Source: https://www.federalregister.gov/documents/2015/08/26/2015-20870/defense-federal-acquisition-regulation-supplement-network-penetration-reporting-and-contracting-for
Timestamp: 2017-06-25 07:19:42
Document Index: 275323096

Matched Legal Cases: ['ART 212', 'art 204', 'art 204', 'arts 204', 'art1', 'art2', 'art3', 'art 204', 'art4', 'art5', 'art6', 'art7', 'art8', 'art9', 'art10', 'art 239', 'art11', 'art 239', 'art12', 'art13', 'art14', 'art15', 'art16']

:: Defense Federal Acquisition Regulation Supplement: Network Penetration Reporting and Contracting for Cloud Services (DFARS Case 2013-D018)
51739-51748
PART 212—ACQUISITION OF COMMERCIAL ITEM
https://www.federalregister.gov/d/2015-20870
Mr. Dustin Pitsch, OUSD(AT&L)DPAP/DARS, telephone 571-372-6090.
This interim rule requires contractors and subcontractors to report cyber incidents that result in an actual or potentially adverse effect on a covered contractor information system or covered defense information residing therein, or on a contractor's ability to provide operationally critical support. DoD is working to establish a single reporting mechanism for DoD contractor reporting of cyber incidents on unclassified information systems. This rule is intended to streamline the reporting process for DoD contractors and minimize duplicative reporting processes. Cyber incidents involving classified information on classified contractor systems will continue to be reported in accordance with the National Industrial Security Program Operating Manual (see DoD-M 5220.22 available at http://www.dtic.mil/​whs/​directives/​corres/​pdf/​522022m.pdf).
In addition, this rule also implements DoD policies and procedures for use when contracting for cloud computing services. The DoD Chief Information Officer (CIO) issued a memo on December 15, 2014, entitled “Updated Guidance on the Acquisition and Use of Commercial Cloud Computing Services” to clarify DoD guidance when acquiring commercial cloud services (See memo here: http://iase.disa.mil/​cloud_​security/​Pages/​docs.aspx). The DoD CIO also released a Cloud Computing Security Requirements Guide (SRG) Version 1, Release 1 on January 13, 2015, for cloud service providers to comply with when providing the DoD with cloud services (See SRG here: http://iase.disa.mil/​cloud_​security/​Pages/​index.aspx). This rule implements these new policies developed within the DoD CIO memo and the SRG in the DFARS to ensure uniform application when contracting for cloud services across the DoD. The combination of the two statutes as well as the cloud computing policy will serve to increase the cyber security requirements placed on DoD information in contractor systems and will help the DoD to mitigate the risks related to compromised information as well as gather information for future improvements in cyber security policy.
(1) DFARS subpart 204.73 is modified to expand safeguarding and reporting policy to require protection of covered defense information, which includes controlled technical information, export controlled information, critical Start Printed Page 51740information, and other information requiring protection by law, regulation, or Government-wide policy.
(2) The clause at 252.204-7012 is renamed “Safeguarding Covered Defense Information and Cyber Incident Reporting” and the scope of the clause is expanded to cover the safeguarding of covered defense information and require contractors to report cyber incidents involving this new class of information as well as any cyber incident that may affect the ability to provide operationally critical support. The table of security controls based on National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 is replaced by NIST SP 800-171, entitled “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.” NIST SP 800-171 is a publication specifically tailored for use in protecting sensitive information residing in contractor information systems that refines the requirements from Federal Information Processing Standard (FIPS) 200 and controls from NIST SP 800-53 and presents them in an easier to use format. In addition to being easier to use, NIST SP 800-171 greatly increases the protections of Government information in contractor information systems, while simultaneously reducing the burden placed on the contractor by eliminating Federal-centric processes and requirements currently embedded in NIST SP 800-53. For example, a task analysis comparing the requirements of NIST SP 800-171 to the current table of security controls (based on NIST SP 800-53) demonstrates a reduction in required tasks by 30 percent.
(8) The term “cyber incident,” is removed from the definitions section of subpart 204.73 and is now defined at 202.1. The terms “compromise” and “media” are also added to 202.1, because the terms are used in parts 204 and 239.
This rule affects the information collection requirements in the provisions at DFARS 252.204-7012, currently approved under OMB Control Number 0704-0478, titled “Enhanced Safeguarding and Cyber Incident Reporting of Unclassified DoD Information Within Industry,” in accordance with the Paperwork Reduction Act (44 U.S.C. chapter 35). The rule revises the collection reporting requirements based on—
Changes to DFARS clause 252.204-7012, which is now titled “Safeguarding Covered Defense Information and Cyber Incident Reporting”;
A new DFARS provision 252.204-7008, Compliance with Safeguarding Covered Defense Information Controls;Start Printed Page 51741
OMB Control Number 0704-0489, Defense Industrial Base Voluntary Cyber Security/Information Assurance (DIB CS/IA) Cyber Incident Reporting, (regulations codified under Title 32 of the CFR) supports “voluntary” reporting and covers the online collection medium, a Defense Industrial Base/Information Assurance Incident Collection database, which is an online repository used for both voluntary reporting and reporting that is contractually mandated under the DFARS clauses and provisions.
OMB Control Number 0704-0490, Defense Industrial Base Voluntary Cyber Security/Information Assurance (DIB CS/IA) Points of Contact (POC) Information, (regulations codified under Title 32 of the CFR) addresses the application process for participating companies. OMB Control Number 0704-0490 involves collection of personally identifiable information and is supported by a System of Records Notices for the cyber incident reporting program. The Privacy Act Statement of Records Notice (SORN) system identifier, DCIO 01, Defense Industrial Base (DIB) Cybersecurity Records, includes stipulations related to the release and disclosure of information collected. An update was published in the Federal Register on May 21, 2015, at 80 FR 29315 (see http://www.gpo.gov/​fdsys/​pkg/​FR-2015-05-21/​pdf/​2015-12324.pdf).
This rule expands upon the existing coverage in the DFARS, which previously only covered the protection of and reporting of incidents affecting the controlled technical information, but not other incidents within the contractor system. This interim rule expands the protection and reporting to entire contractor systems (i.e., “covered contractor information system”) as well as a new type of information “covered defense information” which includes controlled technical information as a subset. This interim rule increases the number of circumstances where contractors must implement security controls as well as when they must report incidents.
Start Amendment Part1. The authority citation for 48 CFR 202, 204, 212, and 252 continues to read as follows:End Amendment Part
Start Amendment Part2. Amend section 202.101 by adding, in alphabetical order, the definitions for “compromise,” “cyber incident,” and “media” to read as follows: End Amendment Part
Start Amendment Part3. Revise subpart 204.73 heading to read as follows: End Amendment Part
Start Amendment Part4. Revise section 204.7300 to read as follows: End Amendment Part
Start Amendment Part5. Amend section 204.7301 by— End Amendment Part
Start Amendment Parta. Removing the definition of “cyber incident”; End Amendment Part
Start Amendment Partb. Adding, in alphabetical order, the definitions for “contractor attributional/proprietary information,” “covered contractor information system,” “covered defense information,” “information system,” “operationally critical support,” and “rapid(ly) report(ing)”; and End Amendment Part
Start Amendment Partc. Revising the definition for “controlled technical information”. End Amendment Part
Start Amendment Part6. Revise section 204.7302 to read as follows: End Amendment Part
(a) DoD and its contractors and subcontractors will provide adequate security to safeguard covered defense information on their unclassified information systems from unauthorized access and disclosure.Start Printed Page 51743
(1) Contractors and subcontractors are required to submit to DoD—
Start Amendment Part7. Amend section 204.7303 by removing “unclassified controlled technical information” and adding “covered defense information” in its place. End Amendment Part
Start Amendment Part8. Revise section 204.7304 to read as follows: End Amendment Part
Start Amendment Part9. Amend section 212.301 by— End Amendment Part
Start Amendment Parta. Redesignating paragraphs (f)(ii)(A) through (E) as paragraphs (f)(ii)(C) through (G); End Amendment Part
Start Amendment Partb. Adding new paragraphs (f)(ii)(A) and (B); End Amendment Part
Start Amendment Partc. Revising the newly redesignated (f)(ii)(D); End Amendment Part
Start Amendment Partd. Redesignating paragraphs (f)(xv)(A) and (B) as paragraphs (f)(xv)(C) and (D); End Amendment Part
Start Amendment Parte. Adding new paragraphs (f)(xv)(A) and (B). End Amendment Part
Start Amendment Part10. The authority citation for 48 CFR part 239 is revised to read as follows:End Amendment Part
Start Amendment Part11. Add subpart 239.76 to read as follows: End Amendment Part
Cloud computing means a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This includes other commercial terms, such as on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. It also includes commercial offerings for Start Printed Page 51744software-as-a-service, infrastructure-as-a-service, and platform-as-a-service.
(b) The contracting officer shall only award a contract to acquire cloud computing services from any cloud service provider (e.g., contractor or subcontractor, regardless of tier) that has been granted provisional authorization by Defense Information Systems Agency, at the level appropriate to the requirement, to provide the relevant cloud computing services in accordance with the Cloud Computing Security Requirements Guide (SRG) (version in effect at the time the solicitation is issued or as authorized by the contracting officer) found at http://iase.disa.mil/​cloud_​security/​Pages/​index.aspx. Provisional authorization processes are also available at the SRG Web site. Cloud service providers with existing provisional authorization are listed at http://www.disa.mil/​Computing/​Cloud-Services/​Cloud-Support.
(c) When contracting for cloud computing services, the contracting officer shall ensure the following information is provided in the purchase request—
(1) Government data and Government-related data descriptions;
(2) Data ownership, licensing, delivery and disposition instructions specific to the relevant types of Government data and Government-related data (e.g., CDRL, SOW task, line item). Disposition instructions shall provide for the transition of data in commercially available, or open and non-proprietary format (and for permanent records, in accordance with disposition guidance issued by National Archives and Record Administration);
Required storage of data within the United States or outlying areas.
Start Amendment Part12. Add section 252.204-7008 to read as follows: End Amendment Part
(c) If the Offeror proposes to deviate from any of the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, http://dx.doi.org/​10.6028/​NIST.SP.800-171 that is in effect at the time the solicitation is issued or as authorized by the Contracting Officer, the Offeror shall submit to the Contracting Officer, for consideration by the DoD CIO, a written explanation of—
(2) How an alternative but equally effective, security measure is used to compensate for the inability to satisfy a Start Printed Page 51745particular requirement and achieve equivalent protection.
Start Amendment Part13. Add section 252.204-7009 to read as follows: End Amendment Part
Start Amendment Part14. Revise section 252.204-7012 to read as follows: End Amendment Part
(D) Any other information, marked or otherwise identified in the contract, that requires safeguarding or dissemination Start Printed Page 51746controls pursuant to and consistent with law, regulations, and Governmentwide policies (e.g., privacy, proprietary business information).
(ii) For covered contractor information systems that are not part of an IT service of system operated on behalf of the Government and therefore are not subject to the security requirement specified at paragraph (b)(1)(i) of this clause—
(A) The security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations, http://dx.doi.org/​10.6028/​NIST.SP.800-171 that is in effect at the time the solicitation is issued or as authorized by the Contracting Officer; or
(1) When the Contractor discovers a cyber incident that affects a covered contractor information system or the covered defense information residing therein, or that affects the contractor's ability to perform the requirements of the contract that are designated as operationally critical support, the Contractor shall—
(3) Medium assurance certificate requirement. In order to report cyber incidents in accordance with this clause, the Contractor or subcontractor shall have or acquire a DoD-approved medium assurance certificate to report cyber incidents. For information on obtaining a DoD-approved medium assurance certificate, see http://iase.disa.mil/​pki/​eca/​certificate.html.
(j) Use and release of contractor attributional/proprietary information created by or for DoD. Information that is obtained from the contractor (or derived from information obtained from the contractor) under this clause that is created by or for DoD (including the information submitted Start Printed Page 51747pursuant to paragraph (c) of this clause) is authorized to be used and released outside of DoD for purposes and activities authorized by paragraph (i) of this clause, and for any other lawful Government purpose or activity, subject to all applicable statutory, regulatory, and policy based restrictions on the Government's use and release of such information.
Start Amendment Part15. Add section 252.239-7009 to read as follows: End Amendment Part
Start Amendment Part16. Add section 252.239-7010 to read as follows: End Amendment Part
(2) The Contractor shall implement and maintain administrative, technical, and physical safeguards and controls with the security level and services required in accordance with the Cloud Computing Security Requirements Guide (SRG) (version in effect at the time the solicitation is issued or as authorized by the Contracting Officer) found at http://iase.disa.mil/​cloud_​security/​Pages/​index.aspx;​
(d) Cloud computing services cyber incident reporting. The Contractor shall report all cyber incidents that are related to the cloud computing service provided under this contract. Reports shall be submitted to the Department of Defense via http://dibnet.dod.mil/​.
(e) Malicious software. The Contractor or subcontractors that discover and isolate malicious software in connection with a reported cyber incident shall submit the malicious software in accordance with Start Printed Page 51748instructions provided by the Contracting Officer.