITIONS

6.4 Acronyms and Abbreviations

1 USDA CYBER SUPPLY CHAIN RISK MANAGEMENT (C-SCRM)

Cyber Supply Chain Risk Management (C-SCRM) is the process of taking strategic steps to identify, assess and mitigate supply chain risk to departmental and agency information systems, system components and associated services based on analysis of the criticality of system components, services and functions. It covers the entire life cycle of a system (including design, development, distribution, deployment, acquisition, maintenance, and destruction) as supply chain threats and vulnerabilities may intentionally or unintentionally compromise information technology (IT) systems with operational technology (OT) systems (IT/OT) product or service at any stage.

IMPORTANT:

Program offices/CORs shall ensure the appropriate Cybersecurity SCRM language is included in requirements documents (PWS, SOW, SOO) and incorporated into the resultant contract action.

The content of this document is applicable to IT or security related contracts.

C-SCRM contract language is in support the latest publication of:

USDA DR 3540-003 – USDA Security Assessment and Authorization (A&A) Policy, Federal Acquisition Supply Chain Security Act 2018, NIST SP 800-161 - Supply Chain Risk Management Practices for Federal Information Systems and

Organizations, NIST SP 800-37 - Risk Management Framework for Information Systems and Organizations, NIST Cyber Supply Change Risk Management Program, NIST SP 800-39, Managing Information Security Risk and, NIST 800-88 - Guidelines for Media Sanitization.

1.1 USDA SCRM Policy

In line with its federal obligations, the United States Department of Agriculture (USDA) commits itself through the IT Security Strategy and the Information Security Program (SSISP) Policy (in draft) to develop a Supply Chain Risk Management (SCRM) capability to address supply chain risk. USDA SCRM strategy is based on external and organizational requirements and constraints (e.g., applicable laws and regulations). Policies include the purpose and applicability, as well as investment and funding requirements, of any SCRM program.

Based on the USDA supply chain policy, the SCRM identifies:

• Mission/business requirements that will influence SCRM, such as cost, schedule, performance, security, privacy, quality, and safety;

• Information security requirements, including SCRM-specific requirements;

• Organization-wide mission/business functions and how SCRM will be integrated into their processes;

Risk tolerance level for supply chain risks;

A group of individuals across the USDA organization who will address SCRM throughout the organization, known as the USDA SCRM Team; and Ensure that SCRM is appropriately integrated into the organization risk management policies and activities.

1.2 USDA Supply Chain Risk Review Team

Implementing SCRM requires organizations establish a coordinated team-based approach to assess supply chain risk and manage this risk by using programmatic and technical mitigation techniques. The coordinated team approach will enable agencies to conduct a comprehensive analysis of their supply chain, communicate with external partners/stakeholders, and gain broad consensus regarding appropriate resources for SCRM. Details of SCRM Review Team roles and responsibilities are contained in USDA’s SCRM Strategy document [Link].

The SCRM Review Team should consist of members with diverse roles and responsibilities for leading and supporting SCRM activities including information technology, information security, contracting, risk executive, mission/business, legal, supply chain and logistics, acquisition and procurement, and other relevant functions. These individuals may include government personnel or prime [Contractors/Sub-Contractors] hired to provide acquisition services to a government client. Members of the SCRM Review team should be a diverse group of people who are involved in the various aspects of the Software Development Lifecycle (SDLC). Collectively, to aid in SCRM, these individuals should have an awareness of, and provide expertise in organizational acquisition processes, legal practices, vulnerabilities, threats, and attack vectors, as well as an understanding of the technical aspects and dependencies of systems. The USDA Supply Chain Team may be an extension of an organization’s existing information system risk management or include parts of a general risk management team.

1.3 The C-SCRM methodology implements strategies to manage both every day and exceptional risks along the supply chain based on continuous risk assessment with the objective of reducing vulnerability and ensuring continuity. The below sections outline USDA’s C-SCRM methodology.

Section 2: Country of Origin (COO) represents the country or countries of manufacture, production, design, or brand origin

Section 3: Personnel and Certification Requirements

Personnel Certification and Training

Section 4: Information and Communications Technology (ICT) Supply Chain Risk Management (SCRM) Software Development Lifecyle (SDLC) phases:

Manufacturing (Original Equipment Manufacturer) Transport/Shipping Pre-Deployment Deployment Operation and Maintenance Disposition/Return of Government Furnished Property

Section 5: All-Inclusive Areas within the ICT SCRM SDLC:

Chain of Custody Anti-Tampering

C-SCRM Methodology

Identified Incidents USDA Audit Rights

Country of Origin (COO) represents the country or countries of manufacture, production, design, or brand origin. The expectation is: (1) the cargo is what it purports to be and in the quantity stated;

(2) the cargo was in the continuous possession or control by the carrier who took charge of the cargo from the time it was loaded in the container at origin until the time it is delivered at final destination; and (3) there is evidence of the identify of each person or entity who had access to it during its movement and that the cargo remained in the same condition from the moment it was sealed in the container for transfer to the carrier who controlled possession until the moment that carrier released the cargo into the receipted custody of another.

Country of Origin guidelines are as follows:

a) USDA will not use any product or its components (including hardware, software, and firmware) that are on the Department of Commerce Entity List. This includes countries where the development, manufacturing, maintenance, and service for the product are provided.

b) [Contractor/Sub-Contractor] shall identify the country (or countries) of origin of the procured product and its components (including hardware, software, and firmware).

c) [Contractor/Sub-Contractor] will identify the countries where the development, manufacturing, maintenance, and service for the product are provided.

d) [Contractor/Sub-Contractor] will notify USDA of changes in the list of countries where product maintenance or other services are provided in support of the procured product. This notification shall occur # days prior to initiating a change in the list of countries.

e) [Contractor/Sub-Contractor] shall ensure that all-source threat and vulnerability information includes any available foreign ownership and control (FOCI) data. This data should be reviewed periodically as mergers and acquisitions, if affecting a supplier, may impact both threat and vulnerability information and therefore SCRM.

f) [Contractor/Sub-Contractor] shall use trusted channels to ship procured products, such as U.S.

registered mail.

g) [Contractor/Sub-Contractor] shall demonstrate a capability for detecting unauthorized access throughout the delivery processes.

h) [Contractor/Sub-Contractor] shall demonstrate chain-of-custody documentation for procured products as determined by USDA in its sole discretion and require tamper-evident packaging for the delivery of this product.

i) [Contractor/Sub-Contractor] shall implement anti-tamper technologies and techniques that provide a level of protection for critical information systems, system components, and information technology products against known related threats including modification, reverse engineering, and substitution.

COUNTRY OF ORIGIN (COO)

3 PERSONNEL AND CERTIFICATION REQUIREMENTS

3.1.1 Background Check

As part of the Homeland Security Presidential Directive (HSPD) 12, Homeland Security Presidential Directive 12: Policy for a Common Identification Standard for Federal Employees and Contractors, each [Contractor/Sub-Contractor] must provide identity documentation, as set forth in the Form (I-9), and the validity of the documentation is certified by at least three other checks incorporated into the ID-Proofing process.

a) [Contractor/Sub-Contractor] shall comply with the personal identity verification (PIV) policies and procedures established by the Department of Agriculture (USDA) Directives 4620-002 series - Common Identification Standard for U.S. Department of Agriculture Employees and Contractors.

b) Should the results of the PIV process require the exclusion of a [Contractor/Sub- Contractor]’s employee; the Contracting Officer Representative (COR) shall notify the Contracting Officer (CO) in writing.

c) The [Contractor/Sub-Contractor] must appoint a representative to manage compliance with the PIV policies established by the USDA Directives 4620-002 series and to maintain a list of employees eligible for a USDA LincPass required for performance of the work.

d) The responsibility of maintaining a sufficient workforce remains with the [Contractor/Sub-Contractor]. Employees may be barred by the Government from performance of work should they be found ineligible or to have lost eligibility for a USDA LincPass. Failure to maintain a sufficient workforce of employees eligible for a USDA LincPass may be grounds for termination of the contract.

e) The [Contractor/Sub-Contractor] shall insert this clause in all subcontracts when the sub[Contractor/Sub-Contractor] is required to have routine physical access to a federally controlled facility and/or routine access to a federally controlled information system.

f) The PIV Sponsor for this contract is a designated program point of contact, which in most cases is the COR, unless otherwise specified in this contract.

In addition to meeting the requirements of HSPD-12 for PIV (I and II process), all [Contractor/Sub-Contractor]s requiring routine physical access for Federally-controlled facilities and/or routine access to Federally-controlled information systems must have been successfully identity proofed and successfully adjudicated National Agency Check with Written Inquiries (NACI) or Office of Personnel Management (OPM)/National Security (NS) community background investigation to serve on a USDA contract. Contract personnel must have a minimum of a NACI or higher level of background investigation depending on the Position Sensitivity Designation (PSD).

3.1.2 Position Sensitivity Designations (PSDs)

All positions within USDA are assigned Position Sensitivity Designations (PSDs) based upon the risk/damage an unauthorized disclosure would cause to the Agency and/or National Security. This

3.1 Personnel

includes positions occupied by [Contractors/Sub-Contractors]. The Contracting Officer (CO) and/or Contracting Officer Representative (COR) will identify and assign a Position Sensitivity Designation Code to each position that will be occupied by a [Contractor/Sub-Contractor] in the performance of the contract. The CO/COR will advise the [Contractor/Sub-Contractor] of the assigned designation and investigative requirements at the offset of contract talks. The minimum Public Sector Information (PSI) for a [Contractor/Sub-Contractor] is National Agency Check with Law Enforcement and Credit Check (NACLC). However, based upon the assigned sensitivity code, the minimum level PSI may not meet the requirements and a higher level of investigation and/or Security Clearance may be required. The Contracting Officer Representative (COR) will submit all investigative and/or clearance data to the Physical Security Team (PST) five (5) days prior to the [Contractor/Sub- Contractor]’s first day of work. The PSDs are separated into two categories, Public Trust Positions (Risk) and National Security Positions.

a) Public Trust Positions: These positions are identified as Low Risk, Moderate Risk, and High Risk.

They are numerically identified as 1, 5, and 6, respectively. Each of these designations requires a different PSI and a favorable Suitability Determination. Public Trust Positions do not require Personnel Security Clearances.

b) National Security Positions: These positions are identified as Non-Critical Sensitive, Critical

Sensitive and Special Sensitive. They are numerically identified as 2, 3 and 4, respectively. Each of these designations requires a different PSI and a favorable Security Determination. National Security Positions require a Personnel Security Clearance equal to or higher than the level of Access required performing the duties. The level of Clearance is requested at the time the PSI is submitted.

For Position Sensitivity Designation (PSD) for Contract Employees, the [Contractor/Sub-Contractor] will submit proof of their contract employee’s investigative and/or clearance data to the COR five (5) days prior to the [Contractor/Sub-Contractor]’s first day of work.

Only appropriately cleared [Contractors/Sub-Contractors] will be utilized in the performance of this Contract. The Physical Security Team will review all investigated and clearance data submitted by the [Contractor/Sub-Contractor] on behalf of their employees and determine its validity. Should any contract employee be removed for security or suitability reasons, it is incumbent on the Company to provide a replacement that meets or exceeds all PSI and/or Clearance requirements. Any failure of the [Contractor/Sub-Contractor] to comply with the Personnel Security requirements may result in the termination of the [Contractor/Sub-Contractor] and/or Contract for default/cause.

[Contractor/Sub-Contractor] ID credentials will be issued after successful identity proofing of the [Contractor/Sub-Contractor] employee applicant and upon verification of a successfully adjudicated NACI or OPM/NS BI.

For more information about HSPD-12, see https://hspd12.usda.gov/.

3.1.3 [Contractor/Sub-Contractor] System Access The Contracting Officer or Contracting Officer’s Representative will work with the project manager and/or supervisor to determine the appropriate security access required by the

Contractor. USDA will ensure access is commensurable with the functions to be performed by utilizing the RBAC (Role-Based Access Concept).

3.1.4 Non-Disclosure Agreement

All [Contractor/Sub-Contractor] and sub[Contractor/Sub-Contractor] cybersecurity personnel must submit a Non-Disclosure Agreement, “Employee/[Contractor/Sub-Contractor] Non-Disclosure Agreement” form, prior to the commencement of any cybersecurity work on the contract. Further, [Contractor/Sub-Contractor] and sub[Contractor/Sub-Contractor] personnel must submit a Non- Disclosure agreement whenever replacement personnel are proposed. Any information provided by the [Contractor/Sub-Contractor] or sub[Contractor/Sub-Contractor] in the performance of this contract or obtained by the government is only to be used in the performance of this contract.

3.1.5 [Contractor/Sub-Contractor] Termination / Resignation Upon termination, resignation or other event leading to a contract employee leaving duty under this contract, the contract employee is responsible for returning all Government identification, vehicle passes, other Government property or anything considered Government Furnished issued to the employee. Such material shall be returned to the Contracting Officer’s Representative. Failure on the part of the employee to return such property may result in the [Contractor/Sub-Contractor]’s liability for all costs associated with correcting the resultant breech in building security. Refer to FAR for specific details.'

3.2.1 Computing Environment (CE) Certification

The computing environment involves the collection of computer machinery, data storage devices, workstations, software applications, and networks that support the processing and exchange of electronic information demanded by the software solution. The various types of CE include Personal, Time Sharing, Client Server, Distributed, Cloud and Cluster. Therefore, [Contractor/Sub- Contractor] shall have the required certification for the computing environment.

3.2.2 Cybersecurity Maturity Model Certification (CMMC)

USDA SCRM Strategy applies to systems operated by USDA and entities not under the jurisdiction of the USDA Secretary that are employed or contracted to process, transmit, or store USDA information through services such as (but not limited to), platform as a service (PaaS), infrastructure as a service (IaaS), and software as a service (SaaS.). In accordance with USDA DR 3540-003, The Contracting Officer Representative/Program Manager will certify that [Contractor/Sub-Contractor] has the appropriate DOD Cybersecurity Maturity Model Certification (CMMC) level as prescribed by USDA and outlined below.

3.2 Cybersecurity Certification and Training

3.2.3 Information Security Awareness Training

The Contracting Officer Representative/Program Manager will certify that [Contractor/Sub- Contractor] personnel have completed the required Information Security Awareness and Rules of Behavior Training prior to submission of a Security Access Requests.

4 INFORMATION AND COMMUNICATIONS TECHNOLOGY (ICT) SUPPLY CHAIN RISK

Information and Communications Technology (ICT) Supply Chain Risk Management (SCRM) Software Development Lifecyle (SDLC) is implemented as part of overall risk management activities, such as those described in NIST SP 800-39, Managing Information Security Risk. Activities should involve identifying and assessing applicable risks, determining appropriate mitigating actions, developing an ICT SCRM Plan to document selected mitigating actions, and monitoring performance against that Plan.

[Contractor/Sub-Contractor] shall ensure the latest publication of NIST SP 800-161 - Supply Chain Risk Management Practices for Federal Information Systems and Organizations and NIST SP 800-37 - Risk Management Framework for Information Systems and Organizations are incorporated into their ICT SCRM SDLC process.

Consistent with the latest publication of NIST SP 800-161 and NIST SP 800-37, the acquisition community at the USDA and agencies will adopt an ICT SCRM SDLC approach to managing risk to information systems. The USDA, agencies, and personnel will integrate SCRM processes, activities and tasks throughout the life cycle of agency systems, components and services.

MANAGEMENT (SCRM) SOFTWARE DEVELOPMENT LIFECYCLE (SDLC)

The Continuous Diagnostics and Mitigation (CDM) Approved Products List (APL) Product Submission Instructions reference the requirement to submit a Supply Chain Risk Management Plan (SCRM) as part of that activity. The CDM APL SCRM Plan is in support of the National Institute of Standards (NIST) and the latest publication of NIST Special Publication (SP) 800-53 “SA-12” supply chain control.

[Contractor/Sub-Contractor] is responsible for providing the CDM APL SCRM Plan. The purpose of this document is to provide background information on the SCRM requirement and outline the instructions an offeror is to follow in completing and submitting the CDM APL SCRM Plan. The CDM APL SCRM Plan consists of (1) the completed questionnaires and (2) additional information the offeror wishes to provide. APL submission packages that do not include completed CDM-APL-SCRM questionnaires will fail conformance. Additional information can be submitted; APL packages will not fail conformance for the lack of providing SCRM information beyond the questionnaires for CDM-APL-SCRM.

The objective of CDM SCRM Plan is to provide information to Agencies and ordering activities about how the offeror identifies, assesses, and mitigates supply chain risks in order to facilitate better informed decision-making by Agencies and ordering activities. The CDM SCRM Plan is intended to provide visibility into, and improve the buyer’s understanding of, how the Offeror’s proposed products are developed, integrated and deployed; as well as the processes, procedures, and practices used to assure the integrity, security, resilience, and quality of those products.

The contractor shall include a CDM SCRM Plan with its proposal that addresses counterfeit and illegally modified products. The CDM SCRM plan shall describe the contractor’s approach to SCRM and demonstrate how the contractor’s approach will reduce and mitigate supply chain risks. For additional details on GSA’s internal guidance on supply chain risk management, see subpart GSAM 504.70.

The contractor shall provide a CDM SCRM plan to manage supply chain risk throughout each of the five

(5) supply chain phases specified in its proposal: 1) design and engineering, 2) manufacturing and assembly, 3) distribution and warehousing, 4) operations and support, and 5) disposal and return. In addition to the components and processes for which the contractor is directly responsible, and as feasible, the contractor shall identify “specified supporting infrastructure beyond the system boundary” and where appropriate, include such infrastructure in its SCRM Plan.

The CDM SCRM Plan shall address at a minimum, but not be limited to, the following:

1. How the contractor ensures that requirements for genuine Information Technology Tools (ITT) are imposed upon its direct suppliers, whether the direct supplier is a systems integrator, reseller or OEM. The requirements for assurance and supporting evidence must include:

a) The contractor performs reasonable steps to ensure its SCRM Plan is performed for ITT in its delivered and installed configuration;

b) Equipment resellers from whom the contractor purchases ITT have valid licenses for OEM equipment and software;

c) The ITT OEM exercises strict quality control to ensure that counterfeit or illegally modified hardware or software components are not incorporated into the OEM product; and

Chain Risk Management Plan Continuous Diagnostic and Mitigation (CDM) Approved Products List (APL) Supply 4.1

d) The contractor ensures traceability of assurance and evidence of genuineness of ITT back to the licensed product and component OEMs.

2. The contractor’s use of system security engineering processes in specifying and designing a system that is protected against external threats and against hardware and software vulnerabilities.

3. The contractor’s strategy for implementing SCRM security requirements throughout the life of the contract. The SCRM plan shall address the security controls described in the latest publication of NIST SP 800-53. Implementation of the controls shall be tailored in scope to the effort and the specific information.

4. The criticality analysis (CA) process used by the contractor to determine Mission Critical Functions and the protection techniques (countermeasures and sub-countermeasures) used to achieve system protection and mission effectiveness. The CA shall describe the contractor’s supply chain for all critical hardware and software components (and material included in products), key suppliers, and include proof of company ownership and location (on-shore or off-shore) for key suppliers and component manufacturers.

5. How the contractor will ensure that products and components are not repaired and shipped as new products and components are provided to the government.

6. How the contractor will ensure that supply channels are monitored for counterfeit products throughout the product life cycle to include maintenance and repair.

7. How the contractor’s physical and logical delivery mechanisms…