ATT0037 REVISED ST-1 CDRL SE008 Post Deployment Meeting.pdf

DD FORM 1423-1, FEB 2001

CONTRACT DATA REQUIREMENTS LIST

(1 Data Item)

PREVIOUS EDITION MAY BE USED.

Form Approved OMB No. 0704-0188

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Executive Services Directorate (0704-0188). Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. Please do not return your form to the above organization. Send completed form to the Government Issuing Contracting Officer for the Contract/PR No. listed in Block E.

A. CONTRACT LINE ITEM NO. B. EXHIBIT C. CATEGORY:

TDP ________ TM _______ OTHER

D. SYSTEM/ITEM E. CONTRACT/PR NO. F. CONTRACTOR

1. DATA ITEM NO. 2. TITLE OF DATA ITEM 3. SUBTITLE

4. AUTHORITY (Data Acquisition Document No.) 5. CONTRACT REFERENCE 6. REQUIRING OFFICE

7. DD 250 REQ

8. APP CODE

9. DIST STATEMENT

REQUIRED

10. FREQUENCY

11. AS OF DATE

12. DATE OF FIRST SUBMISSION

13. DATE OF SUBSEQUENT

SUBMISSION

14. DISTRIBUTION

a. ADDRESSEE

b. COPIES

Draft Final

Reg Repro

15. TOTAL

16. REMARKS

17. PRICE GROUP

18. ESTIMATED

TOTAL PRICE

G. PREPARED BY H. DATE I. APPROVED BY J. DATE

Page of Pages

CONTRACT DATA REQUIREMENTS LIST

(1 Data Item)

A. CONTRACT LINE ITEM NO. B. EXHIBIT C. CATEGORY:

TDP ________ TM _______ OTHER

D. SYSTEM/ITEM E. CONTRACT/PR NO. F. CONTRACTOR

16. REMARKS (Continued)

DD FORM 1423-1, FEB 2001 Page of Pages

INSTRUCTIONS FOR COMPLETING DD FORM 1423

(See DoD 5010.12-M for detailed instructions.)

FOR GOVERNMENT PERSONNEL

Item A. Self-explanatory.

Item B. Self-explanatory.

Item C. Mark (X) appropriate category: TDP - Technical Data Package;

TM - Technical Manual; Other - other category of data, such as "Provisioning,""Configuration Management," etc.

Item D. Enter name of system/item being acquired that data will support.

Item E. Self-explanatory (to be filled in after contract award).

Item F. Self-explanatory (to be filled in after contract award).

Item G. Signature of preparer of CDRL.

Item H. Date CDRL was prepared.

Item I. Signature of CDRL approval authority.

Item J. Date CDRL was approved.

Item 1. See DoD FAR Supplement Subpart 4.71 for proper numbering.

Item 2. Enter title as it appears on data acquisition document cited in Item 4.

Item 3. Enter subtitle of data item for further definition of data item (optional entry).

Item 4. Enter Data Item Description (DID) number, military specification number, or military standard number listed in DoD 5010.12-L (AMSDL), or one-time DID number, that defines data content and format requirements.

Item 5. Enter reference to tasking in contract that generates requirement for the data item (e.g., Statement of Work paragraph number).

Item 6. Enter technical office responsible for ensuring adequacy of the data item.

Item 7. Specify requirement for inspection/acceptance of the data item by the Government.

Item 8. Specify requirement for approval of a draft before preparation of the final data item.

Item 9. For technical data, specify requirement for contractor to mark the appropriate distribution statement on the data (ref. DoDD 5230.24).

Item 10. Specify number of times data items are to be delivered.

Item 11. Specify as-of date of data item, when applicable.

Item 12. Specify when first submittal is required.

Item 13. Specify when subsequent submittals are required, when applicable.

Item 14. Enter addressees and number of draft/final copies to be delivered to each addressee. Explain reproducible copies in Item 16.

Item 15. Enter total number of draft/final copies to be delivered.

Item 16. Use for additional/clarifying information for Items 1 through 15.

Examples are: Tailoring of documents cited in Item 4; Clarification of submittal dates in Items 12 and 13; Explanation of reproducible copies in Item 14.; Desired medium for delivery of the data item.

FOR THE CONTRACTOR

Item 17. Specify appropriate price group from one of the following groups of effort in developing estimated prices for each data item listed on the DD Form 1423.

a. Group I. Definition - Data which is not otherwise essential to the contractor's performance of the primary contracted effort (production, development, testing, and administration) but which is required by DD Form 1423.

Estimated Price - Costs to be included under Group I are those applicable to preparing and assembling the data item in conformance with Government requirements, and the administration and other expenses related to reproducing and delivering such data items to the Government.

b. Group II. Definition - Data which is essential to the performance of the primary contracted effort but the contractor is required to perform additional work to conform to Government requirements with regard to depth of content, format, frequency of submittal, preparation, control, or quality of the data item.

Estimated Price - Costs to be included under Group II are those incurred over and above the cost of the essential data item without conforming to Government requirements, and the administrative and other expenses related to reproducing and delivering such data item to the Government.

c. Group III. Definition - Data which the contractor must develop for his internal use in performance of the primary contracted effort and does not require any substantial change to conform to Government requirements with regard to depth of content, format, frequency of submittal, preparation, control, and quality of the data item.

Estimated Price - Costs to be included under Group III are the administrative and other expenses related to reproducing and delivering such data item to the Government.

d. Group IV. Definition - Data which is developed by the contractor as part of his normal operating procedures and his effort in supplying these data to the Government is minimal.

Estimated Price - Group IV items should normally be shown on the DD Form 1423 at no cost.

Item 18. For each data item, enter an amount equal to that portion of the total price which is estimated to be attributable to the production or development for the Government of that item of data.

These estimated data prices shall be developed only from those costs which will be incurred as a direct result of the requirement to supply the data, over and above those costs which would otherwise be incurred in performance of the contract if no data were required. The estimated data prices shall not include any amount for rights in data. The Government's right to use the data shall be governed by the pertinent provisions of the contract.

DD FORM 1423-1 (BACK), FEB 2001

Post Deployment Checklist

Instructions Begin on Page 3

Section 1 – System & Deliverable

1.1

System Name: Click here to enter System Name.

1.2

Deliverable Type: Choose an item.

Section 2 – POC Information

2.1

Contract Lead: Click here to enter name.

2.2

Government Lead: Click here to enter name.

2.3

SPL: Choose an item.

2.4

Group:

Section 3 – Dates

3.1

Post Deployment Meeting: Click here to enter a date.

3.2

Final Review: Click here to enter a date.

Section 4 – Data Collection and Verification

☐ Assessment Team has received all data and artifacts

Click here to enter comments identifying any data or artifacts pending collection

☐ Data and artifacts have been collected and consolidated

Click here to enter comments related to collected data or artifacts

Section 5 – Assessment Issues

Click here to enter comments identifying any issues during the assessment with tools or other methods or procedures

Section 6 – System Mission

NOTE: The System Mission must include items identified in section 6.1. Additional questioning may be required by the Assessment Team during the assessment to obtain all information related to the System Mission.

Click here to enter System Description.

Section 6.1 - System Mission Verification

· Program / Organization that owns the system

· Criticality & availability requirements of the mission (MAC/CL level or C-I-A categorization)

· Purpose of system

· System data (produced, transmitted, processed, or stored)

· System and/or mission impact of data being compromised, manipulated, or lost

Section 7 – System Description

NOTE: The System Description must include items identified in Section 7.1. Additional questioning may be required by the Assessment Team during the assessment to obtain all information related to the System Description.

Click here to enter System Description.

Section 7.1 - System Description Verification

· System boundary explained

· System components identified (accurate HW/SW lists)

· Reliance on external (outside the boundary) services

· Data interchange or exchange with other systems

· Physical location or fielding conditions of the system

· Explain users of the system (user types and roles)

· Explain user interface for all user types (how do user types interface with the system)

· Connectivity and accessibility (from what network(s) is the system accessible “from” and/or connected “to”)

Section 8 – Review Security Control Families (from Out Brief)

· Review Security Control Assessment overview from Out Brief – status of preliminary compliance

Section 9 – System Baseline & Sampling Review

NOTE: To qualify as “like” devices, the equipment must be of the same manufacture & model, have the same software installed, perform the same function, exist in the same operational environment, and be administered by the same group.

· Baselines or groups of like systems correctly identified

· Quantity of devices in each baseline or group of like systems identified

· Sample rate per baseline or group of like systems achieved

Section 10 – Collected Data Review

· Review collected documentation (Downloaded from eMASS)

· Review HW & SW list

· Review diagrams

· Review configuration scans (ICAT & SCC)

· Review vulnerability scans (Nessus (ACAS))

· Review collected configuration files of appliances, network devices, and/or ancillary devices

· Review completed STIG checklist files

· Review preliminary data analysis (Vulnerator or other data analysis tool)

· Review preliminary documentation analysis

Section 11 – 14 will be used during the Final Deliverable Review process.

Section 11 – Data Collection and Archive File Structure (DCAFS) Review

· Review archive media for structure and content

Section 12 – Analysis Review

· Review data analysis

· Review document analysis

Section 13 – Deliverable Package Review

· All CCI results and security control vulnerabilities have been completed in eMASS

· The SCA-V TTP processes have been followed

· The Cybersecurity Manual procedures have been followed

· DCAFS folder is complete with all required data

· Current templates are used

· Naming convention is consistent

· Review SAR (Copy downloaded from eMASS)

· Review SCA-V memorandum (and enclosure if applicable)

Section 14 – SharePoint

· Project listed in SharePoint

· Project status is “Staffing” at the time of the final review

· All required fields are populated and accurate

Comments

Click here to enter comments.

Post Deployment Checklist Instructions

Section 1 – System & Deliverable

For Contract Efforts, Contract Lead populates System Name and Deliverable Type

For Non-Contract Efforts, Government Lead populates System Name and Deliverable Type

Section 2 – POC Information

For Contract Efforts, Contract Lead populates Contract Lead Name and Government Lead

For Non-Contract Efforts, Government Lead populates Government Lead Name and types ‘NONE’ in Contract Lead Name

For all efforts, Government Lead populates SPL and Group

Section 3 – Dates

Government Lead populates Post Deployment Meeting with the scheduled date

Government Lead populates Final Review with the scheduled date

Section 4 – Data Collection and Verification

For Contract Efforts, Contract Lead verifies that all data and artifacts have been collected and are organized and ready for review, enter comments as needed

For Non-Contract Efforts, Government Lead verifies that all data and artifacts have been collected and are organized and ready for review, enter comments as needed

Section 5 – Assessment Issues

For Contract Efforts, Contract Lead enters comments related to assessment issues

For Non-Contract Efforts, Government Lead enters comments related to assessment issues

Section 6 – System Mission

For Contract Efforts, Contract Lead enters the System Mission. System Mission information will be validated via section 6.1 checklist items

For Non-Contract Efforts, Government Lead enters the System Mission. System Mission information will be validated via section 6.1 checklist items

Section 7 – System Description

For Contract Efforts, Contract Lead enters the System Description. System Description information will be validated via section 7.1 checklist items

For Non-Contract Efforts, Government Lead enters the System Description. System Description information will be validated via section 7.1 checklist items

Section 8 – 14

These sections are used as review points during the Post Deployment and Final Review to assist with the review of data, artifact analysis, and reports; no action is required to populate or enter any information

Comments

Use the comments section to identify any information not covered in other sections

Post Deployment Checklist Instructions (Continued)

· For Contract Efforts

· Contract Lead populates all fields where ‘Contract Lead’ is identified as the responsible individual

· Contract Lead will provide the Post Deployment Checklist to the Government per Contract Deliverables Requirements

· Government Lead will publish the Post Deployment Checklist to the Directorate’s SharePoint Portal in the appropriate Project Documents folder PRIOR to the Post Deployment Meeting

· For Non-Contract Efforts

· Government Lead populates all fields where ‘Government Lead’ is identified as the responsible individual

· Government Lead will publish the completed Post Deployment Checklist to the Directorate’s SharePoint Portal in the appropriate Project Documents folder PRIOR to the Post Deployment Meeting

Format: Template provided as part of the Cybersecurity Assessment and Security Engineering Manual.

Content: Provide deliverable that is technically sound, logically organized, coherent, and free of typographical and grammatical errors following the approved template provided in the Cybersecurity Assessment and Security Engineering Manual.

Method of delivery: One (1) soft copy of the checklist shall be submitted to the Technical Monitor, Contracting Officer’s Representative (COR) and Government Project Lead via CD/DVD or e-mail, and included as an artifact in the DCAFS Archive. The checklist shall be fully identified and referenced in the subject line of the email message. The document shall not be locked or protected in any fashion that would prevent text to be copied or edited by the Government after delivery.