Annex 16 - STATEMENT OF WORK

LANGUAGE IMPLEMENTING THE DIB

MEMO

The following SOW language shall be used to supplement DFARS Clause 252.204-7012 entitled,

“Safeguarding Covered Defense Information and Cyber Incident Reporting” where the Department

of the Navy Program Manager, Program Executive Officer or Chief of Naval Research, in

coordination with Resource Sponsor, determines that the risk to a critical program and/or

technology warrants its inclusion.

1. System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews

a) Within thirty (30) days of contract award, the Contractor shall make its System Security Plan(s)

(SSP(s)) for its covered contractor information system(s) available for review by the Government at

the contractor’s facility. The SSP(s) shall implement the security requirements in Defense Federal

Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract.

The Contractor shall fully cooperate in the Government’s review of the SSPs at the Contractor’s

facility.

b) If the Government determines that the SSP(s) does not adequately implement the requirements of

DFARS clause 252.204-7012 then the Government shall notify the Contractor of each identified

deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of

notification by the Government. The contracting officer may provide for a correction period longer

than thirty (30) days and, in such a case, may require the Contractor to submit a plan of action and

milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately

notify the contracting officer of any failure or anticipated failure to meet a milestone in such a

POAM.

c) Upon the conclusion of the correction period, the Government may conduct a follow-on review of

the SSP(s) at the Contractor’s facilities. The Government may continue to conduct follow-on reviews

until the Government determines that the Contractor has corrected all identified deficiencies in the

SSP(s).

d) The Government may, in its sole discretion, conduct subsequent reviews at the Contractor’s site

to verify the information in the SSP(s). The Government will conduct such reviews at least every

three (3) years (measured from the date of contract award) and may conduct such reviews at any

time upon thirty (30) days’ notice to the Contractor.

2. Compliance to NI ST 800-171

a) The Contractor shall fully implement the CUI Security Requirements (Requirements) and

associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST

SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance

with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this

contract.

b) Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and
POA&M their plans to implement the following, at a minimum:

(1) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor

authentication is required for all users, privileged and unprivileged accounts that log into a network.

In other words, any system that is not standalone should be required to utilize acceptable multifactor authentication. For legacy systems and systems that cannot support this requirement, such as

CNC equipment, etc., a combination of physical and logical protections acceptable to the

Government may be substituted;

(2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the

contractor implements to restrict the unnecessary sharing with, or flow of, covered defense

information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring

and controlling of remote access sessions and include mechanisms to audit the sessions and

methods.

(4) Audit user privileges on at least an annual basis;

(5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved

algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in

a SSP and POAM); and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see

https://csrc.nist.gov/projects/cryptographic-algorithm-validation-progr...);

(6) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for

implementation which shall be evaluated by the Navy for risk acceptance.

(7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for

implementation which can be evaluated by the Government Program Manager for risk to the

program.

3. Cyber Incident Response:

a) The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the

72-hour reporting period), deliver all data used in performance of the contract that the Contractor

determines is impacted by the incident and begin assessment of potential warfighter/program

impact.

b) Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes

Center (DC3) Instructions for Submitting Media available at

http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_M.... In delivery of the

incident data, the Contractor shall, to the extent practical, remove contractor-owned information

from Government covered defense information.

c) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the

Contractor shall immediately notify the contracting officer in writing and shall deliver the incident

data within ten (10) days of identification. In such a case, the Contractor may request a delivery date

later than ten (10) days after identification. The contracting officer will approve or disapprove the

request after coordination with DC3.
4. N aval C riminal I nvestigative S ervice (NCIS) Outreach

The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for

hardening of covered contractor information systems affecting DON programs and technologies.

5. NCIS/Industry Monitoring

a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or

potential vulnerability, the Contractor shall cooperate with the Naval Criminal Investigative Service

(NCIS), which may include cooperation related to: threat indicators; pre-determined incident

information derived from the Contractor's infrastructure systems; and the continuous provision of all

Contractor, subcontractor or vendor logs that show network activity, including any additional logs

the contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice

of actual or potential vulnerability.

b) If the Government determines that the collection of all logs does not adequately protect its

interests, the Contractor and NCIS will work together to implement additional measures, which may

include allowing the installation of an appropriate network device that is owned and maintained by

NCIS, on the Contractor's information systems or information technology assets. The specific details

(e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS

network device shall be the subject of a separate agreement negotiated between NCIS and the

Contractor. In the alternative, the Contractor may install network sensor capabilities or a network

monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this

alternative approach shall also be the subject of a separate agreement negotiated between NCIS and

the Contractor.

c) In all cases, the collection or provision of data and any activities associated with this statement of

work shall be in accordance with federal, state, and non-US law.