AM Ei'I DfuIENT OF S OLI C ITATIONifuI ODI FICATION OF CONTRACT COI'ITR;'\CT lD CCDE

J

QF PAGES

5

5. PRDJEC I l,1O ilf cpysiicablel

CODE S PE]S 1

2 A r',1 E i.l !\1 E l',TiLlC'0 l Fl Ci1. iI Cl' I l.tl

PC00c2

6 ISSUED BY CJODE

OLA TROOP SUPPORT

SUESISTENCE SUPPLY CHAII.I

7OO ROEBINS AVE|\IUE

PHILAOELPI]IA P191.] 1.50?6

USA

Initia(ar: Kef leT tulaulclirr

PSPRTA6 Tel: 215-737-78!6 rAi(:215-737-75.11 Enail: KELLEY ftAULDlr.tODLA [,i _.

B NAtulE AIJD ADDP.ESS OF CONTRACTOR (l/o, sireef, co(rnl),, Siafe and ZIP Cotlo)

Er.lVrSiOtJ, lNC.

lJUtJVVAttrH5l

WICHITA KS 672134E19

USA

CODE 2A178 I-AUILI i Y ULIUts.

i. ADI/ll'JISTERFO B'l (lf clher lltttrt ltrtn 6)

DLA TRCOP SUPPORT

SUESISTEi\JCE SUPPLY CHAIi\]

7OO ROESINS A\/EI'IUE

P3ILADELPi-llA PA i91 11-50!6

U5A

9A. AIVIEI.]DIIIIENT OF SOLICITATIOI'J I.JO,

gts. DATED (SE5l7-5itl 71)

10A. N,IODIFICATION OF COf'JTP"ACT/ORDER NO.

SPE3S 1.15.D.2?04

108 DATED (SEE tTEj,t13)

2015 JUL 77

11. THIS ITEM O N L Y A P P L I E S T O A M E N D f u I E N T S OF SOLICITATIONS

J tr.-f-trvlrvtrLJ|\IE:

bee L-i1K, li)lJ, FEOl,l;)T' _Jr t, puRCH,\sE F E Q , i , t O .

See Block l 4

I lTlte;bovenumberEdsolicitatlcnissnrenCed.lssetfDrthinlternl4.Thehourandciatespecifi+dforreceiprofOFters [ 't exrencr..ci f 't not exienCed.

Otfer: must acknowledge rece pt of this amendmen t prior to the ho uf a nd date spec tied n the sc|cira{ on o. as ame6ded by on e o{ the fo|owinq me rnods:

(a)8vcompietinq ltems I ind I5. and re'urning cope. ofthe arnendmenti (b)By acknov/leiging receiprolthrs ame.rjmenton each copyoithe offe.sJb/n, edi

or (cJ By se pa r! 1., etter cr teiegraflr lrhich includes a reference ro the solLcitatic n and am endm€nt num bers. FAI LU RE O F yO UR ACKNOWL E OG[,1ENT TO e E REaE]VED AT THE

PLACE DESIC|]ATED FOR TrE RECEIPT oFOFFERS PRIOR T0 TIE HOUR ANo OATE SPECIF ED l\,lA / RESULT lN REJECTION OF YOUR OFFER. tl by vr'llle of his

anendmeniyoudesire|cchangeanof€raheacy5Utjmltted.sUcnchan!enaybemadebyte|e1liamor|ene

a_C l5is .rprdae_t st is rocrived oror Io lf€ oFe- _g Four aad o'e -pe! reLl

12 ACCOUi\lTltlG Ai'JD APPROPRIATICI'I DATA {if retuirerJt

13. THIS ITEM APPLIES Ol'lLY TO tulODIFICATIONS OF COI'ITRACTS/ORDERS,

IT MODIF|ES T H E C O N T R A C T / O R D E R I . J O " A S DESCRIBED I N I T E M 14"

ul:trLf\ ulrttr A. THIS CHATIGE OFiDEi"' lS ISSUED PIIRSUAIIT TA'. (specify euthci(y.t THE Ci-iAilGES SET FDRTH Il.J lTEtul l4 ARE r.tADE lll THE CONTF.ACT OF.DEF. NllJ lTEl;l 10A

E. THE AEO\,'E Nluf\'l BEIIED C(lf'lTRA.tlTlCir.DER tS ivlODlFlED TO F.EFLECT TFiE ADfllli'llSTRAflVE CHA.NGES { sr.rcir as chanqes in pavinq orfice.

dai9. eIc, ) SET FORTH III ITEN4 1.+, PUPSUANT IO THE AUTHoRITY oF FAR 43 103 {b).

C HIS SUPPI-EIVIENTAL AGF]EELlEN]T IS FT'JTERED II'.ITO PURSUAI.]T TC AUTJ^iCRITY OF

52 21?-0J(c)

D, OTHER $peciiy type c'i ntoCilicaiton and auil;oritv.J

1.1.DESCF.|PTlO|'.1oFAi\1ENDf1E|.]Til,loD|FlCAT|oN(orgilnt)zet1b,

See Ccntin,laticn She,il

ExceptasproVidech€lein'allle'msandcond;lionsol!hsdacUmenireiere,lcedin|ieD9Acl10A'a5h€re]ofolecl]an!cd'rema]nsUnchange3ndlnfU]]|o|ceandefecl'

1:A l'.lAi,,lE AND TITLE CF SlGi\lER (Tvpe rr print) ItrA. l.lAl',lE AfiD TiTLE OF COf..lTRACTll'1G OFFICER lType ar print)

r i zr' r I ! -J iYrLr v-J Knse HowARD

15C DAi= SIG|'IED

I i 3. / rt ^

u\/ _)i (\r

STANDARD FORiI 3C inev. to-a:t

Fr-es,;ribej c1 GSA FA,r. (4.1 CFP,) 55 2+?

E- IMPORTANT: Coniracicr I isnot. [] is required to sign this dccumef rand return I coprestothe issuing offtceD SIATES CF AfulERICA

lrt -Etlt7 Vt WUI:UdL.tt .\'-'.'t,ctl
 

 CONTINUED ON NEXT PAGE

All terms and conditions of the contract remain the same except the following mandatory provision DFARS 

252.204-7008 and clause DFARS 252.204-7012 are hereby added to the subject contract: 

DFARS 252.204-7008 COMPLIANCE WITH SAFEGUARDING COVERED DEFENSE INFORMATION CONTROLS (DEC 2015)

(a) Definitions. As used in this provision—

“Controlled technical information,” “covered contractor information system,” and “covered defense 

information” are defined in clause 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident 

Reporting. 

(b) The security requirements required by contract clause 252.204-7012, Covered Defense Information and Cyber 

Incident Reporting, shall be implemented for all covered defense information on all covered contractor 

information systems that support the performance of this contract. 

(c) For covered contractor information systems that are not part of an information technology (IT) service or 

system operated on behalf of the Government (see 252.204-7012(b)(1)(ii))—

(1) By submission of this offer, the Offeror represents that it will implement the security requirements 

specified by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, 

“Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (see 

http://dx.doi.org/10.6028/NIST.SP.800-171), not later than December 31, 2017. 

(2)(i) If the Offeror proposes to vary from any of the security requirements specified by NIST SP 800-171 

that is in effect at the time the solicitation is issued or as authorized by the Contracting Officer, the 

Offeror shall submit to the Contracting Officer, for consideration by the DoD Chief Information Officer (CIO), 

a written explanation of—

(A) Why a particular security requirement is not applicable; or

(B) How an alternative but equally effective, security measure is used to compensate for the inability to 

satisfy a particular requirement and achieve equivalent protection. 

(ii) An authorized representative of the DoD CIO will adjudicate offeror requests to vary from NIST SP 

800-171 requirements in writing prior to contract award. Any accepted variance from NIST SP 800-171 shall be 

incorporated into the resulting contract. 

(End of provision)

DFARS 252.204-7012 SAFEGUARDING COVERED DEFENSE INFORMATION AND CYBER INCIDENT REPORTING (DEC 2015)

(a) Definitions. As used in this clause—

“Adequate security” means protective measures that are commensurate with the consequences and probability of 

loss, misuse, or unauthorized access to, or modification of information. 

“Compromise” means disclosure of information to unauthorized persons, or a violation of the security policy 

of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss 

of an object, or the copying of information to unauthorized media may have occurred. 

“Contractor attributional/proprietary information” means information that identifies the contractor(s), 

whether directly or indirectly, by the grouping of information that can be traced back to the contractor(s) 

(e.g., program description, facility locations), personally identifiable information, as well as trade 

secrets, commercial or financial information, or other commercially sensitive information that is not 

customarily shared outside of the company. 

“Contractor information system” means an information system belonging to, or operated by or for, the 

Contractor. 

“Controlled technical information” means technical information with military or space application that is 

subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, 

or dissemination. Controlled technical information would meet the criteria, if disseminated, for distribution 

statements B through F using the criteria set forth in DoD Instruction 5230.24, Distribution Statements on 

Technical Documents. The term does not include information that is lawfully publicly available without 

restrictions. 

“Covered contractor information system” means an information system that is owned, or operated by or for, a 

contractor and that processes, stores, or transmits covered defense information. 

“Covered defense information” means unclassified information that—

(i) Is—

(A) Provided to the contractor by or on behalf of DoD in connection with the performance of the contract; or

CONTINUATION SHEET REFERENCE NO. OF DOCUMENT BEING CONTINUED: PAGE 2 OF 5 PAGES

SPE3S1-15-D-Z204/P00002
 

 CONTINUED ON NEXT PAGE

(B) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support 

of the performance of the contract; and 

(ii) Falls in any of the following categories:

(A) Controlled technical information.

(B) Critical information (operations security). Specific facts identified through the Operations Security 

process about friendly intentions, capabilities, and activities vitally needed by adversaries for them to plan 

and act effectively so as to guarantee failure or unacceptable consequences for friendly mission 

accomplishment (part of Operations Security process). 

(C) Export control. Unclassified information concerning certain items, commodities, technology, software, or 

other information whose export could reasonably be expected to adversely affect the United States national 

security and nonproliferation objectives. To include dual use items; items identified in export administration 

regulations, international traffic in arms regulations and munitions list; license applications; and sensitive 

nuclear technology information. 

(D) Any other information, marked or otherwise identified in the contract, that requires safeguarding or 

dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies (e.g., 

privacy, proprietary business information). 

“Cyber incident” means actions taken through the use of computer networks that result in a compromise or an 

actual or potentially adverse effect on an information system and/or the information residing therein. 

“Forensic analysis” means the practice of gathering, retaining, and analyzing computer-related data for 

investigative purposes in a manner that maintains the integrity of the data. 

“Malicious software” means computer software or firmware intended to perform an unauthorized process that 

will have adverse impact on the confidentiality, integrity, or availability of an information system. This 

definition includes a virus, worm, Trojan horse, or other code-based entity that infects a host, as well as 

spyware and some forms of adware. 

“Media” means physical devices or writing surfaces including, but is not limited to, magnetic tapes, optical 

disks, magnetic disks, large-scale integration memory chips, and printouts onto which information is recorded, 

stored, or printed within an information system. 

‘‘Operationally critical support’’ means supplies or services designated by the Government as critical for 

airlift, sealift, intermodal transportation services, or logistical support that is essential to the 

mobilization, deployment, or sustainment of the Armed Forces in a contingency operation. 

“Rapid(ly) report(ing)” means within 72 hours of discovery of any cyber incident.

“Technical information” means technical data or computer software, as those terms are defined in the clause 

at DFARS 252.227-7013, Rights in Technical Data-Non Commercial Items, regardless of whether or not the clause 

is incorporated in this solicitation or contract. Examples of technical information include research and 

engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, 

manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses 

and related information, and computer software executable code and source code. 

(b) Adequate security. The Contractor shall provide adequate security for all covered defense information on 

all covered contractor information systems that support the performance of work under this contract. To 

provide adequate security, the Contractor shall—

(1) Implement information systems security protections on all covered contractor information systems 

including, at a minimum—

(i) For covered contractor information systems that are part of an Information Technology (IT) service or 

system operated on behalf of the Government—

(A) Cloud computing services shall be subject to the security requirements specified in the clause 

252.239-7010, Cloud Computing Services, of this contract; and 

(B) Any other such IT service or system (i.e., other than cloud computing) shall be subject to the security 

requirements specified elsewhere in this contract; or 

(ii) For covered contractor information systems that are not part of an IT service or system operated on 

behalf of the Government and therefore are not subject to the security requirement specified at paragraph 

(b)(1)(i) of this clause—

(A) The security requirements in National Institute of Standards and Technology (NIST) Special Publication 

(SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and 

Organizations,” http://dx.doi.org/10.6028/NIST.SP.800-171 that is in effect at the time the solicitation is 

issued or as authorized by the Contracting Officer, as soon as practical, but not later than December 31, 

CONTINUATION SHEET REFERENCE NO. OF DOCUMENT BEING CONTINUED: PAGE 3 OF 5 PAGES

SPE3S1-15-D-Z204/P00002
 

 CONTINUED ON NEXT PAGE

2017. The Contractor shall notify the DoD CIO, via email at osd.dibcsia@mail.mil, within 30 days of contract 

award, of any security requirements specified by NIST SP 800-171 not implemented at the time of contract 

award; or 

(B) Alternative but equally effective security measures used to compensate for the inability to satisfy a 

particular requirement and achieve equivalent protection accepted in writing by an authorized representative 

of the DoD CIO; and 

(2) Apply other information systems security measures when the Contractor easonably determines that 

information systems security measures, in addition to those identified in paragraph (b)(1) of this clause, may 

be required to provide adequate security in a dynamic environment based on an assessed risk or vulnerability. 

(c) Cyber incident reporting requirement.

(1) When the Contractor discovers a cyber incident that affects a covered contractor information system or 

the covered defense information residing therein, or that affects the contractor’s ability to perform the 

requirements of the contract that are designated as operationally critical support, the Contractor shall—

(i) Conduct a review for evidence of compromise of covered defense information, including, but not limited 

to, identifying compromised computers, servers, specific data, and user accounts. This review shall also 

include analyzing covered contractor information system(s) that were part of the cyber incident, as well as 

other information systems on the Contractor’s network(s), that may have been accessed as a result of the 

incident in order to identify compromised covered defense information, or that affect the Contractor’s ability 

to provide operationally critical support; and 

(ii) Rapidly report cyber incidents to DoD at http://dibnet.dod.mil.

(2) Cyber incident report. The cyber incident report shall be treated as information created by or for DoD 

and shall include, at a minimum, the required elements at http://dibnet.dod.mil. 

(3) Medium assurance certificate requirement. In order to report cyber incidents in accordance with this 

clause, the Contractor or subcontractor shall have or acquire a DoD-approved medium assurance certificate to 

report cyber incidents. For information on obtaining a DoD-approved medium assurance certificate, see 

http://iase.disa.mil/pki/eca/Pages/index.aspx. 

(d) Malicious software. The Contractor or subcontractors that discover and isolate malicious software in 

connection with a reported cyber incident shall submit the malicious software in accordance with instructions 

provided by the Contracting Officer. 

(e) Media preservation and protection. When a Contractor discovers a cyber incident has occurred, the 

Contractor shall preserve and protect images of all known affected information systems identified in paragraph 

(c)(1)(i) of this clause and all relevant monitoring/packet capture data for at least 90 days from the 

submission of the cyber incident report to allow DoD to request the media or decline interest. 

(f) Access to additional information or equipment necessary for forensic analysis. Upon request by DoD, the 

Contractor shall provide DoD with access to additional information or equipment that is necessary to conduct a 

forensic analysis. 

(g) Cyber incident damage assessment activities. If DoD elects to conduct a damage assessment, the

Contracting Officer will request that the Contractor provide all of the damage assessment information gathered 

in accordance with paragraph (e) of this clause. 

(h) DoD safeguarding and use of contractor attributional/proprietary information. The Government shall 

protect against the unauthorized use or release of information obtained from the contractor (or derived from 

information obtained from the contractor) under this clause that includes contractor attributional/proprietary 

information, including such information submitted in accordance with paragraph (c). To the maximum extent 

practicable, the Contractor shall identify and mark attributional/proprietary information. In making an 

authorized release of such information, the Government will implement appropriate procedures to minimize the 

contractor attributional/proprietary information that is included in such authorized release, seeking to 

include only that information that is necessary for the authorized purpose(s) for which the information is

being released. 

(i) Use and release of contractor attributional/proprietary information not created by or for DoD. 

Information that is obtained from the contractor (or derived from information obtained from the contractor) 

under this clause that is not created by or for DoD is authorized to be released outside of DoD—

(1) To entities with missions that may be affected by such information;

(2) To entities that may be called upon to assist in the diagnosis, detection, or mitigation of cyber 

incidents; 

(3) To Government entities that conduct counterintelligence or law enforcement investigations;

CONTINUATION SHEET REFERENCE NO. OF DOCUMENT BEING CONTINUED: PAGE 4 OF 5 PAGES

SPE3S1-15-D-Z204/P00002
 

(4) For national security purposes, including cyber situational awareness and defense purposes (including 

with Defense Industrial Base (DIB) participants in the program at 32 CFR part 236); or 

(5) To a support services contractor (“recipient”) that is directly supporting Government activities under a 

contract that includes the clause at 252.204-7009, Limitations on the Use or Disclosure of Third-Party 

Contractor Reported Cyber Incident Information. 

(j) Use and release of contractor attributional/proprietary information created by or for DoD. Information 

that is obtained from the contractor (or derived from information obtained from the contractor) under this 

clause that is created by or for DoD (including the information submitted pursuant to paragraph (c) of this 

clause) is authorized to be used and released outside of DoD for purposes and activities authorized by 

paragraph (i) of this clause, and for any other lawful Government purpose or activity, subject to all 

applicable statutory, regulatory, and policy based restrictions on the Government’s use and release of such 

information. 

(k) The Contractor shall conduct activities under this clause in accordance with applicable laws and 

regulations on the interception, monitoring, access, use, and disclosure of electronic communications and 

data. 

(l) Other safeguarding or reporting requirements. The safeguarding and cyber incident reporting required by 

this clause in no way abrogates the Contractor’s responsibility for other safeguarding or cyber incident 

reporting pertaining to its unclassified information systems as required by other applicable clauses of this 

contract, or as a result of other applicable U.S. Government statutory or regulatory requirements. 

(m) Subcontracts. The Contractor shall—

(1) Include this clause, including this paragraph (m), in subcontracts, or similar contractual instruments, 

for operationally critical support, or for which subcontract performance will involve a covered contractor 

information system, including subcontracts for commercial items, without alteration, except to identify the 

parties; and 

(2) When this clause is included in a subcontract, require subcontractors to rapidly report cyber incidents 

directly to DoD at http://dibnet.dod.mil and the prime Contractor. This includes providing the incident report 

number, automatically assigned by DoD, to the prime Contractor (or next higher-tier subcontractor) as soon as 

practicable. 

(End of clause)

ATTENTION: PLEASE SHIP TO WAREHOUSE 30-UGR AND SCHEDULE APPOINTMENTS (CALL 209-839-5597) 24 HOURS PRIOR TO 

ALL DELIVERIES. 

CONTINUATION SHEET REFERENCE NO. OF DOCUMENT BEING CONTINUED: PAGE 5 OF 5 PAGES

SPE3S1-15-D-Z204/P00002