U.S. flag
          An official website of the United States Government  Main navigation
  

        

              Data Initiatives
                              Regulations
                                                                        Row 1
                                              FAR FAR
                              Smart Matrix Smart Matrix
                              Chapter 99 (CAS) Chapter 99 (CAS)
                              Row 2
                                              DFARS DFARS
                              DFARSPGI DFARSPGI
                              AFARS AFARS
                              DAFFARS DAFFARS
                              DAFFARS MP DAFFARS MP
                              DARS DARS
                              DLAD DLAD
                              NMCARS NMCARS
                              Row 3
                                              SOFARS SOFARS
                              TRANSFARS TRANSFARS
                              AGAR AGAR
                              AIDAR AIDAR
                              CAR CAR
                              DEAR DEAR
                              DIAR DIAR
                              DOLAR DOLAR
                              Row 4
                                              DOSAR DOSAR
                              DTAR DTAR
                              EDAR EDAR
                              EPAAR EPAAR
                              FEHBAR FEHBAR
                              GSAM/R GSAM/R
                              HHSAR HHSAR
                              HSAR HSAR
                              Row 5
                                              HUDAR HUDAR
                              IAAR IAAR
                              JAR JAR
                              LIFAR LIFAR
                              NFS NFS
                              NRCAR NRCAR
                              TAR TAR
                              VAAR VAAR
                              Tools
                                                                        Archives
                              Smart Matrix
                              Regulations Search
                              Acquisition Regulation Comparator (ARC)
                              Policy Network
                                                                        CAOC
                              CAAC
                              FAR Council
                              ISDC
 Breadcrumb
        Home
                            Regulations
                            NMCARS
                            Annex 16 - STATEMENT OF WORK LANGUAGE         IMPLEMENTING THE DIB MEMO
        
                  NMCARS
NMCARS
Change Number: NMCARS Change 18-22 Effective Date: 07/11/2022
PartPart 5201Part 5202Part 5203Part 5204Part 5205Part 5206Part 5207Part 5208Part 5209Part 5211Part 5212Part 5213Part 5214Part 5215Part 5216Part 5217Part 5219Part 5222Part 5223Part 5225Part 5227Part 5228Part 5229Part 5230Part 5231Part 5232Part 5233Part 5234Part 5235Part 5236Part 5237Part 5239Part 5241Part 5242Part 5243Part 5245Part 5246Part 5248Part 5249Part 5250Part 5252Annex 1Annex 2Annex 3Annex 4Annex 5Annex 6Annex 7Annex 8Annex 9Annex 10Annex 11Annex 12Annex 13Annex 14Annex 15Annex 16Annex 17Annex 18Annex 19Annex 20Annex 21Annex 22Annex 23Annex 24Annex 25
Subpart
Section
Leave this field blank
        
                  

                                
                  
        « PreviousNext »
Annex 16 - STATEMENT OF WORK LANGUAGE IMPLEMENTING THE DIB MEMOAnnex 16 - STATEMENT OF WORK LANGUAGE         IMPLEMENTING THE DIB MEMO       The following SOW language shall be used to supplement             DFARS Clause 252.204-7012 entitled, “Safeguarding Covered Defense Information and Cyber             Incident Reporting” where the Department of the Navy Program Manager, Program Executive             Officer or Chief of Naval Research, in coordination with Resource Sponsor, determines             that the risk to a critical program and/or technology warrants its inclusion.          **1.**                      **System Security Plan and Plans of Action and Milestones (SSP/POAM)                         Reviews**                                                                  a)Within thirty (30) days                         of contract award, the Contractor shall make its System Security Plan(s)                         (SSP(s)) for its covered contractor information system(s) available for                         review by the Government at the contractor’s facility. The SSP(s) shall                         implement the security requirements in Defense Federal Acquisition                         Regulation Supplement (DFARS) clause 252.204-7012, which is included in this                         contract. The Contractor shall fully cooperate in the Government’s review of                         the SSPs at the Contractor’s facility.                                                                     b)If the Government                         determines that the SSP(s) does not adequately implement the requirements of                         DFARS clause 252.204-7012 then the Government shall notify the Contractor of                         each identified deficiency. The Contractor shall correct any identified                         deficiencies within thirty (30) days of notification by the Government. The                         contracting officer may provide for a correction period longer than thirty                         (30) days and, in such a case, may require the Contractor to submit a plan                         of action and milestones (POAM) for the correction of the identified                         deficiencies. The Contractor shall immediately notify the contracting                         officer of any failure or anticipated failure to meet a milestone in such a                         POAM.                                                                     c)Upon the conclusion of                         the correction period, the Government may conduct a follow-on review of the                         SSP(s) at the Contractor’s facilities. The Government may continue to                         conduct follow-on reviews until the Government determines that the                         Contractor has corrected all identified deficiencies in the SSP(s).                                                                     d)The Government may, in                         its sole discretion, conduct subsequent reviews at the Contractor’s site to                         verify the information in the SSP(s). The Government will conduct such                         reviews at least every three (3) years (measured from the date of contract                         award) and may conduct such reviews at any time upon thirty (30) days’                         notice to the Contractor.                                                                                            **2.**                      **Compliance to NI**                      **ST 800-171**                                                                                     a)The Contractor shall                         fully implement the CUI Security Requirements (Requirements) and associated                         Relevant Security Controls (Controls) in NIST Special Publication 800-171                         (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies                         from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2),                         for all covered contractor information systems affecting this contract.                                                                     b)Notwithstanding the                         allowance for such variation, the contractor shall identify in any SSP and                         POA&M their plans to implement the following, at a minimum:                                                                                    (1)Implement Control                               3.5.3 (Multi-factor authentication). This means that multi-factor                               authentication is required for all users, privileged and unprivileged                               accounts that log into a network. In other words, any system that is                               not standalone should be required to utilize acceptable multi-factor                               authentication. For legacy systems and systems that cannot support                               this requirement, such as CNC equipment, etc., a combination of                               physical and logical protections acceptable to the Government may be                               substituted;                                                                                       (2)Implement Control                               3.1.5 (least privilege) and associated Controls, and identify                               practices that the contractor implements to restrict the unnecessary                               sharing with, or flow of, covered defense information to its                               subcontractors, suppliers, or vendors based on need-to-know                               principles;                                                                                       (3)Implement Control                               3.1.12 (monitoring and control remote access sessions) - Require                               monitoring and controlling of remote access sessions and include                               mechanisms to audit the sessions and methods.                                                                                       (4)Audit user                               privileges on at least an annual basis;                                                                                       (5)Implement:                                                                                                      i.Control                                     3.13.11 (FIPS 140-2 validated cryptology or implementation of                                     NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or                                     Triple DES) or compensating controls as documented in a SSP and                                     POAM); and,                                                                                                         ii.NIST                                     Cryptographic Algorithm Validation Program (CAVP) (see                                     https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);                                                                                                                                                        (6)Implement Control                               3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM                               for implementation which shall be evaluated by the Navy for risk                               acceptance.                                                                                       (7)Implement Control                               3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for                               implementation which can be evaluated by the Government Program                               Manager for risk to the program.                                                                                                                                                 **3.**                      **Cyber Incident Response:**                                                                  a)The Contractor shall,                         within fifteen (15) days of discovering the cyber incident (inclusive of the                         72-hour reporting period), deliver all data used in performance of the                         contract that the Contractor determines is impacted by the incident and                         begin assessment of potential warfighter/program impact.                                                                     b)Incident data shall be                         delivered in accordance with the Department of Defense Cyber Crimes Center                         (DC3) Instructions for Submitting Media available at                         http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.docx.                         In delivery of the incident data, the Contractor shall, to the extent                         practical, remove contractor-owned information from Government covered                         defense information.                                                                     c)If the Contractor                         subsequently identifies any such data not previously delivered to DC3, then                         the Contractor shall immediately notify the contracting officer in writing                         and shall deliver the incident data within ten (10) days of identification.                         In such a case, the Contractor may request a delivery date later than ten                         (10) days after identification. The contracting officer will approve or                         disapprove the request after coordination with DC3.                                                                                            **4.**                      **N**                      **aval**                      **C**                      **riminal**                      **I**                      **nvestigative**                      **S**                      **ervice (NCIS)**                      ****                      **Outreach**                      ****                   The Contractor shall engage with NCIS industry                   outreach efforts and consider recommendations for hardening of covered contractor                   information systems affecting DON programs and technologies.                                                   **5.**                      **NCIS/Industry Monitoring**                      ****                      **​​​​​**                                                                  a)In the event of a cyber                         incident or at any time the Government has indication of a vulnerability or                         potential vulnerability, the Contractor shall cooperate with the Naval                         Criminal Investigative Service (NCIS), which may include cooperation related                         to: threat indicators; pre-determined incident information derived from the                         Contractor's infrastructure systems; and the continuous provision of all                         Contractor, subcontractor or vendor logs that show network activity,                         including any additional logs the contractor, subcontractor or vendor agrees                         to initiate as a result of the cyber incident or notice of actual or                         potential vulnerability.                                                                     b)If the Government                         determines that the collection of all logs does not adequately protect its                         interests, the Contractor and NCIS will work together to implement                         additional measures, which may include allowing the installation of an                         appropriate network device that is owned and maintained by NCIS, on the                         Contractor's information systems or information technology assets. The                         specific details (e.g., type of device, type of data gathered, monitoring                         period) regarding the installation of an NCIS network device shall be the                         subject of a separate agreement negotiated between NCIS and the Contractor.                         In the alternative, the Contractor may install network sensor capabilities                         or a network monitoring service, either of which must be reviewed for                         acceptability by NCIS. Use of this alternative approach shall also be the                         subject of a separate agreement negotiated between NCIS and the                         Contractor.                                                                     c)In all cases, the                         collection or provision of data and any activities associated with this                         statement of work shall be in accordance with federal, state, and non-US                         law.
« PreviousNext »
FavoriteX

      NMCARS Parts
            Regulations Nmcars Menu
  

        
      Index
                              5201
                              5202
                              5203
                              5204
                              5205
                              5206
                              5207
                              5208
                              5209
                              5211
                              5212
                              5213
                              5214
                              5215
                              5216
                              5217
                              5219
                              5222
                              5223
                              5225
                              5227
                              5228
                              5229
                              5230
                              5231
                              5232
                              5233
                              5234
                              5235
                              5236
                              5237
                              5239
                              5241
                              5242
                              5243
                              5245
                              5246
                              5248
                              5249
                              5250
                              5252
                          NMCARS Annex
              Regulations Nmcars Annex Menu
  

        
      1
                              2
                              3
                              4
                              5
                              6
                              7
                              8
                              9
                              10
                              11
                              12
                              13
                              14
                              15
                              16
                              17
                              18
                              19
                              20
                              21
                              22
                              23
                              24
                              25

      ×
        Data Initiatives
                                                              Regulations
                                                              Tools
                                              Archives
                                                              Smart Matrix
                                                              Regulations Search
                                                              Acquisition Regulation Comparator (ARC)
                                                              Policy Network
                                              CAO.gov
                                                        CAO Home
                                                              Council Member
                                                                    Large Agencies
                                                              Small Agencies
                                                              Council Defining Documents
                                                                    CAOC History
                                                              CAOC Charter
                                                              Civilian Agency Acquisition Council (CAAC)
                                                              Federal Acquisition Regulatory Council
                                                              Interagency Suspension and Debarment Committee (ISDC)
                                                              Search
 ˄ Top Sign up for FAR News

                            Share the FAR
                        Upper Footer Menu
  

        
      Useful Links
                              FAR Resources
                              Training
                              Acquisition Systems
            
                            **Contact Us/FAQs**
                        **Privacy and Security Notice**
                        **Accessibility Aids**
                        **Last Updated 03/29/2024**
 ACQUISITION.GOV
                An official website of the General Services Administration About GSA
                Accessibility support
                FOIA requests
                No FEAR Act data
                Office of the Inspector General
                Performance reports
                Privacy policy Looking for U.S. government information and services?
            Visit USA.gov
 «
    
    Tt