ALD_SOW_App_002_VendorName_DUA_04_24.pdf

D E P A R T M E N T O F T H E A R M Y W A S H I N G T O N

DATA USAGE AGREEMENT

FOR

ARMY LEADER DASHBOARD

(Project #)

SOFTWARE DEMONSTRATIONS

1. References:

a. Department of Defense Manual 5200.1 Volume 3, “DoD Information Security Program: Protection of Classified Information” Change 2, March 19, 2013

b. Department of Defense Manual 5200.1 Volume 4, “DoD Information Security

Program: Controlled Unclassified Information (CUI)” February 24, 2012

2. Purpose: Establish data usage agreement for the appropriate receipt, use, access, transmission, and storage of Army provided data to the entities selected for Software Demonstrations (with Army data) for the Army Leader Dashboard (ALD). The Army provided data is Controlled Unclassified Information (CUI) and is designated For Official Use Only (FOUO). Reference 1.a., provides policy, assigns responsibilities and provides procedures for the designation, marking, protection and dissemination of information of all categories and Enclosure 7, paragraph 9 identifies Personally Identifiable Information (PII) as CUI. Reference 1b. Provides policy, assigns responsibilities and provides procedures for the designation, marking, protection and dissemination of CUI.

3. Scope: This Agreement applies to each entity selected for the ALD Software Demonstrations and Technical Exchanges (hereinafter referred to as “Offerors”), their teaming partners and all employees and other personnel who receive, use, access, transmit or store Army provided data.

4. All offerors in receipt of Army data shall:

a. Flow down all terms and conditions of this usage agreement to their teaming partners and all employees and other personnel who are provided access to the Army data.

b. Ensure the data is only accessed and/or used for the specific purpose as described in U.S. Army Solicitation #_____, in support of Project #_____ Software Demonstration (with Army data).

c. Not share or disclose this data with any other organizations or individuals, unless they have a direct need-to-know in support of the Offeror’s Software Demonstrations.

SUBJECT: Army Leader Dashboard Data Usage Agreement

d. Establish appropriate administrative, technical, and physical safeguards to protect Army data; and comply with applicable DoD standards, regulations, and policies for receiving, accessing, handling, use, and storage of CUI and FOUO information and data. In addition, Protect data-at-rest (DAR) following DoD approved standards for encryption of files on any laptops or digital media storage/drives.

Comply with Defense Acquisition Regulation Supplement (DFARS) 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting.

e. Comply with FAR 52.224-1, Privacy Act Notification; and 52.224-2, Privacy Act, which are incorporated by reference into this agreement and shall be incorporated in any agreements with teaming partners or sub-contractors.

f. Performance of the Software Demonstrations may require offerors to access Personally Identifiable Information (PII), as defined in DoD 5400.11-R, Department of Defense Privacy Program. When dealing with PII, the offeror is required to comply with applicable DoD privacy regulations, instructions, and policies including DoD Directive 5400.11, Department of Defense of Privacy Program; and DoD 5400.11-R, Department of Defense Privacy Program.

g. Performance of the Software Demonstrations may require offerors to access Protected Health Information (PHI). PHI is individually identifiable health information created or received by a health care provider, health plan, public health authority, and/or medical professional that relates to the past, present, or future physical or mental health of an individual, and is transmitted or maintained in electronic, paper, or any other form. When dealing with PHI, the offeror is required to comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the HIPAA Privacy Rule provisions outlined in the DoD Health Information Privacy Regulation, DoD 6025.18-R, January 2003; and DoDI 6025.18, Privacy of Individually Identifiable Health Information in DoD.

h. Ensure if there is a loss, theft, or compromise of any data it is immediately reported to the Agreements Officer at Army Contracting Command – New Jersey (ACC-NJ). For PII data, ensure proper breach reporting and notification procedures are followed as outlined in DoD 5400.11-R (Department of Defense Privacy Program) Chapter 10.6, and that the ACC-NJ Agreements Officer, and the designated official at the Program Executive Officer Enterprise Information Systems are notified immediately upon the discovery of any loss, theft or compromise of any sensitive or PII/PHI data.

i. Ensure that the required Privacy Act and HIPAA training is completed by all individuals with access to the Army data provided for the purpose of executing the

SUBJECT: Army Leader Dashboard Data Usage Agreement

Software Demonstrations. All required Privacy Act and HIPAA training will be conducted online through Army Records Management & Declassification Agency (RMDA) https://www.rmda.army.mil/privacy/RMDA-PO-Training.html to meet the above requirements. Records of training completion will be maintained by the offeror and available to the government upon request.

5. All Government provided data (hard drives) shall be returned to the Government at the completion of the Software Demonstrations. Any copies of the Army data will be turned over to the Government or destroyed at the completion of the Software Demonstrations.

Additionally all data shall be purged from any offeror hardware and/or networks within 8 hours of completion of the final demonstration in accordance with acceptable industry standards. Certification of data purging will be submitted to the Agreements officer within 24 hours of the completion of the Software Demonstrations.

6. The separate inventory of all the files that was furnished with Software Demonstration instructions shall be returned to the government on the final day of Software Demonstrations.

7. In the event of an actual, suspected or potential breach of this DUA, ACC-NJ, in its sole discretion, may restrict further access to Army provided data and require immediate return all such data, copies of data, and government provided hard drives. In addition, other appropriate action in accordance with applicable law and regulation, may be taken.

8. The PEO points of contact for this action are LTC Robert (Rob) Wolfe, 703-545- 8817, or robert.j.wolfe.mil@mail.mil and Ms. Miranda A. Coleman, 703-545-8971, or miranda.a.coleman2.civ@mail.mil.

Agreed to by:

Name

Company

Position/Title

Date https://www.rmda.army.mil/privacy/RMDA-PO-Training.html