Federal Register / Vol. 77, No. 92 / Friday, May 11, 2012 / Rules and Regulations 27615 

variation margin that is equal (before 

taking into account any change in the 

value of the contract between the time 

the contract is entered into and the time 

at which the payment is made) to the 

amount of the upfront payment and 

such payment is made, directly or 

indirectly, to the derivatives clearing 

organization or clearing agency; and 

(F) The payment in the nature of 

initial variation margin is paid by the 

derivatives clearing organization or 

clearing agency, directly or indirectly, to 

the controlled foreign corporation. 

(G) Examples. The following 

examples illustrate the application of 

this paragraph (b)(1)(xi): 

Example 1. CFC is a controlled foreign 

corporation that is wholly owned by USP, a 

domestic corporation. CFC is a dealer in 

securities under section 475(c)(1). CFC enters 

into a credit default swap (that it treats as a 

notional principal contract for U.S. federal 

income tax purposes) with unrelated 

counterparty B. The credit default swap is 

accepted for clearing by a U.S.-registered 

derivatives clearing organization (DCO). CFC 

is not a member of DCO. CFC uses a U.S. 

affiliate (CM), which is a member of DCO, as 

its clearing member to submit the credit 

default swap to be cleared. CM is a domestic 

corporation that is wholly owned by USP. 

The standardized terms of the credit default 

swap provide that, for a term of X years, CFC 

will pay B a fixed coupon of 100 basis points 

per year on a notional amount of $Y. At the 

time CFC and B enter into the credit default 

swap, the market coupon for similar credit 

default swaps is 175 basis points per year. To 

compensate B for the below-market annual 

coupon payments that B will receive, the 

contract requires CFC to make an upfront 

payment through CM to DCO. DCO then 

makes the upfront payment to B through B’s 

clearing member. DCO also requires B to post 

initial variation margin in an amount equal 

to the upfront payment. B pays the initial 

variation margin through its clearing member 

to DCO. DCO then pays the initial variation 

margin through CM to CFC. Because the 

conditions set out in this paragraph (b)(1)(xi) 

are satisfied, the obligation of CM arising 

from the upfront payment by CFC does not 

constitute United States property for 

purposes of section 956. 

Example 2. Assume the same facts as in 

Example 1, except that counterparty B is, like 

CM, a domestic corporation that is wholly 

owned by USP. Because the conditions set 

out in this paragraph (b)(1)(xi) are satisfied, 

the obligations of CM and B arising from the 

upfront payment by CFC do not constitute 

United States property for purposes of 

section 956. 

Example 3. Assume the same facts as in 

Example 2, except that CFC uses an 

unrelated person as its clearing member. 

Because the conditions set out in this 

paragraph (b)(1)(xi) are satisfied, the 

obligation of B arising from the upfront 

payment by CFC does not constitute United 

States property for purposes of section 956. 

(b)(2) through (d)(1) [Reserved]. For 

further guidance, see § 1.956–2(b)(2) 

through (d)(1). 

* * * * * 

(f) Effective/applicability date. 

Paragraph (b)(1)(xi) applies to payments 

described in § 1.956–2T(b)(1)(xi) made 

on or after May 11, 2012. Taxpayers may 

apply the rules of paragraph (b)(1)(xi) to 

payments described in § 1.956– 

2T(b)(1)(xi) made prior to May 11, 2012. 

(g) Expiration date. The applicability 

of paragraph (b)(1)(xi) expires on Friday, 

May 8, 2015. 

Steven T. Miller, 

Deputy Commissioner for Services and 

Enforcement. 

Approved: May 1, 2012. 

Emily S. McMahon, 

Acting Assistant Secretary of the Treasury 

(Tax Policy). 

[FR Doc. 2012–11329 Filed 5–10–12; 8:45 am] 

BILLING CODE 4830–01–P 

DEPARTMENT OF DEFENSE 

Office of the Secretary 

32 CFR Part 236 

[DOD–2009–OS–0183/RIN 0790–AI60] 

Department of Defense (DoD)-Defense 

Industrial Base (DIB) Voluntary Cyber 

Security and Information Assurance 

(CS/IA) Activities 

AGENCY: Office of the DoD Chief 

Information Officer, DoD. 

ACTION: Interim final rule. 

SUMMARY: DoD is publishing an interim 

final rule to establish a voluntary cyber 

security information sharing program 

between DoD and eligible DIB 

companies. The program enhances and 

supplements DIB participants’ 

capabilities to safeguard DoD 

information that resides on, or transits, 

DIB unclassified information systems. 

DATES: This rule is effective May 11, 

2012. Comments must be received by 

July 10, 2012. 

ADDRESSES: You may submit comments, 

identified by docket number and/or RIN 

number and title, by any of the 

following methods: 

• Federal Rulemaking Portal: http:// 

www.regulations.gov. Follow the 

instructions for submitting comments. 

• Mail: Federal Docket Management 

System Office, 4800 Mark Center Drive, 

East Tower, Suite 02G09, Alexandria, 

VA 22350–3100. 

Instructions: All submissions received 

must include the agency name and 

docket number or Regulatory 

Information Number (RIN) for this 

Federal Register document. The general 

policy for comments and other 

submissions from members of the public 

is to make these submissions available 

for public viewing on the Internet at 

http://www.regulations.gov as they are 

received without change, including any 

personal identifiers or contact 

information. 

FOR FURTHER INFORMATION CONTACT: DIB 

Cyber Security and Information 

Assurance Program Office: (703) 604– 

3167, toll free (855) 363–4227, email 

DIB.CS/IA.Reg@osd.mil. 

SUPPLEMENTARY INFORMATION: 

Background 

Cyber threats to DIB unclassified 

information systems represent an 

unacceptable risk of compromise of DoD 

information and pose an imminent 

threat to U.S. national security and 

economic security interests. DoD’s 

voluntary DIB CS/IA program enhances 

and supplements DIB participants’ 

capabilities to safeguard DoD 

information that resides on, or transits, 

DIB unclassified information systems. 

This rule is being published as an 

interim final rule to: 

(a) Allow eligible DIB companies to 

receive USG threat information and 

share information about network 

intrusions that could compromise 

critical DOD programs and missions. 

(b) Permit DIB companies and DOD to 

assess and reduce damage to critical 

DOD programs and missions when DOD 

information is compromised. 

(c) Fulfill statutory requirements to 

ensure the protection of DOD 

information. 

(d) Address vigorous congressional 

and public interest in increasing cyber 

security and information assurance 

activities through government-industry 

cooperation. 

(e) Immediately provide a voluntary 

framework for DOD and DIB companies 

to share information to address 

sophisticated cyber threats that 

represent an imminent threat to U.S. 

national security and economic security 

interests. 

Until this rule is published as an 

interim final rule, eligible DIB 

companies cannot receive USG 

information about cyber threats and 

mitigation strategies or share 

information about cyber incidents that 

may compromise critical DOD programs 

and missions. Without this information, 

eligible DIB companies’ ability to 

protect USG information cannot be fully 

effective. While this vulnerability 

remains open, the USG faces an elevated 

risk that critical program information 

mstockstill on DSK4VPTVN1PROD with RULES

27616 Federal Register / Vol. 77, No. 92 / Friday, May 11, 2012 / Rules and Regulations 

could be compromised, resulting in 

potential economic losses or damage to 

U.S. national security. For example, the 

compromise of such information can 

significantly diminish return on DIB 

company and U.S. Government research 

and development investment and 

represents a loss of intellectual property 

that compromises the security and 

technical advantages of DoD weapons 

systems. 

DIB CS/IA activities, including the 

collection, management and sharing of 

information for cyber security purposes, 

support and implement the following 

national and DoD-specific guidance and 

authority: information assurance (IA) 

requirements to establish programs and 

activities to protect DoD information 

and DoD information systems, including 

information and information systems 

operated and maintained by contractors 

or others in support of DoD activities 

(see 10 U.S.C. 2224; and the Federal 

Information Security Management Act 

(FISMA), codified at 44 U.S.C. 3541 et 

seq.); critical infrastructure protection 

responsibilities, in which DoD is the 

sector specific agency for the DIB sector, 

(see Homeland Security Presidential 

Directive 7 (HSPD–7), ‘‘Critical 

Infrastructure Identification, 

Prioritization, and Protection’’). 

The DoD established the voluntary 

DIB CS/IA program to enhance and 

supplement DIB participants’ 

capabilities to safeguard DoD 

unclassified information that resides on, 

or transits, DIB unclassified information 

systems. At the core of the program is 

a bilateral cyber security information 

sharing activity, in which DoD provides 

cyber threat information and 

information assurance (IA) best 

practices to DIB companies to enhance 

and supplement DIB companies’ 

capabilities to safeguard DoD 

unclassified information; and in return, 

DIB companies report certain types of 

cyber intrusion incidents to the Defense 

Cyber Crime Center’s DoD-DIB 

Collaborative Information Sharing 

Environment (DCISE), DoD’s operational 

focal point for cyber threat information 

sharing and incident response under 

this program. The DoD analyzes the 

information reported by the DIB 

company regarding any such cyber 

incident, to glean information regarding 

cyber threats, vulnerabilities, and the 

development of effective response 

measures. In addition to this initial 

reporting and analysis, the DoD and DIB 

company may pursue, on a voluntary 

basis, follow-on, more detailed, digital 

forensics analysis or damage 

assessments of individual incidents, 

including sharing of additional 

electronic media/files or information 

regarding the incident or the affected 

systems, networks, or information. The 

information sharing arrangements 

between the DoD and each participating 

DIB company are memorialized in a 

standardized bilateral Framework 

Agreement (FA), signed by the 

participating DIB company and the 

Government, that implements the 

requirements of this part and is signed 

by the participating DIB company and 

the Government. The FA is available to 

eligible DIB companies during the 

application process. As provided by the 

FA, participation in the program is 

entirely voluntary and does not obligate 

any DIB participant to change its 

information systems or otherwise alter 

its normal conduct of cyber security 

activities. In keeping with the voluntary, 

collaborative nature of the activity 

described in the FA, each Party bears 

responsibility for its own actions under 

this FA. The FA emphasizes sharing to 

the greatest extent possible information 

to provide the clearest understanding of 

the cyber threat. This will allow the 

Company to improve defense and 

remediation efforts and allow the 

Government to assess the damage or 

impact to defense information and 

programs entrusted to the Company. 

A foundational element of this 

bilateral information sharing model is 

the recognition that the information 

being shared between the parties 

includes extremely sensitive nonpublic 

information, which must be protected 

against unauthorized uses and 

disclosures in order to preserve the 

integrity of the program. For example, 

the cyber threat information shared by 

the Government must be protected 

against compromise by the cyber threat, 

which may already have a presence on 

the DIB participant’s system; and thus 

the DIB participants must utilize 

security measures and limited sharing 

within the company, to ensure that the 

cyber threat information retains its 

operational value—for the benefit of all 

of the DIB participants. Similarly, the 

DIB participants typically treat 

information regarding potential cyber 

intrusion incidents on their networks as 

extremely sensitive proprietary, 

commercial, or operational information 

and tightly control that information 

within the company, let alone sharing 

outside the company. The DIB 

participants share this type of 

information with the Government only 

on the condition that the Government 

safeguards that information against any 

unauthorized use or release (both within 

the Government and outside the 

Government), which could cause 

substantial competitive harm to the DIB 

participant that reported that 

information. In addition, during any 

follow-on forensics or damage 

assessment activities, the Government 

and DIB companies may share 

additional types of sensitive 

information, which may include 

information regarding the types of DoD 

information or DIB company 

information that may have been 

compromised during the reported 

incident—potentially including the 

most sensitive types of unclassified 

information (e.g., critical program 

information relating to DoD weapons 

systems, DIB company trade secrets 

related to DoD programs, personally 

identifiable information (PII) regarding 

individuals). For additional information 

regarding the Government’s 

safeguarding of information received 

from the DIB companies, with specific 

focus on PII, see the Privacy Impact 

Assessment for the DIB CS/IA Program 

(http://dodcio.defense.gov/Portals/0/

Documents/DIB%20CS-IA%20PIA_

FINAL_signed_30jun2011_VMSS_

GGMR_RC.pdf). 

As part of DoD’s instantiation of the 

voluntary DIB CS/IA program, DoD 

developed new policies and procedures, 

developed a dedicated threat sharing 

and collaboration system, and validated 

on-line application procedures in order 

to support participation by a large 

number of companies. The on-line 

application procedures provide the 

administrative and security 

requirements for DIB participants, 

including the standardized bilateral FA 

that implements the requirements of the 

DIB CS/IA program. The FA will 

typically be executed by a senior DoD 

official, such as the DoD Chief 

Information Officer (CIO), and by a DIB 

company corporate senior official (e.g., 

Company CIO or equivalent). 

This interim-final rule establishes a 

new part 236 in title 32 of the Code of 

Federal Regulations, with the following 

new sections: Section 236.2 establishes 

the definitions of terms used in the new 

part, leveraging established definitions 

to the maximum extent possible (e.g., 

those provided in the Committee on 

National Security Systems Instruction 

No. 4009, ‘‘National Information 

Assurance Glossary’’) (http://

www.cnss.gov/Assets/pdf/cnssi_

4009.pdf); Section 236.4 sets forth the 

basic requirements and procedures of 

the voluntary program, including 

information collection requirements; 

Section 236.5 characterizes cyber 

security information sharing and 

collection procedures; Section 236.6 

establishes the general provisions of the 

voluntary DIB CS/IA program; and 

Section 236.7 sets forth the eligibility 

mstockstill on DSK4VPTVN1PROD with RULES

Federal Register / Vol. 77, No. 92 / Friday, May 11, 2012 / Rules and Regulations 27617 

requirements to participate in the 

voluntary program. 

Nothing in this rule or program is 

intended to be inconsistent with any 

other related or similar federal agency or 

private sector activity or requirement. 

For example, nothing in this rule or 

program abrogates the Government’s or 

the DIB participants’ rights or 

obligations regarding the handling, 

safeguarding, sharing, or reporting of 

information, or regarding any physical, 

personnel, or other security 

requirements, as required by law, 

regulation, policy, or a valid legal 

contractual obligation. 

Similarly, this rule and program are 

intended to be consistent and 

coordinated with, and updated as 

necessary to ensure consistency with 

and support for, other federal activities 

related to the handling and safeguarding 

of controlled unclassified information, 

such as those that are being led by the 

National Archives and Records 

Administration pursuant to Executive 

Order 13556 ‘‘Controlled Unclassified 

Information’’ (November 4, 2010) (see 

http://www.archives.gov/cui/). 

Executive Orders 12866, ‘‘Regulatory 

Planning and Review’’ and 13563, 

‘‘Improving Regulation and Regulatory 

Review’’ 

It has been certified that 32 CFR part 

236 does not: 

(a) Have an annual effect on the 

economy of $100 million or more, or 

adversely affect in a material way, the 

economy; a section of the economy; 

productivity; competition; jobs; the 

environment; public health or safety; or 

State, local, or tribal governments or 

communities; 

(b) Create a serious inconsistency, or 

otherwise interfere with, an action taken 

or planned by another Agency; 

(c) Materially alter the budgetary 

impact of entitlements, grants, user fees, 

or loan programs, or the rights and 

obligations of recipients thereof; or 

(d) Raise novel legal or policy issues 

arising out of legal mandates, the 

President’s priorities, or the principles 

as set forth in these Executive Orders. 

Public Law 104–121, ‘‘Congressional 

Review Act’’ (5 U.S.C. 801) 

It has been determined that 32 CFR 

part 236 is not a ‘‘major’’ rule under 5 

U.S.C. 801, enacted by Public Law 104– 

121, because it will not result in an 

annual effect on the economy of $100 

million or more; a major increase in 

costs or prices for consumers, 

individual industries, Federal, State, or 

local government agencies, or 

geographic regions; or significant 

adverse effects on competition, 

employment, investment, productivity, 

innovation, or on the ability of United 

States-based enterprises to compete 

with foreign-based enterprises in 

domestic and export markets. 

Sec. 202, Public Law 104–4, ‘‘Unfunded 

Mandates Reform Act’’ 

It has been certified that 32 CFR part 

236 does not contain a Federal mandate 

that may result in expenditure by State, 

local and tribal governments, in 

aggregate, or by the private sector, of 

$100 million or more in any one year. 

Public Law 96–354, ‘‘Regulatory 

Flexibility Act’’ (5 U.S.C. 601) 

It has been certified that 32 CFR part 

236 is not subject to the Regulatory 

Flexibility Act (5 U.S.C. 601) because it 

would not, if promulgated, have a 

significant economic impact on a 

substantial number of small entities. 

DIB participation in the DIB CS/IA 

Program is voluntary. 

Public Law 96–511, ‘‘Paperwork 

Reduction Act’’ (44 U.S.C. Chapter 35) 

Sections 236.4 and 236.5 and 236.7 of 

this interim final rule contain 

information collection requirements. 

DoD has submitted the following 

proposal to Office of Management and 

Budget (OMB) under the provisions of 

the Paperwork Reduction Act (44 U.S.C. 

Chapter 35). Comments are invited on: 

(a) Whether the proposed collection of 

information is necessary for the proper 

performance of the functions of DoD, 

including whether the information will 

have practical utility; (b) the accuracy of 

the estimate of the burden of the 

proposed information collection; (c) 

ways to enhance the quality, utility, and 

clarity of the information to be 

collected; and (d) ways to minimize the 

burden of the information collection on 

respondents, including the use of 

automated collection techniques or 

other forms of information technology. 

(a) Title: Defense Industrial Base 

Cyber Security/Information Assurance 

(DIB CS/IA) Points of Contact 

Information. 

Type of Request: New. 

Projected Responses per Respondent: 

One response is required initially and 

thereafter only on an ‘‘as needed/ 

required’’ basis, as changes to the points 

of contact occur. 

Annual Responses: 275, which 

includes the additional responses 

required on an ‘‘as needed/required’’ 

basis. 

Average Burden per Response: 20 

minutes. 

Annual Burden Hours: Total annual 

burden for respondents 92 hours. 

Total Annualized Cost to 

Respondents: One-time cost of ∼$12 per 

respondent. Total cumulative annual 

cost for 250 respondents (275 responses) 

is $3,337. 

Needs and Uses: The DIB CS/IA 

program collects Point of Contact (POC) 

information from DIB participants. POC 

information is needed to facilitate 

communication between DoD and DIB 

participants, as well as prospective 

participants. The POC information 

includes the names, security clearance 

information, citizenship, work 

addresses, including division/group, 

work email addresses and work 

telephone numbers of companyidentified representatives. DIB POCs 

include the Chief Executive Officer 

(CEO), Chief Information Officer (CIO), 

Chief Information Security Officer 

(CISO), General Counsel, the Chief 

Privacy Officer, and the Corporate 

Security Officer (CSO) or Facility 

Security Officer (FSO), or their 

equivalents. DIB participants also 

provide POC information for personnel 

responsible for the implementation and 

execution of the DIB CS/IA program 

within their company including 

designated personnel authorized to 

report incidents and any policy, 

administrative, or technical personnel 

identified to interact with DOD in the 

operational implementation of the 

program. 

Affected Public: Business or other forprofit and not-for-profit institutions 

participating in the voluntary DIB CS/IA 

program. 

Frequency: On occasion. 

Respondent’s Obligation: Voluntary. 

(b) Title: DIB Cyber Security/ 

Information Assurance Cyber Incident 

Reporting. 

Type of Request: New. 

Phased expansion of DIB CS/IA 

Number of Participants increases to 750 

over three years. 

Projected Responses per Participant: 

5. 

Annual Responses: Year 1 responses 

are 1,250. Year 2 responses are 2,500. 

Year 3 responses are 3,750. 

Average Burden per Response: 7 

hours (this includes searching existing 

data sources, gathering and maintaining 

the data needed, and completing and 

reviewing the collection of information). 

Annual Burden Hours: Year 1 burden 

hours are 8,750 hours. Year 2 burden 

hours are 17,500 hours. Year 3 burden 

hours are 26,250 hours. 

Needs and Uses: The collection of this 

information is necessary to enhance and 

supplement DIB participants’ 

information security capabilities to 

safeguard DoD information that resides 

on, or transits, DIB unclassified 

mstockstill on DSK4VPTVN1PROD with RULES

27618 Federal Register / Vol. 77, No. 92 / Friday, May 11, 2012 / Rules and Regulations 

information systems. The requested 

information supports the information 

assurance objectives, cyber threat 

information sharing, and incident 

reporting between DoD and the DIB 

participants. In most cases, DIB 

participants report incidents using a DIB 

CS/IA standardized Incident Collection 

Form (ICF). In some cases, a company 

may elect to report the incident without 

using the ICF; and companies may 

report incidents through a variety of 

communications channels, including 

email, fax, or by phone, if necessary. 

Affected Public: Business or other forprofit and not-for-profit institutions 

participating in the DIB CS/IA program. 

Frequency: On occasion. 

Respondent’s Obligation: Voluntary. 

OMB Desk Officer: Written comments 

and recommendations on the 

information collection should be sent to 

Ms. Jasmeet Seehra at the Office of 

Management and Budget, DoD Desk 

Officer, Room 10102, New Executive 

Office Building, Washington, DC 20503, 

with a copy to the Director, DIB CS/IA 

Program Office, at the Office of the DoD 

Chief Information Officer, 6000 Defense 

Pentagon, Attn: DIB CS/IA Program 

Office, Washington, DC 20301, or email 

at DIB.CS/IA.Reg@osd.mil. Comments 

can be received from 30 to 60 days after 

the date of this notice, but comments to 

OMB will be most useful if received by 

OMB within 30 days after the date of 

this notice. 

You may also submit comments, 

identified by docket number and title, 

by the following method: Federal 

Rulemaking Portal: http:// 

www.regulations.gov. Follow the 

instructions for submitting comments. 

Instructions: All submissions received 

must include the agency name, docket 

number and title for this Federal 

Register document. The general policy 

for comments and other submissions 

from members of the public is to make 

these submissions available for public 

viewing on the Internet at http:// 

www.regulations.gov as they are 

received without change, including any 

personal identifiers or contact 

information. 

To request more information on this 

information collection or to obtain a 

copy of the proposal and associated 

collection instruments, please write to 

Director, DIB CS/IA Program Office, at 

Office of the DoD Chief Information 

Officer, Attn: DIB CS/IA Program Office, 

6000 Defense Pentagon, Washington, DC 

20301. 

Executive Order 13132, ‘‘Federalism’’ 

It has been certified that 32 CFR part 

236 does not have federalism 

implications, as set forth in Executive 

Order 13132. This rule does not have 

substantial direct effects on: 

(a) The States; 

(b) The relationship between the 

National Government and the States; or 

(c) The distribution of power and 

responsibilities among the various 

levels of Government. 

List of Subjects in 32 CFR Part 236 

Contracts, Security measures. 

Accordingly 32 CFR part 236 is added 

to read as follows: 

PART 236—DEPARTMENT OF 

DEFENSE (DOD)-DEFENSE 

INDUSTRIAL BASE (DIB) VOLUNTARY 

CYBER SECURITY AND INFORMATION 

ASSURANCE (CS/IA) ACTIVITIES 

Sec. 

236.1 Purpose. 

236.2 Definitions. 

236.3 Policy. 

236.4 Procedures. 

236.5 Cyber security information sharing. 

236.6 General provisions. 

236.7 DIB participant eligibility 

requirements. 

Authority: 10 U.S.C. 2224; 44 U.S.C. 3506; 

44 U.S.C. 3544. 

§ 236.1 Purpose. 

Cyber threats to DIB unclassified 

information systems represent an 

unacceptable risk of compromise of DoD 

information and pose an imminent 

threat to U.S. national security and 

economic security interests. DoD’s 

voluntary DIB CS/IA program enhances 

and supplements DIB participants’ 

capabilities to safeguard DoD 

information that resides on, or transits, 

DIB unclassified information systems. 

§ 236.2 Definitions. 

As used in this part: 

(a) Attribution information means 

information that identifies the DIB 

participant, whether directly or 

indirectly, by the grouping of 

information that can be traced back to 

the DIB participant (e.g., program 

description, facility locations). 

(b) Compromise means disclosure of 

information to unauthorized persons or 

a violation of the security policy of a 

system in which unauthorized 

intentional, or unintentional, disclosure, 

modification, destruction, loss of an 

object, or the copying of information to 

unauthorized media may have occurred. 

(c) Covered defense information 

means unclassified information that: 

(1) Is: 

(i) Provided by or on behalf of the 

DoD to the DIB participant in 

connection with an official DoD activity; 

or 

(ii) Collected, developed, received, 

transmitted, used, or stored by the DIB 

participant in support of an official DoD 

activity; and 

(2) Is: 

(i) Technical information marked for 

restricted distribution in accordance 

with DoD Directive 5230.25, 

‘‘Withholding of Unclassified Technical 

Data From Public Disclosure,’’ or DoD 

Directive 5230.24, ‘‘Distribution 

Statements on Technical Documents’’; 

(ii) Information subject to export 

control under the International Traffic 

in Arms Regulations (ITAR) (http:// 

pmddtc.state.gov/regulations_laws/ 

itar_official.html), or the Export 

Administration Regulations (EAR) 

(http://ecfr.gpoaccess.gov, Title 15, part 

730); 

(iii) Information designated as Critical 

Program Information (CPI) in 

accordance with DoD Instruction 

5200.39, ‘‘Critical Program Information 

(CPI) Protection within the Department 

of Defense’’; 

(iv) Information that hostile 

intelligence systems might obtain that 

could be interpreted or pieced together 

to derive critical intelligence in time to 

be useful to adversaries as described in 

5205.02–M, ‘‘DoD Operations Security 

(OPSEC Program Manual’’; 

(v) Personally Identifiable Information 

(PII) that can be used to distinguish or 

trace an individual’s identity in 

accordance with DoD Directive 5400.11, 

‘‘DoD Privacy Program’’; 

(vi) Information bearing current and 

prior designations indicating 

unclassified controlled information 

(e.g., For Official Use Only, Sensitive 

But Unclassified, and Limited Official 

Use, DoD Unclassfied Controlled 

Nuclear Information, Sensitive 

Information) that has not been cleared 

for public release in accordance with 

DoD Directive 5230.29, ‘‘Clearance of 

DoD Information for Public Release’’ 

(see also Appendix 3 of DoD 5200.1–R, 

‘‘Information Security Program 

Regulation’’); or 

(vii) Any other information that is 

exempt from mandatory public 

disclosure under DoD Directive 5400.07, 

‘‘DoD Freedom of Information Act 

(FOIA) Program’’, and DoD Regulation 

5400.7–R, ‘‘DoD Freedom of Information 

Program’’. 

(d) Covered DIB systems means an 

information system that is owned or 

operated by or for a DIB participant and 

that processes, stores, or transmits 

covered defense information. 

(e) Cyber incident means actions 

taken through the use of computer 

networks that result in an actual or 

potentially adverse effect on an 

information system and/or the 

information residing therein. 

mstockstill on DSK4VPTVN1PROD with RULES

Federal Register / Vol. 77, No. 92 / Friday, May 11, 2012 / Rules and Regulations 27619 

(f) Cyber intrusion damage 

assessment means a managed, 

coordinated process to determine the 

effect on defense programs, defense 

scientific and research projects, or 

defense warfighting capabilities 

resulting from compromise of a DIB 

participant’s unclassified computer 

system or network. 

(g) Defense Industrial Base (DIB) 

means the Department of Defense, 

government, and private sector 

worldwide industrial complex with 

capabilities to perform research and 

development, design, produce, and 

maintain military weapon systems, 

subsystems, components, or parts to 

satisfy military requirements. 

(h) DIB participant means a DIB 

company that has met all of the 

eligibility requirements to participate in 

the voluntary DIB CS/IA information 

sharing program as set forth in this part 

(see § 236.7). 

(i) Government means the United 

States Government. 

(j) Government Furnished Information 

(GFI) means information provided by 

the Government under the voluntary 

DIB CS/IA program, including but not 

limited to cyber threat information and 

information assurance practices. 

(k) Information means any 

communication or representation of 

knowledge such as facts, data, or 

opinions in any medium or form, 

including textual, numerical, graphic, 

cartographic, narrative, or audiovisual. 

(l) Information system means a 

discrete set of information resources 

organized for the collection, processing, 

maintenance, use, sharing, 

dissemination, or disposition of 

information. 

(m) Threat means any circumstance or 

event with the potential to adversely 

impact organization operations 

(including mission, functions, image, or 

reputation), organization assets, 

individuals, other organizations, or the 

Nation through an information system 

via unauthorized access, destruction, 

disclosure, modification of information 

and/or denial of service. 

§ 236.3 Policy. 

It is DoD policy to: 

(a) Establish a comprehensive 

approach for enhancing and 

supplementing DIB information 

assurance capabilities to safeguard 

covered defense information on covered 

DIB systems. 

(b) Increase the Government and DIB 

situational awareness of the extent and 

severity of cyber threats to DOD 

information. 

§ 236.4 Procedures. 

(a) The Government and each DIB 

participant will execute a voluntary 

standardized agreement, referred to as a 

Framework Agreement (FA), to share, in 

a timely and secure manner, on a 

recurring basis, and to the greatest 

extent possible, cyber security 

information relating to information 

assurance for covered defense 

information on covered DIB systems. 

(b) Each such FA between the 

Government and a DIB participant must 

comply with and implement the 

requirements of this part, and will 

include additional terms and conditions 

as necessary to effectively implement 

the voluntary information sharing 

activities described in this part with 

individual DIB participants. 

(c) DoD’s DIB CS/IA Program Office is 

the overall point of contact for the 

program. The DoD Cyber Crime Center’s 

DoD-DIB Collaborative Information 

Sharing Environment (DC3/DCISE) is 

the operational focal point for cyber 

threat information sharing and incident 

reporting under the DIB CS/IA program. 

(d) The Government will maintain a 

Web site or other Internet-based 

capability to provide potential DIB 

participants with information about 

eligibility and participation in the 

program, to enable the online 

application or registration for 

participation, and to support the 

execution of necessary agreements with 

the Government. (http:// 

dibnet.dod.mil/) 

(e) Prior to receiving GFI from the 

Government, each DIB participant shall 

provide the requisite points of contact 

information, to include security 

clearance and citizenship information, 

for the designated personnel within 

their company (e.g., typically 3–10 

company designated points of contact) 

in order to facilitate the DoD-DIB 

interaction in the DIB CS/IA program. 

The Government will confirm the 

accuracy of the information provided as 

a condition of that point of contact 

being authorized to act on behalf of the 

DIB participant for this program. 

(f) GFI will be issued via both 

unclassified and classified means. DIB 

participant handling and safeguarding 

of classified information shall be in 

compliance with the National Industrial 

Security Program Operating Manual 

(NISPOM) (DoD 5220.22–M). The 

Government shall specify transmission 

and distribution procedures for all GFI, 

and shall inform DIB participants of any 

revisions to previously specified 

transmission or procedures. 

(g) Except as authorized in this part or 

in writing by the Government, DIB 

participants may use GFI to safeguard 

covered defense information only on 

covered DIB systems that are U.S. based 

(i.e., provisioned, maintained, or 

operated within the physical boundaries 

of the United States); and share GFI only 

within their company or organization, 

on a need to know basis, with 

distribution restricted to U.S. citizens 

(i.e., a person born in the United States, 

or naturalized, holding a U.S. passport). 

However, in individual cases, upon 

request of a DIB participant that has 

determined that it requires the ability to 

share the information with a non-U.S. 

citizen, or to use the GFI on a non-U.S. 

based covered DIB system, and can 

demonstrate that appropriate 

information handling and protection 

mechanisms are in place, the 

Government may authorize such 

disclosure or use under appropriate 

terms and conditions. 

(h) DIB participants shall maintain the 

capability to electronically disseminate 

GFI within the Company in an 

encrypted fashion (e.g., using Secure/ 

Multipurpose Internet Mail Extensions 

(S/MIME), secure socket layer (SSL), 

Transport Layer Security (TLS) protocol 

version 1.2, DoD-approved medium 

assurance certificates). 

(i) The DIB participants shall not 

share GFI outside of their company or 

organization, regardless of personnel 

clearance level, except as authorized in 

this part or otherwise authorized in 

writing by the Government. 

(j) If the DIB participant utilizes a 

third-party service provider (SP) for 

information system security services, 

the DIB participant may share GFI with 

that SP under the following conditions 

and as authorized in writing by the 

Government: 

(1) The DIB participant must identify 

the SP to the Government and request 

permission to share or disclose any GFI 

with that SP (which may include a 

request that the Government share 

information directly with the SP on 

behalf of the DIB participant) solely for 

the authorized purposes of this program; 

(2) The SP must provide the 

Government with sufficient information 

to enable the Government to determine 

whether the SP is eligible to receive 

such information, and possesses the 

capability to provide appropriate 

protections for the GFI; 

(3) Upon approval by the 

Government, the SP must enter into a 

legally binding agreement with the DIB 

participant (and also an appropriate 

agreement with the Government in any 

case in which the SP will receive or 

share information directly with the 

Government on behalf of the DIB 

participant) under which the SP is 

subject to all applicable requirements of 

mstockstill on DSK4VPTVN1PROD with RULES

27620 Federal Register / Vol. 77, No. 92 / Friday, May 11, 2012 / Rules and Regulations 

this part and of any supplemental terms 

and conditions in the DIB participant’s 

FA with the Government, and which 

authorizes the SP to use the GFI only as 

authorized by the Government. 

(k) The DIB participant may not sell, 

lease, license, or otherwise incorporate 

the GFI into its products or services, 

except that this does not prohibit a DIB 

participant from being appropriately 

designated an SP in accordance with 

paragraph (j) of this section. 

§ 236.5 Cyber security information 

sharing. 

(a) GFI. The Government shall share 

GFI with DIB participants or designated 

SPs in accordance with this part. 

(b) Initial incident reporting. The DIB 

participant shall report to DC3/DCISE 

cyber incidents involving covered 

defense information on a covered DIB 

system. These initial reports will be 

provided within 72 hours of discovery. 

DIB participants also may report other 

cyber incidents to the Government if the 

DIB participant determines the incident 

may be relevant to information 

assurance for covered defense 

information or covered DIB systems or 

other information assurance activities of 

the Government. 

(c) Follow-up reporting. After an 

initial incident report, the Government 

and the DIB participant may voluntarily 

share additional information that is 

determined to be relevant to a reported 

incident, including information 

regarding forensic analyses, mitigation 

and remediation, and cyber intrusion 

damage assessments. 

(d) Cyber intrusion damage 

assessment. Following analysis of a 

cyber incident, DC3/DCISE may provide 

information relevant to the potential or 

known compromise of DoD acquisition 

program information to the Office of the 

Secretary of Defense’s Damage 

Assessment Management Office (OSD 

DAMO) for a cyber intrusion damage 

assessment. The Government may 

provide DIB participants with 

information regarding the damage 

assessment. 

(e) DIB participant attribution 

information. The Government 

acknowledges that information shared 

by the DIB participants under this 

program may include extremely 

sensitive proprietary, commercial, or 

operational information that is not 

customarily shared outside of the 

company, and that the unauthorized use 

or disclosure of such information could 

cause substantial competitive harm to 

the DIB participant that reported that 

information. The Government shall take 

reasonable steps to protect against the 

unauthorized use or release of such 

information (e.g., attribution 

information and other nonpublic 

information) received from a DIB 

participant or derived from such 

information provided by a DIB 

participant, including applicable 

procedures pursuant to paragraph (h) of 

this section. The Government will 

restrict its internal use and disclosure of 

attribution information to only 

Government personnel and Government 

support contractors that are bound by 

appropriate confidentiality obligations 

and restrictions relating to the handling 

of this sensitive information and are 

engaged in lawfully authorized 

activities. 

(f) Non-attribution information. The 

Government may share non-attribution 

information that was provided by a DIB 

participant (or derived from information 

provided by a DIB participant) with 

other DIB participants in the DIB CS/IA 

program, and may share such 

information throughout the Government 

(including with Government support 

contractors that are bound by 

appropriate confidentiality obligations) 

for cyber security and information 

assurance purposes for the protection of 

Government information or information 

systems. 

(g) Electronic media. Electronic 

media/files provided by DIB 

participants to DC3 under paragraphs 

(b), (c) and (d) of this section are 

maintained by the digital and 

multimedia forensics laboratory at DC3, 

which implements specialized handling 

procedures to maintain its accreditation 

as a digital and multimedia forensics 

laboratory. DC3 will maintain, control, 

and dispose of all electronic media/files 

provided by DIB participants to DC3 in 

accordance with established DoD 

policies and procedures. 

(h) Freedom of Information Act 

(FOIA). Agency records, which may 

include qualifying information received 

from non-federal entities, are subject to 

request under the Freedom of 

Information Act (5 U.S.C. 552) (FOIA), 

which is implemented in the 

Department of Defense by DoD Directive 

5400.07 and DoD Regulation 5400.7–R 

(see 32 CFR parts 285 and 286, 

respectively). Pursuant to established 

procedures and applicable regulations, 

the Government will protect sensitive 

nonpublic information under this 

Program against unauthorized public 

disclosure by asserting applicable FOIA 

exemptions, and will inform the nonGovernment source or submitter (e.g., 

DIB participants) of any such 

information that may be subject to 

release in response to a FOIA request, to 

permit the source or submitter to 

support the withholding of such 

information or pursue any other 

available legal remedies. 

§ 236.6 General provisions. 

(a) Confidentiality of information that 

is exchanged under this program will be 

protected to the maximum extent 

authorized by law, regulation, and 

policy. 

(b) The Government and DIB 

participants will conduct their 

respective activities under this program 

in accordance with applicable laws and 

regulations, including restrictions on 

the interception, monitoring, access, 

use, and disclosure of electronic 

communications or data. The 

Government and the DIB participant 

each bear responsibility for their own 

actions under this program. 

(c) Prior to sharing any information 

with the Government under this 

program pursuant to the FA, the DIB 

participant shall perform a legal review 

of its policies and practices that support 

its activities under this program, and 

shall make a determination that such 

policies, practices, and activities 

comply with applicable legal 

requirements. The Government may 

request from any DIB participant 

additional information or assurances 

regarding such DIB participant’s 

policies or practices, or the 

determination by the DIB participant 

that such policies or practices comply 

with applicable legal requirements. 

(d) This voluntary DIB CS/IA program 

is intended to safeguard covered defense 

information. None of the restrictions on 

the Government’s use or sharing of 

information under the DIB CS/IA 

program shall limit the Government’s 

ability to conduct law enforcement, 

counterintelligence activities, or other 

activities in the interest of national 

security; and participation does not 

supersede other regulatory or statutory 

requirements. 

(e) Participation in the DIB CS/IA 

program is voluntary and does not 

obligate the DIB participant to utilize 

the GFI in, or otherwise to implement 

any changes to, its information systems. 

Any action taken by the DIB participant 

based on the GFI or other participation 

in this program is taken on the DIB 

participant’s own volition and at its 

own risk and expense. 

(f) A DIB participant’s voluntary 

participation in this program is not 

intended to create any unfair 

competitive advantage or disadvantage 

in DoD source selections or 

competitions, or to provide any other 

form of unfair preferential treatment, 

and shall not in any way be represented 

or interpreted as a Government 

endorsement or approval of the DIB 

mstockstill on DSK4VPTVN1PROD with RULES

Federal Register / Vol. 77, No. 92 / Friday, May 11, 2012 / Rules and Regulations 27621 

participant, its information systems, or 

its products or services. 

(g) The DIB participant and the 

Government may each unilaterally limit 

or discontinue participation in this 

program at any time. Termination shall 

not relieve the DIB participant or the 

Government from obligations to 

continue to protect against the 

unauthorized use or disclosure of GFI, 

attribution information, contractor 

proprietary information, third-party 

proprietary information, or any other 

information exchanged under this 

program, as required by law, regulation, 

contract, or the FA. 

(h) Upon termination of the FA, and/ 

or change of Facility Security Clearance 

status below Secret, GFI must be 

returned to the Government or 

destroyed pursuant to direction of, and 

at the discretion of, the Government. 

(i) Participation in this program does 

not abrogate the Government’s or the 

DIB participants’ rights or obligations 

regarding the handling, safeguarding, 

sharing, or reporting of information, or 

regarding any physical, personnel, or 

other security requirements, as required 

by law, regulation, policy, or a valid 

legal contractual obligation. 

§ 236.7 DIB participant eligibility 

requirements. 

To be eligible to participate in this 

program, a DIB company must: 

(a) Have or acquire DoD-approved 

medium assurance certificates to enable 

encrypted unclassified information 

sharing between the Government and 

DIB participants; 

(b) Have an existing active Facility 

Security Clearance (FCL) granted under 

the National Industrial Security Program 

Operating Manual (NISPOM) (DoD 

5220.22–M) with approved safeguarding 

for at least Secret information, and 

continue to qualify under the NISPOM 

for retention of its FCL and approved 

safeguarding (http://www.dtic.mil/whs/ 

directives/corres/pdf/522022m.pdf); 

(c) Have or acquire a Communication 

Security (COMSEC) account in 

accordance with the NISPOM Chapter 9, 

Section 4 (DoD 5220.22–M), which 

provides procedures and requirements 

for COMSEC activities; 

(d) Obtain access to DoD’s secure 

voice and data transmission systems 

supporting the DIB CS/IA program, 

(e) Own or operate covered DIB 

system(s), and 

(f) Execute the standardized FA with 

the Government (available during the 

application process), which implements 

the requirements set forth in sections 

236.4 through 236.6 of this part. 

Dated: April 30, 2012. 

Patricia L. Toppings, 

OSD Federal Register Liaison Officer, 

Department of Defense. 

[FR Doc. 2012–10651 Filed 5–2–12; 8:45 am] 

BILLING CODE 5001–06–P 

DEPARTMENT OF HOMELAND 

SECURITY 

Coast Guard 

33 CFR Parts 100 and 165 

[Docket No. USCG–2012–0123] 

RIN 1625–AA08, 1625–AA00 

Special Local Regulations and Safety 

Zone; War of 1812 Bicentennial 

Commemorations, Chesapeake Bay 

and Port of Baltimore, MD 

AGENCY: Coast Guard, DHS. 

ACTION: Temporary final rule. 

SUMMARY: The Coast Guard is 

establishing temporary special local 

regulations and a safety zone in the 

Chesapeake Bay and Port of Baltimore, 

Maryland for War of 1812 Bicentennial 

Commemorations activities. These 

actions are necessary to provide for the 

safety of life on navigable waters before, 

during, and after War of 1812 

Bicentennial Commemorations events 

being planned for Baltimore, Maryland. 

These actions will restrict vessel traffic 

in portions of the Inner Harbor, the 

Northwest Harbor, the Patapsco River, 

and the Chesapeake Bay. 

DATES: This rule is effective from June 

12, 2012 through June 20, 2012. 

ADDRESSES: Comments and material 

received from the public, as well as 

documents mentioned in this preamble 

as being available in the docket, are part 

of docket USCG–2012–0123 and are 

available online by going to http:// 

www.regulations.gov, inserting USCG– 

2012–0123 in the ‘‘Keyword’’ box, and 

then clicking ‘‘Search.’’ This material is 

also available for inspection or copying 

at the Docket Management Facility (M– 

30), U.S. Department of Transportation, 

West Building Ground Floor, Room 

W12–140, 1200 New Jersey Avenue SE., 

Washington, DC 20590, between 9 a.m. 

and 5 p.m., Monday through Friday, 

except Federal holidays. 

FOR FURTHER INFORMATION CONTACT: If 

you have questions on this temporary 

rule, call or email Mr. Ronald Houck, 

U.S. Coast Guard Sector Baltimore, MD; 

telephone 410–576–2674, email 

Ronald.L.Houck@uscg.mil. If you have 

questions on viewing the docket, call 

Renee V. Wright, Program Manager, 

Docket Operations, telephone 202–366– 

9826. 

SUPPLEMENTARY INFORMATION: 

Regulatory Information 

On March 15, 2012, we published a 

notice of proposed rulemaking (NPRM) 

entitled ‘‘War of 1812 Bicentennial 

Commemorations, Chesapeake Bay and 

Port of Baltimore, MD’’ in the Federal 

Register (77 FR 15323). We received one 

comment on the proposed rule. No 

public meeting was requested, and none 

was held. 

Background and Purpose 

The U.S. Department of the Navy is 

sponsoring War of 1812 Bicentennial 

Commemorations in the Chesapeake 

Bay and Port of Baltimore, Maryland. 

Planned events include the scheduled 

arrival of U.S. and foreign naval vessels, 

public vessels, tall ships and other 

vessels beginning on June 12, 2012 and 

the scheduled departure of those vessels 

ending on June 20, 2012. The Coast 

Guard anticipates a large spectator fleet 

for these events. Operators should 

expect significant vessel congestion 

along the arrival and departure routes. 

The purpose of these regulations is to 

promote maritime safety and protect 

participants and the boating public in 

the Port of Baltimore and the waters of 

the Chesapeake Bay immediately prior 

to, during, and after the scheduled 

events. The regulations will provide for 

clear passage of participating vessels, a 

safety buffer around the participating 

vessels while they are in transit for the 

benefit of participants and spectators. 

The regulations will impact the 

movement of all vessels operating in 

specified waters of the Chesapeake Bay, 

Patapsco River, Northwest Harbor and 

the Inner Harbor. 

It may be necessary for the Coast 

Guard to establish additional safety or 

security zones in addition to these 

regulations to safeguard dignitaries and 

certain vessels participating in the 

event. If the Coast Guard deems it 

necessary to establish such zones at a 

later date, the details of those zones will 

be announced separately via the Federal 

Register, Local Notice to Mariners, 

Safety Voice Broadcasts, and any other 

means available. 

With the arrival of War of 1812 

Bicentennial Commemorations 

participants and spectator vessels in the 

Port of Baltimore for this event, it will 

be necessary to curtail normal port 

operations to some extent. The Coast 

Guard will attempt to minimize 

interference while still ensuring the 

safety of life on the navigable waters 

immediately before, during, and after 

the scheduled events. 

mstockstill on DSK4VPTVN1PROD with RULES