[Federal Register Volume 90, Number 9 (Wednesday, January 15, 2025)]
[Proposed Rules]
[Pages 4278-4317]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-30437]
[[Page 4277]]
Vol. 90
Wednesday,
No. 9
January 15, 2025
Part VI
Department of Defense
General Services Administration
National Aeronautics and Space Administration
-----------------------------------------------------------------------
48 CFR Parts 1, 2, 3, et al.
Federal Acquisition Regulation: Controlled Unclassified Information;
Proposed Rule
Federal Register / Vol. 90 , No. 9 / Wednesday, January 15, 2025 /
Proposed Rules
[[Page 4278]]
-----------------------------------------------------------------------
DEPARTMENT OF DEFENSE
GENERAL SERVICES ADMINISTRATION
NATIONAL AERONAUTICS AND SPACE ADMINISTRATION
48 CFR Parts 1, 2, 3, 4, 5, 7, 9, 11, 12, 15, 27, 33, 42, 52, and
53
[FAR Case 2017-016, Docket No. 2017-0016, Sequence No. 1]
RIN 9000-AN56
Federal Acquisition Regulation: Controlled Unclassified
Information
AGENCY: Department of Defense (DoD), General Services Administration
(GSA), and National Aeronautics and Space Administration (NASA).
ACTION: Proposed rule.
-----------------------------------------------------------------------
SUMMARY: DoD, GSA, and NASA are proposing to amend the Federal
Acquisition Regulation (FAR) to implement the National Archives and
Records Administration's Controlled Unclassified Information Program
enacted under an Executive Order entitled Controlled Unclassified
Information.
DATES: Interested parties should submit written comments to the
Regulatory Secretariat Division at the address shown below on or before
March 17, 2025 to be considered in the formation of the final rule.
ADDRESSES: Submit comments in response to FAR Case 2017-016 to the
Federal eRulemaking portal at https://www.regulations.gov by searching
for ``FAR Case 2017-016''. Select the link ``Comment Now'' that
corresponds with ``FAR Case 2017-016''. Follow the instructions
provided on the ``Comment Now'' screen. Please include your name,
company name (if any), and ``FAR Case 2017-016'' on your attached
document. If your comment cannot be submitted using https://www.regulations.gov, call or email the points of contact in the FOR
FURTHER INFORMATION CONTACT section of this document for alternate
instructions.
Instructions: Please submit comments only and cite ``FAR Case 2017-
016'' in all correspondence related to this case. Public comments may
be submitted as an individual, as an organization, or anonymously (see
frequently asked questions at https://www.regulations.gov/faq).
Comments submitted in response to this rule will be made publicly
available and are subject to disclosure under the Freedom of
Information Act. For this reason, please do not include in your
comments information of a confidential nature, such as sensitive
personal information or proprietary information, or any information
that you would not want publicly disclosed unless you follow the
instructions below for confidential comments. Summary information of
the public comments received, including any specific comments, will be
posted on https://www.regulations.gov.
All filers using the portal should use the name of the person or
entity submitting comments as the name of their files, in accordance
with the instructions below. Anyone submitting business confidential/
proprietary information should clearly identify any business
confidential/proprietary portion at the time of submission, file a
statement justifying nondisclosure and referencing the specific legal
authority claimed, and provide a non-confidential/non-proprietary
version of the submission. Any business confidential information should
be in an uploaded file that has a file name beginning with the
characters ``BC.'' Any page containing business confidential
information must be clearly marked ``BUSINESS CONFIDENTIAL/
PROPRIETARY'' on the top of that page.
The corresponding non-confidential/non-proprietary version of those
comments must be clearly marked ``PUBLIC.'' The file name of the non-
confidential version should begin with the character ``P.'' The ``BC''
and ``P'' should be followed by the name of the person or entity
submitting the comments or rebuttal comments. All filers should name
their files using the name of the person or entity submitting the
comments. Any submissions with file names that do not begin with a
``BC'' will be assumed to be public and will be made publicly available
through https://www.regulations.gov.
To confirm receipt of your comment(s), please check https://www.regulations.gov, approximately two-to-three days after submission
to verify posting.
FOR FURTHER INFORMATION CONTACT: For clarification of content, contact
Mr. Michael O. Jackson, Procurement Analyst, at 202-821-9776 or by
email at [email protected]. For information pertaining to
status, publication schedules, or alternate instructions for submitting
comments if https://www.regulations.gov cannot be used, contact the
Regulatory Secretariat Division at 202-501-4755 or [email protected].
Please cite FAR Case 2017-016.
SUPPLEMENTARY INFORMATION:
I. Background
Today, Federal information and information systems are increasingly
the targets of sophisticated attacks by criminals and our adversaries,
as well as subject to risks involving non-adversarial threats (e.g.,
accidental misuse of information). Executive Order (E.O.) 13556,
Controlled Unclassified Information, established the Controlled
Unclassified Information (CUI) Program to manage information that
requires safeguarding or dissemination controls and designated the
National Archives and Records Administration (NARA) as the executive
agent of the CUI Program.
NARA published a final rule on September 14, 2016 (81 FR 63324) to
implement the CUI requirements of E.O. 13556. As part of the
implementation of the NARA final rule, NARA maintains a registry
(https://www.archives.gov/cui) of unclassified information that
requires safeguarding or dissemination controls. NARA's CUI Registry
identifies the organizational index grouping and related categories of
information and specifies how the information should be marked and
disseminated, among other actions that must be taken.
NARA's rule codified uniform policies and procedures for marking,
safeguarding, disseminating, decontrolling, and disposing of CUI for
Federal executive branch agencies at 32 CFR part 2002. These policies
also affect contractors that are expected to collect, develop, receive,
transmit, use, handle, or store CUI during contract performance. To
apply the policies to contractors, the CUI Program must be incorporated
into the acquisition process, specifically, when agencies define their
requirements, issue solicitations, and award contracts. In order to do
so, Government and contractor roles and responsibilities for
safeguarding, using, marking, disseminating, and decontrolling CUI
residing on both Federal and non-Federal information systems must be
identified.
DoD has implemented the requirements of the CUI Program within the
clause at Defense Federal Acquisition Regulation Supplement (DFARS)
252.204-7012, Safeguarding Covered Defense Information and Cyber
Incident Reporting. DoD has also proposed amending the DFARS to
incorporate contractual requirements associated with the Cybersecurity
Maturity Model Certification program (CMMC) in order to verify
contractor implementation of security controls through a proposed rule
published in the Federal Register on August 15, 2024, at 89 FR 66327.
Separately, the CMMC program was established in Title 32 of the Code of
Federal Regulations through a final rule published in the
[[Page 4279]]
Federal Register on October 15, 2024, at 89 FR 83092.
DoD, GSA, and NASA are proposing to revise the FAR to implement
NARA's final rule on the Federal CUI Program as it relates to
performance under Federal contracts. The Privacy Act requirements at
FAR part 24 are not changed by this rulemaking.
DoD, GSA, and NASA propose to create a common mechanism, the
Standard Form XXX, Controlled Unclassified Information (CUI)
Requirements, to enable a uniform process for communicating the
information contractors must manage and safeguard as well as identify
where a CUI incident must be reported and when there are CUI incident
reporting requirements that differ from or are in addition to those in
the clause at FAR 52.204-XX(g). Currently laws, Federal regulations,
and Government-wide policies already mandate these protections, but
there is not a standard way these requirements are identified and
shared with contractors.
This proposed rule is just one element of a larger strategy to
improve the Government's efforts to identify, deter, protect against,
detect, and respond to increasingly sophisticated criminals and
adversaries targeting Federal information and information systems.
II. Discussion and Analysis
The proposed rule introduces a new standard form (SF) to support
uniformity in Governmentwide implementation of these policies. It
identifies roles and responsibilities for agencies and contractors when
controlled unclassified information (CUI) is located on Federal
information systems within a Federal facility or resides on or transits
through contractor information systems or within contractor facilities,
and it adds two new clauses and a provision to enable contractor
reporting and compliance responsibilities in Federal solicitations and
contracts.
The proposed rule is intended to provide for the following:
(1) SF XXX, Controlled Unclassified Information (CUI) Requirements,
was developed to promote consistency, assist Federal agencies and
contractors in the identification of CUI in agency requirements, and
uniformly define all associated handling requirements in accordance
with 32 CFR part 2002. The SF XXX will be included in solicitations and
contracts that may result in the handling of CUI that will ultimately
become performance requirements during contract performance.
(2) FAR 2.101 definitions for ``contractor-attributional
information,'' ``controlled unclassified information (CUI),'' ``CUI
incident,'' and ``CUI Registry'' are added to provide clarification as
these terms are new to the FAR. The definition of ``information
system'' is moved from FAR subpart 4.19 to 2.101. The term ``Federally-
controlled information system'' is updated to ``Federal information
system.''
(3) FAR 3.104-4 is amended to clarify that certain information must
be marked by the contractor before submitting it to the Government
(contractor bid or proposal information, contractor-attributional
information, contractor proprietary business information, and source
selection information). Contracting officers should consult with the
contractor if they are unsure whether information provided by the
contractor falls into one of these categories. Contracting officers who
are unsure how to handle such information, including whether it is CUI,
should consult with agency officials as necessary.
(4) FAR subpart 4.4:
The subpart heading is revised to read ``Safeguarding
Information and Information Systems'' since the information referred to
in subpart 4.4 is not limited to classified information and now
includes CUI.
Section 4.401 is amended to add a definition for
``information'' which was moved and revised from the definition
currently at FAR 4.1901.
At FAR 4.403 and 4.404, the current content is moved to
FAR 4.402.
FAR 4.403 is replaced with new content that provides
instructions on the implementation of the CUI Program. The added
language identifies the contracting officer's role in receiving and
incorporating the SF XXX in solicitations and contracts and the
contracting officer's responsibilities during contract administration.
A new provision at FAR 52.204-WW, Notice of Controlled Unclassified
Information Requirements, and new clauses at FAR 52.204-XX, Controlled
Unclassified Information, and 52.204-YY, Identifying and Reporting
Information That Is Potentially Controlled Unclassified Information,
are also prescribed. The changes for FAR 4.403 include the following:
[ssquf] Existing FAR 4.403 has been renumbered as FAR 4.402-2.
[ssquf] The clause at FAR 4.404 was moved to a new FAR 4.402-3.
[ssquf] FAR 4.403-1 adds definitions for ``CUI Basic,'' ``CUI
categories,'' ``CUI Specified,'' ``handling,'' ``lawful Government
purpose,'' ``limited dissemination control,'' and ``on behalf of an
agency.''
[ssquf] FAR 4.403-2 provides information on E.O. 13556 including
that the E.O. establishes NARA as the executive agent for the CUI
Program.
[ssquf] FAR 4.403-3 gives the applicability of the SF XXX and the
new FAR clauses 52.204-XX and 52.204-YY.
[ssquf] FAR 4.403-4 outlines the CUI policy and requires that CUI
involved in performance of a contract shall be identified on a SF XXX
and incorporated into the contract. Unmarked or mismarked CUI is not
considered a CUI incident unless the mismarking or lack of marking has
resulted in the mishandling or improper dissemination of the
information. Offerors are requested and contractors are required to
notify the Government within an 8 hour timeframe if they discover or
suspect information is CUI, but that CUI is not listed on an SF XXX or
is not marked or properly marked.
[ssquf] FAR 4.403-5 adds the usage of the SF XXX. The SF XXX itself
has detailed instructions.
[ssquf] FAR 4.403-6 provides that the agency point of contact to
whom the contractor reports an incident is found in the SF XXX at Part
C, Section IV. When the SF XXX is not used in a contract, the point of
contact is identified in FAR 52.204-YY(b). FAR 4.403-6 explains that
the SF XXX should list any special incident reporting requirements for
CUI Specified. FAR 4.403-6 also adds that the contracting officer shall
provide instructions to the contractor for submitting the system
images, in accordance with agency procedures. FAR 4.403-6 also explains
that the contractor is required to hold the system images for 90 days
unless the Government declines interest.
[ssquf] FAR 4.403-7 requires the contracting officer to insert the
clause at FAR 52.204-XX, Controlled Unclassified Information, or the
clause at FAR 52.204-YY, Identifying and Reporting Information That Is
Potentially Controlled Unclassified Information, and to insert the
provision at FAR 52.204-WW, Notice of Controlled Unclassified
Information Requirements, in solicitations and contracts, excluding
solicitations and contracts solely for the acquisition of commercially
available off-the-shelf (COTS) items.
FAR 4.404 clause prescription is moved to FAR 4.403-7.
Coverage from FAR subpart 4.19 has been moved to FAR 4.404.
Several organizational changes, including relocation of
text and definitions from FAR subpart 4.19, improve the logical flow of
information.
[[Page 4280]]
FAR 4.404-1 adds definitions for ``covered contractor
information system'' and ``covered Federal information.'' The term
``Federal contract information'' was changed to ``covered Federal
information'' to align with the term ``covered contractor information
system,'' and the definition of ``covered Federal information'' was
revised to clarify that the term excludes CUI and classified
information. The definition of ``covered Federal information'' is also
amended in FAR clause 52.204-21, Basic Safeguarding of Covered
Contractor Information Systems.
FAR 4.404-2, Applicability, has been added to state that
while covered Federal information is not required to be marked or
identified by the Government, some administrative markings (e.g.,
draft, deliberative process, predecisional, not for public release) can
indicate that the information is covered Federal information.
FAR 4.404-3 has been added to require the contracting
officer to insert the clause at FAR 52.204-21, Basic Safeguarding of
Covered Contractor Information Systems, in solicitations and contracts,
excluding solicitations and contracts solely for the acquisition of
COTS items or Federally-funded basic and applied research in science,
technology, and engineering at colleges, universities, and laboratories
in accordance with National Security Decision Directive 189 when the
agency does not provide any covered Federal information to the
contractor. FAR 4.404-3 replaces the clause prescription section at FAR
4.1903. The prescription for the clause at FAR 52.204-21 was updated to
match the prescription for the CUI clause, because, while both types of
information are likely to be in a wide range of contracts, covered
Federal information is more ubiquitous than CUI and it may be difficult
for the contracting officer to identify during development of the
solicitation when covered Federal information may be applicable for the
procurement.
FAR 4.1301 and 4.1303 have been updated to remove the
references to ``PUB Number'' and ``PUB'' and edit the term ``Federally-
controlled information system'' to make it ``Federal information
system''.
(5) FAR 7.103, Agency-head responsibilities. New language is added
to describe agency planners' responsibilities for compliance with 32
CFR part 2002 and the completion of the SF XXX during acquisition
planning.
(6) FAR 7.105, Contents of written acquisition plans. CUI is added
to the security considerations to be addressed during acquisition
planning.
(7) At FAR 7.503, Policy, language has been revised to clarify that
the list of examples of functions generally not considered to be
inherently governmental functions, includes contractors working in any
situation that permits or might permit them to gain access to CUI.
(8) FAR subpart 9.5, Organizational and Consultant Conflicts of
Interest, includes updates to FAR 9.505, 9.505-4, and 9.508 to make
clear proprietary information is contractor proprietary business
information.
(9) FAR 11.002, Policy. New language is added to incorporate the
requirements for CUI and use of the SF XXX when describing agency
needs.
(10) FAR 12.202, Market research and description of agency need.
New language is added to incorporate the requirements for CUI and the
SF XXX in requirements documents for the acquisition of commercial
products and commercial services.
(11) At FAR 15.407-1, a reference to CUI and classified information
is added to clarify the type of information that should be protected
from improper disclosure.
(12) At FAR subpart 15.6, conforming changes are made to change
``proprietary information'' and ``restrictive legend'' or ``legend'' to
``contractor proprietary business information'' and ``administrative
marking,'' respectively.
(13) FAR 27.203, Security requirements for patent applications and
other patent information. A new section is added to inform contracting
officers that CUI safeguarding requirements apply to patent application
and other patent information.
(14) FAR part 52. A new provision FAR 52.204-WW, Notice of
Controlled Unclassified Information Requirements, is added to inform
offerors of requirements on restricted use of Government-provided
information, on appropriately identifying sensitive offeror-provided
information, and on notifying the Government regarding unmarked or
mismarked CUI. A new FAR clause 52.204-XX, Controlled Unclassified
Information, is added to require contractors to comply with applicable
CUI requirements, if the SF XXX indicates that the contractor is
expected to collect, develop, receive, transmit, use, handle, or store
CUI under the contract. A new FAR clause 52.204-YY, Identifying and
Reporting Information That Is Potentially Controlled Unclassified
Information, is added to apply to contracts in which the requiring
activity indicates on the SF XXX that no CUI is involved in the
performance of the contract. CUI requirements include:
Requirements for how the contractor must mark CUI
submitted to the Government and notify the Government of any mismarked
or unmarked CUI discovered;
Restrictions on the contractor's use of Government-
provided information apply whether or not the information is marked as
CUI;
Requirements for safeguarding CUI residing on Federal and
non-Federal systems, as identified in the SF XXX, Controlled
Unclassified Information (CUI) Requirements;
Requirements for reporting and managing security
incidents;
Actions that may be necessary to validate compliance;
Minimum CUI training requirements; and
The requirement for contractors to flow down CUI
requirements to subcontractors, if applicable.
(15) FAR 52.204-21, Basic Safeguarding of Covered Contractor
Information Systems. Text is added for the definition and at paragraph
(b)(3) for the identification of ``covered Federal information''.
(16) FAR clause 52.212-5 is updated to reflect that FAR clause
52.204-XX is applicable to acquisitions of commercial products and
services. FAR clause 52.213-4 is updated to reflect usage of the FAR
52.204-XX clause in simplified acquisitions for other than commercial
products or services. FAR clause 52.244-6 is updated to address the
flow down to subcontracts for the two new clauses.
(17) Additional minor edits are made at FAR 1.106 to add the OMB
control number information for the provision and clause, at FAR 42.302
to update a cross-reference, and at FAR subpart 53.2 to add the new SF
XXX, Controlled Unclassified Information (CUI) Requirements.
III. Applicability to Contracts at or Below the Simplified Acquisition
Threshold (SAT) and for Commercial Products, Including Commercially
Available Off-the-Shelf (COTS) Items, or Commercial Services
This rule proposes a new provision at FAR 52.204-WW, Notice of
Controlled Unclassified Information Requirements. The proposed
provision is prescribed at FAR 4.403-7(a) for use in solicitations that
contain the clause at FAR 52.204-XX or the clause at FAR 52.204-YY. The
rule proposes a new clause at FAR 52.204-XX, Controlled Unclassified
Information. The proposed clause is
[[Page 4281]]
prescribed at FAR 4.403-7(b) for use in solicitations and contracts if
the requiring activity has marked the ``Yes'' box in Part A of the SF
XXX, except for solicitations and contracts solely for the acquisition
of COTS items. The rule proposes a new clause at FAR 52.204-YY,
Identifying and Reporting Information That Is Potentially Controlled
Unclassified Information. The proposed clause is prescribed at FAR
4.403-7(c) for use in solicitations and contracts if the requiring
activity has marked the ``No'' box in Part A of the SF XXX, excluding
solicitations and contracts solely for the acquisition of COTS items.
This rule also proposes to amend the FAR to implement 32 CFR part
2002, Controlled Unclassified Information, in Federal solicitations and
contracts. The objective of the rule is to implement uniform,
Governmentwide policies and procedures for Federal agencies and
contractors regarding handling of CUI. Since CUI requires protection
regardless of dollar value or commerciality of the product or service,
this rule will apply to contracts at or below the SAT and to commercial
products and commercial services. The rule does not apply to contracts
that are solely for the acquisition of COTS items.
IV. Expected Impact of the Rule
A. General Compliance Requirements
Under the terms of this proposed rule, contractors will be required
to safeguard CUI that the Government identifies in the standard form
(SF) XXX, Controlled Unclassified Information (CUI) Requirements, and
ensure handling consistent with 32 CFR part 2002. This includes CUI
that the agency provides to the contractor, or CUI that the contractor
collects, develops, receives, transmits, uses, handles, or stores in
performance of the contract. CUI is defined at FAR 2.101 as information
that the Government creates or possesses, or that an entity creates or
possesses for or on behalf of the Government, that a law, regulation,
or Governmentwide policy requires or permits an agency to handle using
safeguarding or dissemination controls.
The contractor shall permit access to CUI only as described in the
SF XXX. A contractor will need to review the SF XXX to determine what
information under the contract is considered CUI and how to properly
safeguard the CUI. If the contractor intends to flow CUI down to a
subcontractor, then the contractor will also be required to prepare an
SF XXX and distribute it to the subcontractor to ensure the
subcontractor properly safeguards CUI. Any contractor or subcontractor
employee that handles CUI will be required to complete training on
safeguarding CUI, as specified on the SF XXX.
Identification of CUI on the SF XXX triggers compliance
requirements as specified in the new contract clause at FAR 52.204-XX,
Controlled Unclassified Information, e.g., security requirements in
NIST SP 800-171, Revision 2, or controls in NIST SP 800-53 depending on
the type of information systems that process, store, or transmit CUI.
The compliance requirements are discussed in more detail in section
IV.C. of this preamble and will vary depending on the organizational
Index Grouping and category of CUI being handled under the contract and
how the information is being collected, developed, received,
transmitted, used, handled, or stored. Prime contractors that flow down
CUI to subcontractors will also be required to flow down the compliance
requirements of the clause at FAR 52.204-XX; a requirement that applies
at all subcontract tiers. The new clause at FAR 52.204-YY also flows
down to subcontracts.
A new solicitation provision at FAR 52.204-WW, Notice of Controlled
Unclassified Information Requirements, is prescribed for use in
solicitations that contain the new clause at FAR 52.204-XX or the new
clause at FAR 52.204-YY. This provision provides a notice to offerors
that agencies will provide agency procedures on handling CUI during the
solicitation phase if handling CUI is necessary to prepare an offer.
The notice also advises offerors that contractor bid or proposal
information, proprietary business information, or contractor-
attributional information must be properly marked to ensure adequate
protection of their information. The provision also advises offerors
that they should notify the contracting officer if there appears to be
unmarked or mismarked CUI or an incident related to CUI handled by the
offeror during the solicitation phase.
When the contract does not identify CUI, the new contract clause at
FAR 52.204-YY, Identifying and Reporting Information That Is
Potentially Controlled Unclassified Information, is used in lieu of the
CUI clause. Similar to the solicitation provision, this clause requires
the contractor to notify the Government if there appears to be unmarked
or mismarked CUI or a suspected CUI incident related to information
handled by the contractor in performance of the contract. This clause
requires the contractor to properly mark proprietary business
information or contractor-attributional information to ensure adequate
protection.
The new solicitation provision and the new contract clauses all
forbid an offeror or contractor from using Government-provided
information for its own purposes, whether or not the information is
marked as CUI, unless the information is in the public domain, or
unless the information is lawfully made available to the offeror or
contractor by someone other than the Government.
B. Benefits
1. Uniform Cybersecurity Hygiene Baseline
Establishing uniform requirements for how the acquisition workforce
and Federal contractors manage CUI will significantly improve the
Government and Federal contractors' ability to protect Federal
information and information systems from criminals and our adversaries.
Absent the uniform approach proposed in this rule, agencies will
continue to employ ad hoc, agency-specific policies to manage this
information, an approach that can cause agencies to mark and handle
information inconsistently and inefficiently. While waivers may be
applied in some circumstances, this rule is intended to establish a
Governmentwide baseline that will lead to more effective implementation
of protections for this sensitive information by the acquisition
workforce and contractors. More effective implementation of
requirements for identifying and marking CUI will reduce scenarios in
which contractors may not realize the information that they are
handling is sensitive information that must be safeguarded.
2. Protection From Potential Financial Impacts of CUI Incidents
Failure to adopt these basic cybersecurity requirements can have a
substantial financial impact on a business. There have been many
analyses regarding the cost of cybersecurity incidents and the
estimates vary widely. In order to establish a defensible set of cost
and loss data that is suitable for the analysis of cybersecurity
incident costs in the Federal sector, the Cyber Security and
Infrastructure Security Agency (CISA) Office of the Chief Economist
(OCE), in the Department of Homeland Security, reviewed a broad range
of cyber cost and loss studies and presented an analysis of the per-
incident, aggregate, and scenario-based estimates of cyber loss. On
October 26, 2020, the CISA
[[Page 4282]]
OCE released a report with the results of their analyses and a summary
of per-incident loss estimates available in the most widely cited
published research, commercial datasets, and industry reports. OCE
estimated the median cost of a cybersecurity incident cited in the
surveyed publications ranged from $0.5 to $1.6 million. The maximum
cost per incident cited ranged from $11.7 million to greater than $1
billion. The CISA OCE acknowledges in its report that the differences
in the assumptions, approaches to data collection, and specific
incidents included in the datasets for the above sources result in a
high degree of variability among the loss estimates.\1\
---------------------------------------------------------------------------
\1\ CISA OCE. (2020). Cost of a Cyber Incident: Systematic
Review and Cross-Validation. https://www.cisa.gov/sites/default/files/publications/CISA-OCE_Cost_of_Cyber_Incidents_Study-FINAL_508.pdf.
---------------------------------------------------------------------------
3. Increased Protection of Sensitive Information
Given the potential financial impacts a CUI incident may have on
companies and individuals, it is imperative that Federal contractors
who are entrusted with sensitive information in the performance of
Government contracts adopt the basic cybersecurity hygiene requirements
outlined in this rule. This increased baseline of cybersecurity hygiene
across Federal contractors will reduce the number of incidents that
have the potential to place sensitive information at risk and pose
serious threats to individuals, Federal operations and assets, and the
contractors themselves. For the remaining incidents that may occur, the
requirement for contractors to report suspected or confirmed CUI
incidents within 8 hours, unless a different time period is required
for a specific category of CUI or a Federally-controlled facility, will
allow the Federal Government to have appropriate situational awareness,
quickly respond to the incident, and reduce the impact of the event.
C. Public Costs
The total estimated public costs associated with this FAR rule in
billions over a 10-year period are as follows:
------------------------------------------------------------------------
Public cost Undiscounted 2 Percent
------------------------------------------------------------------------
Present Value........................... $17.63 $15.89
Annualized.............................. 1.76 1.77
------------------------------------------------------------------------
Undiscounted public costs (in billions) by year over the 10-year
period are summarized as follows:
--------------------------------------------------------------------------------------------------------------------------------------------------------
Year 1 Year 2 Year 3 Year 4 Year 5 Year 6 Year 7 Year 8 Year 9 Year 10
--------------------------------------------------------------------------------------------------------------------------------------------------------
$2.28....................................... $1.71 $1.71 $1.71 $1.71 $1.71 $1.71 $1.71 $1.71 $1.71
--------------------------------------------------------------------------------------------------------------------------------------------------------
The following is a summary from the Regulatory Impact Analysis
(RIA) of the specific compliance requirements and the estimated costs
of compliance. The new FAR clause is modeled after the most recent
version of the clause at DFARS 252.204-7012, which introduced many of
these compliance requirements on defense contractors and subcontractors
in 2015 and required compliance not later than December 31, 2017.
Therefore, the estimated costs of compliance have been segregated into
those that are new for Federal offerors, contractors, and
subcontractors (see section IV.C.1 of this preamble) and those that are
new only for non-defense contractors and subcontractors (see section
IV.C.2 of this preamble). The RIA includes a detailed discussion and
explanation about the assumptions and methodology used to estimate the
cost of this regulatory action, including the specific impact and costs
for small businesses. Public comment is requested on the RIA, which is
available at https://www.regulations.gov (search for ``FAR Case 2017-
016,'' click ``Open Docket,'' and view ``Supporting Documents'').
1. Federal Offerors, Contractors, and Subcontractors
The following compliance requirements are considered new for
Federal offerors, contractors, and subcontractors required to safeguard
CUI:
a. Regulatory Familiarization
Familiarization accounts for the time to read and understand the
rule. It is expected that most contractors will be required to become
familiar with the various compliance requirements of the FAR, in order
to be prepared to handle or receive CUI in performance of a Federal
contract. According to award data in the Federal Procurement Data
System (FPDS) for fiscal year (FY) 2021 through FY 2023, on average per
year the Government awards contracts and orders for supplies and
services to 67,547 unique contractors, all of whom are expected to
become familiar with this rule. It is estimated that on average it will
take two hours per contractor and subcontractor that handle CUI to
review the rule. The estimated cost for regulatory familiarization in
the first year of implementation is $10,267,144 (67,547 contractors and
subcontractors * 2 hours/entity * $76/hour), of which $6,711,104 is
attributed to 44,152 small businesses.
b. Review the SF XXX
Offerors, contractors, or subcontractors will need to review the SF
XXX to determine the information under the contract or subcontract that
is considered CUI and how to properly safeguard the CUI. It is
estimated that approximately 22,680 offerors, contractors, and
subcontractors may review 2,092,918 forms for information on how to
protect CUI each year. On average, it is estimated that it will take an
offeror, contractor, or subcontractor two hours to review the SF XXX.
The estimated annual cost to review standard forms is $334,866,880
(2,092,918 forms * 2 hours/form * $80), of which $5,058,880 is
attributed to 15,809 small businesses.
c. Prepare and Distribute the SF XXX
If the contractor intends to flow down CUI to a subcontractor, then
the contractor must prepare an SF XXX and distribute it to the
subcontractor to ensure the subcontractor properly safeguards CUI. It
is estimated 517,392 standard forms may be prepared and distributed by
contractors and
[[Page 4283]]
subcontractors each year. On average, it is estimated that it will take
the contractor or subcontractor two hours to prepare and distribute the
SF XXX. The estimated annual cost to prepare and distribute the SF XXX
is $82,782,270 (517,392 forms * 2 hours/form * $80), of which
$2,529,440 is attributed to 15,809 small business contractors and
subcontractors.
d. Train Employees on Handling CUI
A contractor shall not permit any contractor employee to collect,
develop, receive, transmit, use, handle, or store CUI unless the
employee has completed training on properly handling CUI as described
in the SF XXX. The contractor must provide evidence of employee
training upon request by the contracting officer; however, such
requests are expected to be limited to, for example, instances in which
the Government is dealing with a CUI incident. It is estimated that
approximately 2,191,400 contractor and subcontractor employees may be
required to take training on handling CUI, which is expected to take
one hour to complete. It is anticipated that agencies will provide
their support contractors and personnel with CUI standard training
aligned with Federal policy.
The estimated annual training cost is $166,546,400 (2,191,400
employees * 1 hour/employee * $76/hour), of which $26,440,400 is
attributed to 34,790 small business contractors and subcontractors. The
estimated annual recordkeeping cost to maintain contractor training
records is $10,003,741 (2,191,400 records * 0.083 hours/record * $55/
hour), of which $1,588,164 is attributed to the 34,790 small
businesses. The estimated annual reporting cost is $19,664 (1,430
requests * 0.25 hours/response * $55/hour), of which $13,401 is
attributed to 975 small businesses.
e. Comply With NIST SP 800-172
A limited number of contractors may be required to implement NIST
SP 800-172, Enhanced Security Requirements for Protecting Controlled
Unclassified Information: A Supplement to NIST Special Publication 800-
171, for components of non-Federal systems that process, store, or
transmit CUI or that provide security protection for such components
when the designated CUI is associated with a critical program or high-
value assets. Contractors that are subject to these enhanced security
requirements may incur additional process/information technology
configuration, network isolation, and security operations center/
threat-related costs; however, the impact on any particular contractor
may vary considerably, depending on a contractor's current
infrastructure and development environment, and the composition of
their customer base.
It is estimated that approximately 160 contractors may be subject
to the enhanced security requirements. Of these 160 contractors, 100
are categorized as small businesses with 25-50 end-point systems. The
estimated cost of initial implementation of NIST SP 800-172 for each of
these contractors is $202,500. Twenty contractors are estimated to have
50-100 end-point systems (medium businesses) and 40 are expected to
have 750-1500 end-point systems (large businesses). The estimated costs
of initial implementation for these contractors are approximately
$1,000,000 per medium business and $2,315,000 per large business.
Therefore, the total estimated cost for 160 contractors to
implement NIST SP 800-172 is $132,850,000, of which $20,250,000 is
attributed to 100 small businesses. Annual recurring costs are
estimated to be 20 percent of the cost of initial implementation.
f. Submit Supporting Documentation To Verify Compliance
A contractor may also be required to submit to the Government a
description of the system security plan required by NIST SP 800-171
Revision 2 to demonstrate their implementation of the security
requirements in NIST SP 800-171 Revision 2. Requests for access to
review the system security plan are expected to be rare, such as in
response to a reported CUI incident. It is estimated that the system
security plan may be requested 1,430 times and that it would take a
contractor 30 minutes to submit the plan. The total estimated annual
cost is $67,925 (1 request * 1,430 contractors * 0.5 hours/response *
$95/hour), of which $46,294 is attributed to 975 small businesses.
Note, the cost to develop and maintain a system security plan in
accordance with NIST SP 800-171 Revision 2 is attributed only to non-
defense contractors (see sections IV.C.2.a. and IV.C.2.d. of this
preamble) since defense contractors are subject to NIST SP 800-171
Revision 2 pursuant to DFARS clause 252.204-7012 and should already
maintain system security plans.
g. Comply With Additional Security Requirements Identified in the
Solicitation or Requirements Document
In addition to the security requirements outlined in the SF XXX and
the new FAR clause at 52.204-XX, the requirements document may require
the contractor to comply with controls beyond NIST SP 800-171 Revision
2 to address unique requirements to protect CUI Basic at higher than
the moderate confidentiality level in accordance with 32 CFR
2002.14(h)(2). Similarly, if offerors require access to CUI, the
Government will provide agency procedures on handling the CUI to ensure
compliance with the requirements in 32 CFR 2002. The contractor shall
also implement additional information security requirements it
reasonably determines necessary to provide adequate security in a
dynamic environment. Given that agencies have discretion in developing
their contract-specific requirements, the Government does not attempt
to quantify these costs.
h. Comply With Additional Notification and Marking Requirements
Offerors and contractors are required to notify the contracting
officer representative or other designated agency official concerning
any unmarked or mismarked CUI if discovered. These potential costs are
not quantified since such occurrences are expected to be rare. In
addition, to the maximum extent practicable, the offeror or contractor
shall identify and mark its proprietary business and attributional
information. These costs are also not quantified since an offeror or
contractor usually marks its proprietary information as a best business
practice to protect its own interests and information. Finally,
offerors are required to notify the contracting officer of a potential
CUI incident within 8 hours of discovery. Such occurrences are expected
to be rare and are assumed to be accounted for under the public cost
estimate for CUI incident reporting in section IV.C.2.b. of this
preamble.
2. Non-Defense Contractors and Subcontractors
a. Comply With NIST SP 800-171 Revision 2
A contractor may need to depend on the expertise of information
security specialists to develop and document processes and procedures
associated with each security requirement, perform the periodic scans,
tests, and assessments necessary for some of the security requirements,
and analyze the results. The amount of time necessary to perform the
various tasks will vary by contractor depending on the number of
employees and the complexity of its information systems. Some
contractors may already have personnel performing some of the functions
as a matter of good business practice to protect their
[[Page 4284]]
networks, while others may be starting with no in-house expertise.
The total estimated labor cost for a small business in the initial
year is approximately $148,200 (average of 1,560 hours * $95), with a
recurring annual labor cost of approximately $98,800 (1,040 hours *
$95). The total estimated labor cost for a business other than a small
business in the initial year is approximately $543,400 (average of
5,720 hours * $95), with a recurring annual labor cost of approximately
$494,000 (5,200 hours * $95). Note, this does not include the time
expected to maintain the system security plan (see section IV.C.2.d. of
this preamble).
Businesses may also need to install software and/or hardware to
implement NIST SP 800-171 Revision 2. Similar to the labor costs, the
cost of the specific software or hardware varies based on the solution
selected by the business, a decision that will take into consideration
the number of users, the types of devices used, and the complexity of
the network, among other things. The Government estimates that a small
business, on average, may spend $27,500 on hardware and software during
initial implementation and $5,000 annually thereafter to maintain
compliance. On average, a business other than a small business may
spend $140,000 on hardware and software in the initial year and $80,000
annually thereafter.
Therefore, the total estimated cost of labor, hardware, and
software for 5,875 contractors to implement NIST SP 800-171 Revision 2
in the initial year is $1,524,706,500, of which $861,808,500 is
attributed to 4,905 small businesses. The total estimated annual
recurring maintenance costs are $1,065,919,000, of which $509,139,000
is attributed to 4,905 small businesses.
b. Assess and Report Suspected CUI Incidents
When the contractor discovers a suspected CUI incident, the
contractor is required by the clause at FAR 52.204-XX and, when
applicable, the clause at FAR 52.204-YY to: determine what CUI was or
could have been improperly accessed, used, processed, stored,
maintained, disseminated, disclosed, or disposed of; construct a
timeline of user activity; and determine methods and techniques used to
access CUI. The contractor shall report any suspected or confirmed CUI
incident to the agency website or point of contact identified in the SF
XXX, within 8 hours of discovery. The clause at FAR 52.204-XX also
requires the contractor to include in the report as many of the
applicable data elements located on the DIBNet website (https://dibnet.dod.mil) as are available and provide any remaining applicable
data elements as soon as they become available. Subcontractors are
required by FAR 52.204-XX(h) to notify the prime or next higher tier
subcontractor within the same timeframe. When applicable, the clause at
FAR 52.204-YY requires contractors to follow agency requirements
related to the incident if it turns out CUI is involved.
It is estimated that there may be 580 incident reports submitted
each year and that it may take a contractor four hours to prepare and
submit CUI incident reports to civilian agencies. The total estimated
annual cost for CUI incident reporting for non-defense contractors is
$275,500 (580 non-defense contractors * 1 incident/non-defense
contractor * 4 hours/response * $95/hour), of which $188,482 is
attributed to 397 small businesses.
c. Preserve and Protect Images for Suspected CUI Incidents and Submit
Media and Data for Damage Assessments
If a suspected or confirmed CUI incident has occurred on an
information system, the contractor is required by the clause at FAR
52.204-XX to preserve and protect images of all known affected
information systems and all relevant monitoring and packet capture data
for at least 90 days from the submission of the report to allow the
Government to request the media and data or decline interest during
this 90 day period, after which, if no request has been made, the
images need no longer be preserved.
It is estimated that it will take a contractor approximately 7.5
hours to preserve and protect images of all known affected information
systems and all relevant monitoring and packet capture data, assuming
30 minutes to image, 2 hours to preserve monitoring and packet capture
data, and 5 hours to upload images and set up storage space. The
estimated annual cost to preserve and protect images associated with
580 CUI incidents is $413,250 (580 contractors * 1 recordkeeper/
contractor * 7.5 hours/record * $95/hour), of which $282,722 is
attributed to 397 small businesses. The estimated annual cost to submit
media and data is $11,400 (48 non-defense contractors * 1 incident/non-
defense contractor * 2.5 hours/response * 95/hour), of which $7,799 is
attributed to 33 small businesses.
d. Maintain the System Security Plan
It is assumed that each of 10,242 non-defense contractors required
to implement NIST SP 800-171 Revision 2 has one information security
analyst who spends one hour per month (or 12 hours per year)
maintaining the system security plan. The estimated annual
recordkeeping cost is $11,675,880 (10,242 contractors * 1 record/
recordkeeper * 12 hours/record * $95/hour), of which $7,987,980 is
attributed to 7,007 small businesses.
e. Cooperate With Validation Actions for Non-Federal Information
Systems
The contractor shall cooperate with validation actions conducted by
an agency in accordance with NIST SP 800-171A, Assessing Security
Requirements for Controlled Unclassified Information, and if
applicable, NIST SP 800-172A for the enhanced security requirements.
These types of validation actions are similar to the High Confidence
Level Assessments being conducted by DoD pursuant to DFARS clause
252.204-7020, NIST SP 800-171 DoD Assessment Requirements, whereby the
Government reviews the system security plan description of how each
security requirement is met and the contractor demonstrates its
implementation. While cooperating with validation actions, a contractor
may need to provide the Government access to its facilities, systems,
and personnel.
According to DoD, the total estimated cost for a contractor to
participate in a strategic High Confidence Level Assessment is
approximately $50,675 per contractor. Therefore, the total annual
estimated cost for the 110 non-defense contractors to cooperate with
Government validation of a system security plan is $5,574,250, of which
$4,104,675 is attributed to 81 small businesses.
f. Comply With NIST SP 800-53 and the FedRAMP Moderate Baseline
Standards
The costs associated with contractor compliance with NIST SP 800-53
and the FedRAMP Moderate baseline standard for cloud service providers
are excluded from this analysis of public cost, as they are being
addressed under the proposed rule implementing section 2.i. of
Executive Order 14028, Improving the Nation's Cyber Security (reference
FAR Case 2021-019, Standardizing Cybersecurity Requirements for
Unclassified Federal Information Systems).
D. Government Costs
The total estimated Government costs associated with this FAR rule
in billions over a ten-year period are as follows:
[[Page 4285]]
------------------------------------------------------------------------
Government cost Undiscounted 2 Percent
------------------------------------------------------------------------
Present Value........................... $4.69 $4.21
Annualized.............................. 0.47 0.47
------------------------------------------------------------------------
Undiscounted Government costs (in billions) by year over the ten-
year period are summarized as follows:
--------------------------------------------------------------------------------------------------------------------------------------------------------
Year 1 Year 2 Year 3 Year 4 Year 5 Year 6 Year 7 Year 8 Year 9 Year 10
--------------------------------------------------------------------------------------------------------------------------------------------------------
0.47........................................ $0.47 $0.47 $0.47 $0.47 $0.47 $0.47 $0.47 $0.47 $0.47
--------------------------------------------------------------------------------------------------------------------------------------------------------
The following is a summary from the RIA of the Government costs
associated with reviewing contractor training records, investigating
reports of suspected or confirmed CUI incidents, and other action
associated with this FAR rule.
1. Prepare the SF XXX
While an SF XXX is required to be included in every solicitation
and contract that involves CUI, except those exclusively for COTS
items, the Government only incurs a significant cost when the CUI is
identified on the form. The contracting officer is responsible for
ensuring that the SF XXX identifies the protected information involved
in the system of records and includes any safeguarding and marking
requirements applicable to the information in accordance with FAR
4.403. Of the 2,092,918 forms expected to specify requirements for
safeguarding CUI (see section IV.C.1.b. of this preamble), 1,573,582
are expected to be prepared by the Government (see section IV.C.1.c. of
this preamble for the estimate of forms prepared by contractors and
subcontractors). The total estimated annual Government cost is
$453,191,616 (1,573,582 forms * 4 hour/form * $72/hour).
2. Review Training Records
It is estimated that it will take a Government employee 30 minutes
to review evidence of training submitted by the contractors (see
section IV.C.1.d. of this preamble). Therefore, the estimated annual
reporting cost is $51,480 (1,430 requests * 0.5 hours/response * $72/
hour).
3. Review CUI Incident Reports
It is estimated that it will take a Government employee four hours
to review the CUI incident information reported by a contractor (see
section IV.C.2.b. of this preamble). The estimated annual cost to the
Government is $292,900 (580 reports * 5 hours/response * $101/hour).
4. Review Media and Data for Damage Assessment
It is estimated that it will take a Government employee 10 hours to
conduct a damage assessment of media and data submitted by a contractor
(see section IV.C.2.c. of this preamble). The estimated annual cost to
the Government is $48,480 (48 submissions * 10 hours/response * $101/
hour).
5. Review System Security Plan
It is estimated that it will take a Government employee four hours
to review a system security plan submitted by a contractor (see section
IV.C.1.g. of this preamble). The estimated annual cost to the
Government is $577,720 (1,430 reports * 4 hours/response * $101/hour).
6. Conduct Validation Actions for Non-Federal Information Systems
For the purposes of this analysis, it is assumed that the cost to a
civilian agency to validate a contractor's system security plan (see
section IV.C.2.e. of this preamble) will be similar to the cost for DoD
to perform a strategic High Confidence Level Assessment, approximately
$51,097 per action. Therefore, the total annual estimated cost for
civilian agencies to perform these validations is $5,620,670 (110 non-
defense contractor system security plan reviews * $51,097/review).
7. Training Government Employees on New Requirements for CUI
It is expected that the Government contracting officers, contract
specialists, contracting officer representatives, and others involved
in the acquisition process, such as program managers and those involved
in the development of requirements documents, will be required to
become familiar with the technical requirements of this rule and
receive additional training. While the requirement to remain current on
policies for Government procurement, such as changes to the FAR, is
considered a part of the normal duties of such individuals, there is
expected to be specialized Government training on this topic, the cost
of which is attributed to this rule. It is estimated that 250,000
Government employees may need to take 30 minutes of specialized
training at an average wage rate equivalent to a GS-12, step 5,
Government employee. Therefore, the estimated annual training cost is
$9,000,000 (250,000 employees * 0.5 hours/employee * $72/hour).
E. Total Costs
The total estimated costs (in billions) associated with this FAR
rule over a ten-year period are as follows:
------------------------------------------------------------------------
Government Cost Undiscounted 2 percent
------------------------------------------------------------------------
Present Value........................... $22.32 $20.10
Annualized.............................. 2.23 2.24
------------------------------------------------------------------------
Undiscounted public and Government costs (in billions) by year over
the ten-year period are summarized in the following table:
[[Page 4286]]
--------------------------------------------------------------------------------------------------------------------------------------------------------
Year 1 Year 2 Year 3 Year 4 Year 5 Year 6 Year 7 Year 8 Year 9 Year 10
--------------------------------------------------------------------------------------------------------------------------------------------------------
$2.75....................................... $2.17 $2.17 $2.17 $2.17 $2.17 $2.17 $2.17 $2.17 $2.17
--------------------------------------------------------------------------------------------------------------------------------------------------------
F. Alternatives Considered
1. Status Quo
Absent this FAR rule, agencies will continue to employ ad hoc,
agency-specific policies to manage CUI. This approach can cause
agencies to mark and handle this information inconsistently and
inefficiently, and forces defense and non-defense contractors to
establish procedures and internal controls to meet different civilian
and defense agency approaches for marking and handling CUI. This
approach was determined to be counter to the purpose of the Federal
Acquisition Regulations System, which was established for the
codification and publication of uniform policies and procedures for
acquisition by all executive agencies (see FAR 1.101).
2. No Standard Form
The Government considered whether or not to establish a new
standard form to communicate CUI requirements specific to the contract.
As an alternative, the FAR could prescribe only a solicitation
provision and contract clause to establish offeror and contractor
responsibilities related to marking and handling CUI involved in the
contract but would not dictate how agencies communicate what types of
CUI may be involved in the contract. Given the importance of protecting
CUI, it was determined that a Standard Form is the best way to ensure
the Government is properly communicating specific CUI requirements for
each contract. Absent a standard form, there is a risk that agencies
may not provide enough information for contractors to understand what
CUI is involved in the contract and what responsibilities they have
with regard to this CUI. The standard form also provides a means for
contractors to uniformly communicate CUI requirements to its
subcontractors.
3. 100 Percent Inspection
Several aspects of this proposed rule require the contractor to
provide information upon request. For example, contractors may be
requested to submit supporting documentation to verify compliance with
the system security plan required by NIST SP 800-171 Revision 2 in
instances where the Government is dealing with a CUI incident that is a
confirmed breach or an agency determines that it is necessary to verify
a contractor's system security plan based on the criticality of a
program and the CUI being handled on the contractor's information
system (see sections B.1.e. and D.1.g. of the Regulatory Impact
Analysis). Similarly, when such CUI incidents have occurred, the
Government may require the contractor to submit information to verify
that the contractor and its subcontractors have provided appropriate
training to their employees that handle CUI, as required by the clause
at FAR 52.204-XX (see sections B.1.c. and D.1.b of the Regulatory
Impact Analysis).
As an alternative, the Government considered whether to require
contractors to submit evidence of its system security plan and evidence
that employees have been trained on an annual basis. However, defense
contractors should have already implemented system security plans in
accordance with DFARS clause 252.204-7012 and non-defense contractors
have incentive to ensure compliance with the requirements in FAR clause
52.204-XX to avoid liability for breaches of CUI that may result from
improperly protecting CUI being handled on the contractor's information
system. As such, implementing a 100 percent inspection requirement
would unnecessarily and significantly increase the burden on
contractors and the Government.
4. Implementation of NIST SP 800-171 Revision 3
This proposed rule requires contractors to implement the
requirements of NIST SP 800-171 Revision 2. In May of 2024, NIST
published Revision 3 to NIST SP 800-171 (see https://csrc.nist.gov/pubs/sp/800/171/r3/final). The Government is currently assessing where
the organizationally-defined parameters within Revision 3 should be
standardized and implemented on a governmentwide basis. As stated in
the benefits section of this rule, it is important for the Government
to immediately implement requirements to protect CUI on non-Federal
information systems; therefore, this proposed rule does not seek to
implement NIST's most recent revision. The FAR Council anticipates that
future rulemaking will be initiated to update NIST SP 800-171 and NIST
SP 800-171A to the current version.
V. Specific Questions for Public Comment
To understand the exact scope of this impact and how this impact
could be affected in the final rule, DoD, GSA, and NASA welcome input
on the following questions regarding anticipated impact on affected
parties. DoD, GSA, and NASA recognize that some agencies may need to
tailor the approach to the information collected based on the unique
mission and risks for their agency.
1. Is there additional information or guidance you view as
necessary to effectively comply with this rule?
2. Are there specific situations you anticipate where your
organization will be required to report on different timelines in order
to comply with the CUI incident reporting requirements outlined in this
proposed rule, other Federal contract requirements, or other
regulations promulgated under Federal law? How would your organization
handle disparate incident reporting timelines in other Federal
Government contracting requirements or from other regulatory agencies?
3. Incident response and associated reporting are often iterative
processes, with system owners updating reports as a situation evolves
and more data becomes available. What implications are there for your
organization, including with respect to incident response, to meet
disparate timelines for incident reporting?
4. How much, if at all, would you estimate that the initial
reporting requirement described in this proposed rule could increase
the price of the products or services your organization provides to the
Federal Government?
5. Understanding evolving data capabilities may change the nature
or sensitivity of information over time, are there specific concerns
not adequately addressed in this proposed rule? If possible, please
provide any relevant use cases.
6. The FAR Council notes there is also what is referred to as ``CUI
specified'', which is information that is considered CUI, but is also
required to be handled in a certain way due to other laws, regulations,
and policies (e.g., restrictions on disseminating information to
foreign nationals or dual citizens under International Traffic in Arms
Regulations (ITAR)). For CUI specified information, not only does it
have to be treated and handled as CUI,
[[Page 4287]]
but it also must be handled in accordance with the other applicable
regulations and laws. Are there specific concerns not addressed in this
proposed rule in this area? If so, please provide a relevant use case.
VI. Executive Orders 12866 and 13563
Executive Orders (E.O.s) 12866 (as amended by E.O. 14094) and 13563
direct agencies to assess the costs and benefits of available
regulatory alternatives and, if regulation is necessary, to select
regulatory approaches that maximize net benefits (including potential
economic, environmental, public health and safety effects, distributive
impacts, and equity). E.O. 13563 emphasizes the importance of
quantifying both costs and benefits, of reducing costs, of harmonizing
rules, and of promoting flexibility. This is a significant regulatory
action and, therefore, was subject to review under section 6(b) of E.O.
12866, Regulatory Planning and Review, dated September 30, 1993.
VII. Regulatory Flexibility Act
DoD, GSA, and NASA expect this proposed rule, if finalized, to have
a significant economic impact on a substantial number of small entities
within the meaning of the Regulatory Flexibility Act, 5 U.S.C. 601-612.
The Initial Regulatory Flexibility Analysis (IRFA) is summarized as
follows:
DoD, GSA, and NASA are proposing to revise the FAR to implement a
NARA final rule on the Federal CUI Program as it relates to performance
under Federal contracts (see 32 CFR part 2002).
This proposed rule creates two new clauses at FAR 52.204-XX,
Controlled Unclassified Information, and FAR 52.204-YY, Identifying and
Reporting Information That Is Potentially Controlled Unclassified
Information, and a new FAR provision at 52.204-WW, Notice of Controlled
Unclassified Information Requirements. These clauses and the provision
work together to implement a uniform way for Federal agencies,
offerors, and contractors to manage CUI. The rule also creates a new
standard form (SF) XXX to standardize the way in which the Government
identifies CUI that will be managed and safeguarded by a contractor in
performance of a contract. This rule is just one element of a larger
strategy to improve the Government's efforts to identify, deter,
protect against, detect, and respond to increasingly sophisticated
attacks by criminals and our adversaries targeting Federal information
and information systems.
Promulgation of this FAR rule is authorized by 41 U.S.C. 1121(b);
41 U.S.C. 1303; 40 U.S.C. 121(c); 10 U.S.C. chapter 4 and 10 U.S.C.
chapter 137 legacy provisions (see 10 U.S.C. 3016); and 51 U.S.C.
20113.
This rule will apply to small businesses that are awarded
Government contracts, other than those that receive awards exclusively
for COTS items. According to award data in the Federal Procurement Data
System (FPDS) for fiscal years (FY) 2021 through FY 2023, on average
per year the Government awards contracts and orders for supplies and
services (excluding those for supplies purchased using commercial item
procedures) to 67,547 unique contractors, of which 44,152 (65 percent)
are small businesses.
When an SF XXX is incorporated in the contract and identifies CUI
that will be involved in the contract, the contractor will be subject
to the new FAR clause at FAR 52.204-XX and more robust compliance
requirements for safeguarding the CUI. Per the FPDS data, of the
contractors that receive covered awards each year, approximately 37,933
are non-defense contractors and 29,614 are defense contractors, or
contractors that do business with both civilian agencies and DoD. Based
on consultation with subject matter experts, it is assumed that 18
percent of non-defense contractors (6,828) and 28 percent of defense
contractors (8,292), or 15,120 total contractors, may receive awards
each year that include an SF XXX listing CUI and the associated
safeguarding requirements. It is further assumed that the ratio of
subcontractors to prime contractors that handle CUI is 0.5:1, or 7,560
total subcontractors.
Therefore, each year, an estimated 22,680 contractors and
subcontractors, of which 15,809 (70 percent) are estimated to be small
businesses, will be required to safeguard CUI in performance of a
contract, pursuant to the new clause at FAR 52.204-XX and the
instructions provided on an SF XXX. These small entities may be
impacted by the various compliance requirements in the clause,
depending on the type of CUI required to be handled under the contract
or subcontract, the way in which the information will be handled, and
whether those small businesses have already been safeguarding sensitive
Government information under other contract provisions.
The new FAR clause at 52.204-XX is modeled after the existing
clause at DFARS 252.204-7012, Safeguarding Covered Defense Information
and Cyber Incident Reporting, the most recent version of which has been
in effect since 2017 (the clause has been in effect since 2013, and the
NIST SP 800-171 requirements were added in 2015). As such, small
businesses that do business with DoD and handle CUI in performance of
their contracts are already subject to requirements equivalent to the
new FAR clause and provision. In addition, small businesses that do
business with other agencies that have included similar or overlapping
safeguarding requirements under agency-specific contract terms may
already be in partial or substantial compliance with the clause
requirements.
The following specific compliance requirements will apply to all
Federal offerors, contractors, and subcontractors:
Review and Distribute the SF XXX. When the contract
includes an SF XXX that identifies CUI to be safeguarded under the
contract, the contract will include the CUI clause. The contractor or
subcontractor will need to review the SF XXX to determine what
information under the contract is considered CUI and subject to the
compliance requirements of the CUI clause. If the contractor or
subcontractor intends to flow down CUI in performance of the contract
or subcontract, then the contractor or subcontractor will need to
prepare an SF XXX, as appropriate for CUI that will flow down, and
distribute it to the subcontractor that will be handling CUI.
Train Contractor Employees on Handling CUI. Per the CUI
clause, a contractor shall not permit any contractor employee to have,
retain access to, create, collect, use, process, store, maintain,
disseminate, disclose, dispose of, or otherwise handle, CUI unless the
employee has completed training on properly handling CUI that, at a
minimum, includes the elements required in the SF XXX. The SF XXX will
also specify the frequency at which a contractor must provide the
training, which is dependent on the type of CUI being handled by the
contractor's employees and the criticality of the program being
supported. The contractor must provide evidence of employee training
upon request by the contracting officer; however, such requests are
expected to be limited to, for example, instances where the Government
is dealing with a CUI incident, or where an agency determines that it
is necessary to verify training based on the criticality of a program
and the CUI being handled by the contractor.
Comply with NIST SP 800-172. A limited number of
contractors may be required under FAR clause 52.204-XX, Controlled
Unclassified Information, to
[[Page 4288]]
implement some or all requirements of NIST SP 800-172, Enhanced
Security Requirements for Protecting Controlled Unclassified
Information: A Supplement to NIST Special Publication 800-171, Revision
2. NIST SP 800-172 provides enhanced security requirements that apply
only to components of nonfederal systems that process, store, or
transmit CUI or that provide security protection for such components
when the designated CUI is associated with a critical program or high-
value asset. The enhanced requirements supplement the basic and derived
security requirements in NIST Special Publication 800-171, Revision 2,
and address the protection of CUI by promoting: penetration-resistant
architecture, damage-limiting operations, and designs to achieve cyber
resiliency and survivability.
Submit Supporting Documentation to Verify Compliance. Per
FAR clause 52.204-XX, Controlled Unclassified Information, upon
request, a contractor shall submit the description of the system
security plan required by NIST SP 800-171, Revision 2, (and NIST SP
800-172, when applicable) and any associated plans of action for any
planned implementations or mitigations to the Government to demonstrate
the contractor's implementation or planned implementation of the
security requirements. Requests for the system security plan are
expected to be rare or limited to, for example, instances where the
Government is dealing with a CUI incident, or an agency determines that
it is necessary to verify a contractor's system security plan based on
the criticality of a program and the CUI being handled on the
contractor's information system.
Comply with any additional security requirements
identified in the Requirements Document. In addition to the security
requirements outlined in the SF XXX and the CUI clause, the
requirements document in the contract may require the Contractor to
comply with additional security requirements beyond NIST SP 800-171,
Revision 2, to address unique requirements to protect CUI Basic at
higher than the moderate confidentiality level in accordance with 32
CFR 2002.14(h)(2). The Contractor shall also implement additional
information security requirements it reasonably determines necessary to
provide adequate security in a dynamic environment.
Comply with Additional Notification Requirements. Unmarked
or mismarked CUI is not considered a CUI incident if the mismarking has
not resulted in the mishandling or improper dissemination of the
information. Per the new solicitation provision and contract clauses,
offerors are requested and contractors are required to notify the
Contracting Officer Representative or other designated agency official
concerning any unmarked or mismarked CUI if discovered. Such
occurrences are expected to be rare.
Comply with Additional Marking Requirements. To the
maximum extent practicable, offerors and contractors are required to
identify and mark any proprietary business or contractor-attributional
information.
The following compliance requirements are attributed only to non-
defense contractors and subcontractors that handle CUI, since defense
contractors are already required to comply with these requirements
pursuant to DFARS clause 252.204-7012:
Comply with NIST SP 800-171, Revision 2. If the Contractor
is operating a non-Federal information system that processes, stores,
or transmits CUI identified in the contract, the CUI clause requires
the contractor to comply with the security requirements in NIST Special
Publication 800-171, Revision 2, or as authorized by the Contracting
Officer and any CUI specified requirements identified in the SF XXX.
NIST SP 800-171 Revision 2 includes 110 security requirements for non-
Federal information systems that can be grouped into the following 14
categories: access control, awareness and training, audit and
accountability, configuration management, identification and
authentication, incident response, maintenance, media protection,
personnel security, physical protection, risk assessment, security
assessment, system and communications protection, and system and
information integrity. Specific information on the 110 individual
security requirements and various templates are available on the NIST
website at https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final. Federal contractors that handle covered Federal information
(CFI), a much broader category than CUI, on their information systems
are already required to have implemented 17 of the 110 security
requirements, which are already included in the clause at FAR 52.204-
21, Basic Safeguarding of Covered Contractor Information Systems. Such
requirements are considered ``met'' by all impacted contractors,
regardless of size. For the remaining 93 security requirements, a
contractor may need to establish a process or procedure, configure
existing information technology that the contractor already owns, or
acquire additional software or hardware.
Assess and report suspected CUI incidents. When the
Contractor discovers a suspected CUI incident, the CUI clause requires
the contractor to determine what CUI was or could have been improperly
accessed, used, processed, stored, maintained, disseminated, disclosed,
or disposed of; construct a timeline of user activity; and determine
methods and techniques used to access CUI. The Contractor shall report
any suspected or confirmed CUI incident to the agency website or point
of contact identified in the SF XXX, within 8 hours of discovery. The
report shall include as many of the applicable data elements located on
the DIBNet website as are available and provide any remaining
applicable data elements as soon as they become available. In addition,
if the Contractor is a FedRAMP authorized (Joint Authorization Board or
Agency) Cloud Service Provider, the Contractor shall also report to the
points of contact specified in the FedRAMP incident reporting
guidelines as documented in the Cloud Service Provider Incident
Response Plan. The requirements of the CUI clause are flowed down to
subcontracts at all tiers; subcontractors are required to notify the
prime contractor or next higher-tier subcontractor within the same
timeframes.
Preserve and protect images for suspected CUI incidents
and submit media and data for damage assessments. If a suspected or
confirmed CUI incident has occurred on an information system, the CUI
clause requires the Contractor shall preserve and protect images of all
known affected information systems and all relevant monitoring and
packet capture data for at least 90 days from the submission of the
report to allow the Government to request the media and data or decline
interest during this 90-day period, after which, if no request has been
made, the images need no longer be preserved.
Cooperate with Validation Actions for Non-Federal
Information Systems. The CUI clause requires the Contractor to
cooperate with validation actions conducted by an agency in accordance
with NIST SP 800-171A, Assessing Security Requirements for Controlled
Unclassified Information, and if applicable, NIST SP 800-172A for
enhanced security requirements. These types of validation actions are
similar to the DoD's Strategic High Confidence Level Assessments being
conducted by DoD pursuant to the clause at DFARS 252.204-7020, and NIST
SP 800-171 DoD Assessment Requirements, whereby the Government reviews
the system security plan description of how
[[Page 4289]]
each security requirement is met and the contractor demonstrates its
implementation. While cooperating with validation actions, a contractor
may need to provide the Government access to its facilities, systems,
and personnel.
Comply with NIST SP 800-53. The CUI clause requires the
Contractor, when it is operating an information system identified in
the SF XXX as a Federal information system that processes, stores, or
transmits CUI identified in the contract, to comply with agency-
identified security controls from NIST Special Publication 800-53 and
any CUI Specified requirements identified in the SF XXX. In addition,
cloud service providers must meet security requirements established by
the Government for the Federal Risk and Authorization Management
Program (FedRAMP) Moderate Baseline (https://www.fedramp.gov/documents/
).
The total estimated cost of compliance for small businesses is
$937,017,841 in the initial year of implementation and $564,187,237 in
each subsequent year. The cost per entity is dependent on whether the
small business is required to implement NIST SP 800-171 Revision 2 or
NIST SP 800-172 on their information systems. For more information on
the specific compliance requirements and the expected cost impact on
contractors, see section IV.C. of this preamble. A Regulatory Impact
Analysis that includes a detailed discussion and explanation about the
assumptions and methodology used to estimate the cost of this
regulatory action, including the specific impact and costs for small
businesses, is available at www.regulations.gov (search for ``FAR Case
2017-016'' click ``Open Docket,'' and view ``Supporting Documents'').
This proposed rule does not duplicate, overlap, or conflict with
any other Federal rules. This proposed rule implements the requirements
of 32 CFR part 2002 to ensure uniform implementation of Federal
contractor requirements for managing CUI.
While this rule is modeled after DFARS clause 252.204-7012, it does
not conflict with the existing clause. It is expected that the DFARS
clause will be amended in the future to address DoD-specific
requirements that may be in addition to the FAR clause.
DoD, GSA, and NASA were unable to identify any alternatives that
would reduce the burden on small entities and still meet the objectives
of 32 CFR part 2002. It is not possible to establish different
compliance standards that take into account the resources available to
small entities or exempt small entities from the rule, or any part
thereof, that does not increase the risk of CUI incidents. However, by
implementing a more standardized set of requirements for contractor
information systems and for CUI safeguarding across agencies, small
businesses that engage in contracts involving sensitive Government
information might find it easier and less costly to meet security
requirements for such information under this rule, because the
variation of system configurations and requirements will be
significantly reduced. This, in turn, may make such businesses more
competitive for future Government contracts.
The Regulatory Secretariat Division has submitted a copy of the
IRFA to the Chief Counsel for Advocacy of the Small Business
Administration. A copy of the IRFA may be obtained from the Regulatory
Secretariat Division. DoD, GSA, and NASA invite comments from small
business concerns and other interested parties on the expected impact
of this proposed rule on small entities.
DoD, GSA, and NASA will also consider comments from small entities
concerning the existing regulations in subparts affected by the rule in
accordance with 5 U.S.C. 610. Interested parties must submit such
comments separately and should cite 5 U.S.C. 610 (FAR Case 2017-016),
in correspondence.
VIII. Paperwork Reduction Act
The Paperwork Reduction Act (44 U.S.C. 3501-3521) applies because
the proposed rule contains information collection requirements.
Accordingly, the Regulatory Secretariat Division has submitted a
request for approval of a new information collection requirement
concerning controlled unclassified information to the Office of
Management and Budget.
A. Public Burden for This Collection of Information
1. System Security Plan. Public reporting burden for this
collection of information is estimated to average 0.50 hour per
response including the time to prepare and submit the plan.
The annual reporting burden is estimated as follows:
Respondents: 1,430.
Total annual responses: 1,430.
Total burden hours: 715.
This estimate is based on approximately one response per
respondent.
The annual recordkeeping burden is estimated as follows:
Recordkeepers: 10,242.
Total annual records: 10,242.
Total recordkeeping burden hours: 122,904.
This estimate is based on one recordkeeper who spends one hour per
month (or 12 hours per year) maintaining the system security plan.
2. Preserve, Protect, and Submit Media and Data. Public reporting
burden for this collection of information is estimated to average 2.5
hours per response including the time to prepare and complete the
submission.
The annual reporting burden is estimated as follows:
Respondents: 48.
Total annual responses: 48.
Total burden hours: 120.
This estimate is based on approximately one response per
respondent.
The annual recordkeeping burden is estimated as follows:
Recordkeepers: 580.
Total annual records: 580.
Total recordkeeping burden hours: 4,350.
This estimate is based on one recordkeeper who spends 7.5 hours per
year to preserve and protect images of all known affected information
systems and all relevant monitoring and packet capture data, assuming
0.5 hours to image, 2 hours to preserve monitoring and packet capture
data, and 5 hours to upload images and set up storage space.
3. CUI Incident Reporting. Public reporting burden for this
collection of information is estimated to average 5 hours per response
including the time to prepare and submit a CUI incident report.
The annual reporting burden is estimated as follows:
Respondents: 580.
Total annual responses: 580.
Total burden hours: 2,900.
This estimate is based on approximately one response per
respondent.
4. Training Records. Public reporting burden for this collection of
information is estimated to average 15 minutes (0.25 hour) per response
including the time to prepare and submit the evidence of training.
The annual reporting burden is estimated as follows:
Respondents: 1,430.
Total annual responses: 1,430.
Total burden hours: 357.5.
This estimate is based on approximately one response per
respondent.
The annual recordkeeping burden is estimated as follows:
Recordkeepers: 53,225.
Total annual records: 2,191,400.
Total recordkeeping burden hours: 181,886.
[[Page 4290]]
This estimate is based on one recordkeeper who spends 5 minutes
(0.083 hours) per record maintaining the employee training
certificates.
5. Prepare and Distribute the SF XXX. Public reporting burden for
this collection of information is estimated to average 2 hours per
response including the time to prepare and distribute the SF XXX.
The annual reporting burden is estimated as follows:
Respondents: 22,680.
Total annual responses: 517,392.
Total burden hours: 1,034,784.
B. Request for Comments Regarding Paperwork Burden
Submit comments on this collection of information no later than
March 17, 2025 through https://www.regulations.gov and follow the
instructions on the site. All items submitted must cite OMB Control No.
9000-XXXX, Controlled Unclassified Information. Comments submitted in
response to this rule will be made publicly available and are subject
to disclosure under the Freedom of Information Act. For this reason,
please do not include in your comments information of a confidential
nature, such as sensitive personal information or proprietary
information, or any information that you would not want publicly
disclosed unless you follow the instructions below for confidential
comments. Summary information of the public comments received,
including any specific comments, will be posted on https://www.regulations.gov.
All filers using the portal should use the name of the person or
entity submitting comments as the name of their files, in accordance
with the instructions below. Anyone submitting business confidential/
proprietary information should clearly identify any business
confidential/proprietary portion at the time of submission, file a
statement justifying nondisclosure and referencing the specific legal
authority claimed, and provide a non-confidential/non-proprietary
version of the submission. Any business confidential information should
be in an uploaded file that has a file name beginning with the
characters ``BC.'' Any page containing business confidential
information must be clearly marked ``BUSINESS CONFIDENTIAL/
PROPRIETARY'' on the top of that page.
The corresponding non-confidential/non-proprietary version of those
comments must be clearly marked ``PUBLIC.'' The file name of the non-
confidential version should begin with the character ``P.'' The ``BC''
and ``P'' should be followed by the name of the person or entity
submitting the comments or rebuttal comments. All filers should name
their files using the name of the person or entity submitting the
comments. Any submissions with file names that do not begin with a
``BC'' will be assumed to be public and will be made publicly available
through https://www.regulations.gov.
To confirm receipt of your comment(s), please check https://www.regulations.gov, approximately two-to-three days after submission
to verify posting. If there are difficulties submitting comments,
contact the GSA Regulatory Secretariat Division at 202-501-4755 or
[email protected].
Public comments are particularly invited on:
The necessity of this collection of information for the
proper performance of the functions of Federal Government acquisitions,
including whether the information will have practical utility;
The accuracy of the estimate of the burden of this
collection of information;
Ways to enhance the quality, utility, and clarity of the
information to be collected; and
Ways to minimize the burden of the collection of
information on respondents, including the use of automated collection
techniques or other forms of information technology.
Requesters may obtain a copy of the supporting statement from the
General Services Administration, Regulatory Secretariat Division by
calling 202-501-4755 or emailing [email protected]. Please cite OMB
Control Number 9000-XXXX, Controlled Unclassified Information, in all
correspondence.
List of Subjects in 48 CFR Parts 1, 2, 3, 4, 5, 7, 9, 11, 12, 15,
27, 33, 42, 52, and 53
Government procurement.
William F. Clark,
Director, Office of Government-wide Acquisition Policy, Office of
Acquisition Policy, Office of Government-wide Policy.
Therefore, DoD, GSA, and NASA propose amending 48 CFR parts 1, 2,
3, 4, 5, 7, 9, 11, 12, 15, 27, 33, 42, 52, and 53 as set forth below:
0
1. The authority citation for 48 CFR Parts 1, 2, 3, 4, 5, 7, 9, 11, 12,
15, 27, 33, 42, 52, and 53 continues to read as follows:
Authority: 40 U.S.C. 121(c); 10 U.S.C. chapter 4 and 10 U.S.C.
chapter 137 legacy provisions (see 10 U.S.C. 3016); and 51 U.S.C.
20113.
PART 1--FEDERAL ACQUISITION REGULATIONS SYSTEM
0
2. In section 1.106 amend in the table following the introductory text,
by adding in numerical order, entries for ``52.204-WW'' and ``52.204-
XX'' to read as follows:
1.106 OMB approval under the Paperwork Reduction Act.
* * * * *
------------------------------------------------------------------------
FAR segment OMB control No.
------------------------------------------------------------------------
* * * * *
52.204-WW............................................. 9000-XXXX
52.204-XX............................................. 9000-0182 and
9000-XXXX
* * * * *
------------------------------------------------------------------------
* * * * *
PART 2--DEFINITIONS OF WORDS AND TERMS
0
3. Amend section 2.101 by--
0
a. Adding in alphabetical order the definitions for ``Contractor-
attributional information'', ``Controlled unclassified information
(CUI)'', ``CUI incident'', ``CUI Registry'', ``Federal information
system'', and ``Information system''; and
0
b. Removing the definition for ``Federally controlled information
system''.
The additions read as follows:
2.101 Definitions.
* * * * *
Contractor-attributional information means information that
identifies the contractor or its employees directly or identifies them
indirectly by grouping information that can be traced back to the
contractor (e.g., program description or facility locations).
* * * * *
Controlled unclassified information (CUI) means information that
the Government creates or possesses, or that an entity creates or
possesses for or on behalf of the Government, that a law, regulation,
or Governmentwide policy requires or permits an agency to handle using
safeguarding or dissemination controls. CUI does not include--
(1) Classified information;
(2) Covered Federal information (see 4.404-1);
(3) Information a contractor possesses and maintains in its own
systems that did not come from, or was not created or possessed by or
for, an executive branch agency or an entity acting for an agency (see
32 CFR 2002.4); or
(4) Federally-funded basic and applied research in science,
technology, and engineering at colleges, universities, and laboratories
in accordance with National Security Decision Directive 189.
* * * * *
[[Page 4291]]
CUI incident means suspected or confirmed improper access, use,
disclosure, modification, or destruction of CUI, in any form or medium.
CUI Registry means the online repository for all information,
guidance, policy, and requirements on handling CUI. Among other
information, the CUI Registry identifies all approved CUI categories
and subcategories, provides general descriptions for each, identifies
the basis for controls, establishes markings, and includes guidance on
handling procedures (see https://www.archives.gov/cui).
* * * * *
Federal information system means an information system (44 U.S.C.
3502(8)) used or operated by an agency, by a contractor of an agency,
or by another organization on behalf of an agency.
* * * * *
Information system means a discrete set of information resources
organized for the collection, processing, maintenance, use, sharing,
dissemination, or disposition of information (44 U.S.C. 3502(8)).
* * * * *
PART 3--IMPROPER BUSINESS PRACTICES AND PERSONAL CONFLICTS OF
INTEREST
0
4. Amend section 3.104-4 by--
0
a. Revising the section heading;
0
b. Removing paragraph (c);
0
c. Redesignating paragraph (b) as paragraph (c);
0
d. Adding a new paragraph (b);
0
e. Revising the newly redesignated paragraph (c);
0
f. Revising paragraph (d); and
0
g. Removing from paragraph (e)(1) the words ``A contractor'' and adding
``An offeror or contractor'' in its place.
The revisions and additions read as follows:
3.104-4 Disclosure, protection, and marking of contractor information.
* * * * *
(b)(1) The clause at 52.204-XX, Controlled Unclassified
Information, directs offerors and contractors to indicate or otherwise
identify any contractor bid or proposal information, contractor-
attributional information, proprietary business information, and source
selection information submitted to the Government. The contracting
officer should consult with the contractor if the contracting officer
is unsure whether information provided by the contractor falls into one
of these categories.
(2) Individuals responsible for preparing material that may be
source selection information as described at paragraph (10) of the
``source selection information'' definition in 2.101 must mark the
cover page and each page that the individual believes contains source
selection information with the legend ``Source Selection Information-
See FAR 2.101 and 3.104.'' Although the information in paragraphs (1)
through (9) of the definition in 2.101 is considered to be source
selection information whether or not marked, all reasonable efforts
must be made to mark such material with the same legend.
(c) Contractor bid or proposal information, contractor-
attributional information, proprietary business information, and source
selection information must be marked and protected from unauthorized
disclosure in accordance with 4.403, 14.401, 15.207, applicable law,
and regulations, including 32 CFR part 2002. If the offeror or
contractor submits information that could be controlled unclassified
information (e.g., proprietary business information), the contracting
officer shall determine whether the information must be marked and
protected in accordance with applicable law, policy, guidance, and
agency procedures. Individuals who are unsure how to handle such
information should consult with agency officials as necessary.
(d) Except as provided in paragraph (d)(3) of this section, the
contracting officer must promptly notify the offeror or contractor in
writing if the contracting officer believes that contractor proprietary
business information, contractor-attributional information, contractor
bid or proposal information, or information marked in accordance with
52.215-1(e) has been inappropriately marked. Notification should occur
upon discovery and may be made prior to award. The offeror or
contractor that has affixed the marking must be given an opportunity to
justify the marking.
(1) If the offeror or contractor agrees that the marking is not
justified or does not respond within the time specified in the notice,
the contracting officer may remove the marking and release the
information.
(2) If, after reviewing the contractor's justification, the
contracting officer determines that the marking is not justified, the
contracting officer must notify the offeror or contractor in writing
before releasing the information.
(3) For technical data marked as proprietary by an offeror or
contractor, the contracting officer must follow the procedures in
27.404-5.
* * * * *
PART 4--ADMINISTRATIVE AND INFORMATION MATTERS
0
5. Revise the heading of subpart 4.4 to read as follows:
Subpart 4.4--Safeguarding Information and Information Systems
0
6. Add section 4.401 to read as follows:
4.401 Definition.
Information, as used in this subpart, means any communication or
representation of knowledge such as facts, data, or opinions in any
medium or form, including textual, numerical, graphic, cartographic,
narrative, electronic, or audiovisual forms (see Office of Management
and Budget (OMB) Circular A-130).
4.402 [Redesignated as 4.402-1]
0
7. Redesignate section 4.402 as section 4.402-1.
0
8. Add section 4.402 to read as follows:
4.402 Classified information.
4.403 [Redesignated as 4.402-2].
0
9. Redesignate section 4.403 as section 4.402-2.
0
10. Amend the newly redesignated section 4.402-2 by--
0
a. Revising paragraphs (b)(2)(i) and (ii); and
0
b. Removing from paragraph (c)(1) the reference ``4.402(d)(1)'' and
adding ``4.402-1(d)(1)'' in its place.
The revisions read as follows:
4.402-2 Responsibilities of contracting officers.
* * * * *
(b) * * *
(2) * * *
(i) An appropriate Security Requirements clause in the solicitation
(see 4.402-3(a)); and
(ii) As appropriate, in solicitations and contracts when the
contract may require access to classified information, a requirement
for security safeguards in addition to those provided in the clause
52.204-2, Security Requirements for Classified Information.
* * * * *
0
11. Add sections 4.402-3, and 4.403 through 4.403-7 to read as follows:
4.402-3 Contract clause.
(a) The contracting officer shall insert the clause at 52.204-2,
Security Requirements for Classified Information, in solicitations and
contracts when the contract may require access to classified
information, unless the conditions specified in paragraph (d) of this
section apply.
[[Page 4292]]
(b) If a cost contract (see 16.302) for research and development
with an educational institution is contemplated, the contracting
officer shall use the clause with its Alternate I.
(c) If a construction or architect-engineer contract under which
employee identification is required for security reasons is
contemplated, the contracting officer shall use the clause with its
Alternate II.
(d) If the contracting agency is not covered by the NISP and has
prescribed a clause and alternates that are substantially the same as
those at 52.204-2, the contracting officer shall use the agency-
prescribed clause as required by agency procedures.
4.403 Controlled unclassified information (CUI).
4.403-1 Definitions.
As used in section 4.403--
CUI Basic means the subset of CUI for which the authorizing law,
regulation, or Governmentwide policy does not set out specific handling
or dissemination controls. CUI Basic must be handled according to the
uniform set of controls set forth in 32 CFR part 2002 and the CUI
Registry.
CUI Categories means those types of information for which laws,
regulations, or Governmentwide policies require or permit agencies to
exercise safeguarding or dissemination controls, and which has been
listed in the CUI Registry.
CUI Specified means the subset of CUI for which the authorizing
law, regulation, or Governmentwide policy contains specific handling
controls that it requires or permits agencies to use and that differ
from those for CUI Basic. The CUI Registry indicates which laws,
regulations, and Governmentwide policies include such specific
requirements.
Handling means any use of CUI, including but not limited to
collecting, developing, receiving, transmitting, storing, marking,
safeguarding, transporting, disseminating, reusing, and disposing of
the information.
Lawful Government purpose means any activity, mission, function,
operation, or endeavor that the Government authorizes or recognizes as
within the scope of its legal authorities or the legal authorities of
non-executive branch entities such as State and local law enforcement.
Limited dissemination control means any control identified on the
CUI Registry that agencies may use to limit or specify CUI
dissemination.
On behalf of an agency means a contractor uses or operates an
information system or maintains or collects information for the purpose
of processing, storing, or transmitting Federal information, and those
activities are not incidental to providing a service or product to the
Government.
4.403-2 General.
(a) Executive Order 13556 of November 4, 2010, entitled
``Controlled Unclassified Information,'' establishes a program to
standardize executive branch management of information that requires
safeguarding or dissemination controls. The National Archives and
Records Administration's (NARA) Information Security Oversight Office
(ISOO) is the executive agent for the Controlled Unclassified
Information Program.
(b) This section implements 32 CFR part 2002, Controlled Classified
Information (CUI).
(c) Part 24, Protection of Privacy and Freedom of Information,
contains additional policy and procedures for safeguarding records that
are protected by the Privacy Act.
(d) Part 27, Patents, Data, and Copyrights, contains policy and
procedures for safeguarding information in patent applications and
patents.
4.403-3 Applicability.
(a) The requirements for safeguarding CUI in this section apply
when an offeror or contractor is expected to handle CUI, including
instances when CUI resides on or transits through contractor
information systems or within contractor facilities.
(b) The CUI requirements in the clause at 52.204-XX, Controlled
Unclassified Information, apply when CUI will be involved in the
contract. The CUI requirements in the clause at 52.204-YY, Identifying
and Reporting Information That Is Potentially Controlled Unclassified
Information, apply when no CUI will be involved in the contract.
4.403-4 Policy.
(a) The requiring activity will identify any CUI in the standard
form (SF) XXX, Controlled Unclassified Information (CUI) Requirements,
which must be incorporated in the contract. Contractors are required to
safeguard only the CUI that is identified in the SF XXX. However, see
52.204-XX(c)(2).
(b) Offerors and contractors are required to safeguard CUI pursuant
to section 4.403-2. For CUI identified on an SF XXX that is
incorporated into a contract, the contractor shall comply with the CUI
requirements in the clause at 52.204-XX and on the form itself.
(c) Unmarked or mismarked CUI is not considered a CUI incident
unless the mismarking or lack of marking has resulted in the
mishandling or improper dissemination of the information. Offerors are
requested, and contractors are required, to notify the Government
within 8 hours of discovery if they discover during the solicitation
phase or performance of a contract any information they suspect is CUI,
but is not listed on an SF XXX or is not marked or properly marked as
required by an SF XXX. Offerors and contractors are not responsible for
identifying or marking unmarked or mismarked CUI that is not identified
in the SF XXX.
(d) The Government shall protect against the improper use or
release of information that includes contractor proprietary business
information or contractor-attributional information to the extent
required by law.
(e) Applicable CUI requirements can be waived by the Government in
accordance with 32 CFR 2002.38.
4.403-5 Procedures.
(a) For each requirement, except those exclusively for the
acquisition of commercially available off-the-shelf items, the
contracting officer shall obtain from the requiring activity an SF XXX
that--
(1) Identifies what CUI is involved in the contract;
(2) Specifies if and how the contractor is to mark CUI involved in
the contract (e.g., when the contractor is generating or developing the
CUI, or when the purpose of the contract is to mark CUI); and
(3) Conforms to 11.002(i).
(b)(1) If the contracting officer has a reason to question the
information on the SF XXX, the contracting officer shall request that
the requiring activity verify that the SF XXX is accurate.
(2) If the requiring activity has marked the ``Yes'' box in Part A
of SF XXX, the contracting officer shall incorporate the SF in the
solicitation and contract and the clause at 52.204-XX, as prescribed at
4.403-7, to communicate requirements for safeguarding CUI during
contract performance.
(3) If the requiring activity has marked the ``No'' box in Part A
of SF XXX, the contracting officer shall include in the contract file a
copy of the SF XXX and include in the solicitation and contract the
clause at 52.204-YY, as prescribed at 4.403-7, to communicate
requirements related to CUI should the contractor encounter suspected
CUI during performance or the contract.
(c) If the requiring activity states that there should be
controlled access to the contents of the SF XXX or the SF XXX is marked
as CUI itself, contracting officers shall follow agency procedures
[[Page 4293]]
for safeguarding and disseminating the SF XXX.
(d) If the contracting officer is notified or otherwise discovers
that there is, or potentially could be CUI involved in the contract and
it was not properly identified on an SF XXX, the contracting officer
shall coordinate with the requiring activity to determine if the
information is CUI. If the agency determines that the information is
CUI, then the agency shall take the following steps:
(1) If the agency wants the contractor to handle this kind of CUI
during performance of the contract, the contracting officer shall--
(i) Coordinate with the requiring activity to have the SF XXX
updated;
(ii) Modify the contract to incorporate the new SF XXX and, if CUI
was not previously anticipated under the contract, to remove the clause
at 52.204-YY and incorporate the clause at 52.204-XX;
(iii) Consider any request for equitable adjustment submitted by
the contractor, as appropriate; and
(iv) Provide to the contractor marking instructions for the CUI.
(2) If the agency does not want the contractor to handle this kind
of CUI, the contracting officer shall coordinate with the requiring
activity to address the CUI (e.g., retrieve the CUI) and shall convey
such instructions to the contractor.
(e) Contracting officers shall also refer to 3.104-4 for procedures
related to the disclosure, protection, and marking of contractor
proprietary business information, contractor bid or proposal
information, and source selection information submitted to the
Government.
(f) The contracting officer shall follow agency procedures when
providing any CUI to an offeror to ensure offeror compliance with the
requirements in 32 CFR part 2002.
4.403-6 CUI incident reports.
(a) Agencies shall protect against the improper use or release of
information that includes contractor proprietary business information
or contractor-attributional information to the extent required by law.
See paragraph (g)(9) of 52.204-XX, Controlled Unclassified Information,
for details on how contracting officers may use or share this
information.
(b) For CUI in a non-Federally-controlled facility--
(1) Designate the agency point of contact to whom the contractor
reports a CUI incident in the SF XXX Part C, Section IV. When the SF
XXX is not used in a contract, the point of contact is the contracting
officer (see 52.204-YY(b)).
(2) The SF XXX will list any special incident reporting
requirements for CUI Specified.
(3) Upon notification of a CUI incident, the contracting officer
shall notify the requiring activity of the CUI incident as soon as
practicable and in accordance with agency procedures. If the CUI
incident occurs on an order against an indefinite delivery contract,
the ordering agency contracting officer shall make the contracting
officer for the indefinite delivery contract aware of the notification.
(c) When the contractor is required to provide information system
images preserved under the requirements of paragraph (g)(4) of the
clause at 52.204-XX or as directed by the contracting officer in
response to contractor notification under paragraph (b)(2) of the
clause at 52.204-YY, in accordance with agency procedures, the
contracting officer shall provide instructions to the contractor for
submitting the system images. The contractor is required to hold the
system images for 90 days unless the Government declines interest.
(d)(1) The contracting officer shall not interpret a contractor's
report of a CUI incident to mean that the contractor or a subcontractor
at any tier failed to provide adequate safeguards for CUI or otherwise
failed to meet the requirements of the clause at 52.204-XX, without
further analysis by the agency.
(2) When a CUI incident is reported, the contracting officer shall
consult with appropriate agency personnel (e.g., program office or
requiring activity) before taking any action under the contract related
to the CUI incident. When the contract includes the clause at 52.204-
XX, the contracting officer shall consider such CUI incidents in the
context of an overall assessment of the contractor's compliance with
the requirements of the clause at 52.204-XX.
(3) Unmarked or mismarked CUI is not considered a CUI incident
unless the mismarking or lack of marking has resulted in the
mishandling or improper dissemination of the information. The
contracting officer shall consult with the appropriate agency personnel
concerning any unmarked or mismarked CUI in accordance with agency
procedures.
4.403-7 Solicitation provision and contract clauses.
(a) Insert the provision at 52.204-WW, Notice of Controlled
Unclassified Information Requirements, in solicitations that contain
the clause at 52.204-XX or the clause at 52.204-YY.
(b) Except for solicitations and contracts solely for the
acquisition of COTS items, insert the clause at 52.204-XX, Controlled
Unclassified Information, and include an SF XXX Controlled Unclassified
Information (CUI) Requirements, in solicitations and contracts if the
requiring activity has marked the ``Yes'' box in Part A of the SF XXX.
(c) Insert the clause at 52.204-YY, Identifying and Reporting
Information That Is Potentially Controlled Unclassified Information, in
solicitations and contracts if the requiring activity has marked the
``No'' box in Part A of SF XXX, excluding solicitations and contracts
solely for the acquisition of COTS items.
0
12. Revise section 4.404 and add sections 4.404-1 through 4.404-3 to
read as follows:
4.404 Basic Safeguarding of Covered Contractor Information Systems.
4.404-1 Definitions.
As used in section 4.404--
Covered contractor information system means an information system
owned or operated by a contractor on which the contractor processes,
stores, or transmits covered Federal information.
Covered Federal information means information provided by or
created for the Government, when that information is other than--
(1) Simple transactional information (such as that necessary to
process payments);
(2) Information already publicly released (such as on public
websites), or marked for public release, by the Government;
(3) Federally-funded basic and applied research in science,
technology, and engineering at colleges, universities, and laboratories
in accordance with National Security Decision Directive 189;
(4) Controlled unclassified information (CUI); or
(5) Classified information.
4.404-2 Applicability.
(a) This section applies to all acquisitions, including
acquisitions of commercial services or commercial products other than
commercially available off-the-shelf (COTS) items, when a contractor's
information system may contain covered Federal information as part of
performance on the contract.
(b) While covered Federal information is not required to be marked
or identified by the Government, some
[[Page 4294]]
administrative markings (e.g., draft, deliberative process,
predecisional, not for public release) can indicate that the
information is covered Federal information.
4.404-3 Contract clause.
Insert the clause at 52.204-21, Basic Safeguarding of Covered
Contractor Information Systems, in solicitations and contracts
excluding solicitations and contracts solely for the acquisition of--
(a) COTS items; or
(b) Federally-funded basic and applied research in science,
technology, and engineering at colleges, universities, and laboratories
in accordance with National Security Decision Directive 189 when the
agency does not provide any covered Federal information to the
contractor.
4.1301 [Amended]
0
13. Amend section 4.1301 by--
0
a. Removing from paragraph (a) the phrases ``PUB Number 201'', and
``Federally-controlled information'' and adding the phrases ``201'' and
``Federal information'' in their places, respectively.
0
b. Removing from paragraph (b) the phrases ``PUB 201'', and
``Federally-controlled information'' and adding the phrases ``201'' and
``Federal information'' in their places, respectively.
4.1303 [Amended]
0
14. Amend section 4.1303 by removing the words ``Federally-controlled
information'' and adding ``Federal information'' in its place.
Subpart 4.19 [Removed and Reserved]
0
15. Remove and reserve subpart 4.19.
PART 5--PUBLICIZING CONTRACT ACTIONS
5.202 [Amended]
0
16. Amend section 5.202 in paragraph (a)(8) by removing the phrase
``proprietary information'' and adding ``controlled unclassified
information (e.g., general proprietary business information)'' in its
place.
5.301 [Amended]
0
17. Amend section 5.301 in paragraph (b)(1) by removing the phrase
``proprietary information'' and adding ``controlled unclassified
information (e.g., general proprietary business information)'' in its
place.
PART 7--ACQUISITION PLANNING
0
18. Amend section 7.103 by adding paragraph (z) to read as follows:
7.103 Agency-head responsibilities.
* * * * *
(z) Ensuring agency planners--(1) Comply with the requirements of
Executive Order 13556 of November 4, 2010, as implemented at 32 CFR
part 2002 and in agency procedures, for controlled unclassified
information (CUI). This does not apply to acquisitions for commercially
available off-the-shelf items or for Federally-funded basic and applied
research in science, technology, and engineering at colleges,
universities, and laboratories in accordance with National Security
Decision Directive 189 when the agency does not provide any CUI to the
contractor; and
(2) Identify all categories of CUI in proposed acquisitions and
incorporate them and accompanying CUI standards in requirements
planning and the SF XXX, Controlled Unclassified Information (CUI)
Requirements, as appropriate (see 4.403-4, 11.002(i), and 39.105).
* * * * *
0
19. Amend section 7.105 by--
0
a. Removing from paragraph (b)(18)(i) the phrase ``(see subpart 4.4)''
and adding ``(see 4.402)'' in its place;
0
b. Removing from paragraph (b)(18)(iii) the phrase ``Federally-
controlled information'' and adding ``Federal information'' in its
place;
0
c. Revising paragraph (b)(18)(iv); and
0
d. Adding paragraph (b)(18)(v).
The revision and addition read as follows:
7.105 Contents of written acquisition plans.
* * * * *
(b) * * *
(18) * * *
(iv) For acquisitions that may require covered Federal information
to reside in or transit through contractor information systems, discuss
compliance with 4.404.
(v) For acquisitions that may require a contractor to have access
to, create, collect, use, process, store, maintain, disseminate,
disclose, or dispose of CUI, discuss the security, marking, training,
incident reporting, and other requirements (e.g., destruction)
applicable to CUI (see 4.403-5 and 4.403-6).
* * * * *
0
20. Amend section 7.503 by revising paragraph (d)(11) to read as
follows:
7.503 Policy.
* * * * *
(d) * * *
(11) Contractors working in any situation that permits or might
permit them to gain access to controlled unclassified information
(CUI). See 4.403.
* * * * *
PART 9--CONTRACTOR QUALIFICATIONS
9.505 [Amended]
0
21. Amend section 9.505 by removing from paragraph (b)(1) the phrase
``Proprietary information'' and adding the phrase ``Contractor
proprietary business information'' in its place.
0
22. Amend section 9.505-4 by--
0
a. Removing from paragraph (a) introductory text the phrase
``proprietary information from others'' and adding ``another
contractor's proprietary business information'' in its place; and
0
b. Revising paragraph (b).
The revision reads as follows:
9.505-4 Obtaining access to proprietary information.
* * * * *
(b) A contractor that gains access to another contractor's
proprietary business information in performing advisory and assistance
services for the Government must agree with the other company to
protect its information from unauthorized use or disclosure for as long
as it remains proprietary and refrain from using the information for
any purpose other than that for which it was furnished. The contracting
officer shall obtain copies of these agreements and ensure that they
are properly executed.
* * * * *
9.508 [Amended]
0
23. Amend section 9.508 by removing from paragraph (h) introductory
text and paragraph (h)(1) the phrase ``proprietary information'' and
adding ``contractor proprietary business information'' in their places,
respectively.
* * * * *
PART 11--DESCRIBING AGENCY NEEDS
0
24. Amend section 11.002 by adding paragraph (i) to read as follows:
11.002 Policy.
* * * * *
(i) When agencies acquire products and services subject to 32 CFR
part 2002, Controlled Unclassified Information (CUI) (see 4.403), the
SF XXX, Controlled Unclassified Information (CUI) Requirements, must be
incorporated in the contract and must identify, at a minimum--
(1) The CUI the contractor will handle in performance of the
contract;
[[Page 4295]]
(2) Any CUI access and dissemination requirements placed on the
contractor during performance of the contract;
(3) Federal and non-Federal information systems the contractor will
use to handle CUI in the performance of the contract;
(4) System security and privacy requirements for each information
system, as appropriate, and any additional security and privacy
measures required by the agency;
(5) Any instructions for handling CUI during performance of the
contract;
(6) Any CUI training requirements the contractor must adhere to in
order to comply with 32 CFR 2002.30; and
(7) Any CUI incident reporting instructions required by the agency,
to include the agency website or single point of contact.
PART 12--ACQUISITION OF COMMERCIAL PRODUCTS AND COMMERCIAL SERVICES
0
25. Amend section 12.202 by adding paragraph (f) to read as follows:
12.202 Market research and description of agency need.
* * * * *
(f) Requirements documents for acquisitions involving controlled
unclassified information (CUI) shall--
(1) Comply with 32 CFR part 2002; and
(2) Incorporate all applicable handling and compliance instructions
included in the SF XXX, Controlled Unclassified Information (CUI)
Requirements (see 4.403 and 11.002(i)).
0
26. Amend section 12.301 by revising paragraph (d)(5) to read as
follows:
12.301 Solicitation provisions and contract clauses for the
acquisition of commercial products and commercial services.
* * * * *
(d) * * *
(5) Insert the clause at 52.204-21, Basic Safeguarding of Covered
Contractor Information Systems, in solicitations and contracts (except
solicitations and contracts solely for the acquisition of COTS items),
as prescribed in 4.404-3.
* * * * *
PART 15--CONTRACTING BY NEGOTIATION
15.407-1 [Amended]
0
27. Amend section 15.407-1 by removing from the introductory text of
paragraph (f) the phrase ``improper disclosure.'' and adding ``improper
disclosure such as requirements for controlled unclassified information
or classified information.'' in its place.
0
28. Amend section 15.604 by--
0
a. Removing from paragraph (a) introductory text the phrase
``proprietary information'' and adding ``contractor proprietary
business information'' in its place; and
0
b. Revising paragraph (a)(7).
The revision reads as follows:
15.604 Agency points of contact.
* * * * *
(a) * * *
(7) Instructions for identifying and marking contractor proprietary
business information so that it is protected and administrative
markings conform to 15.609.
* * * * *
15.606-2 [Amended]
0
29. Amend section 15.606-2 by removing from paragraph (a) introductory
text the phrase ``the legend'' and adding ``the administrative
marking'' in its place.
0
30. Amend section 15.609 by--
0
a. Removing from paragraphs (a) and (b) the phrase ``the following
legend'' and adding the phrase ``the following administrative marking''
in its place;
0
b. Revising paragraph (c);
0
c. Removing from paragraph (d) the phrase ``clearly mark'' and adding
the phrase ``clearly administratively mark'' in its place;
0
d. Removing from paragraph (e) the phrase ``and privileged or
confidential information to the Government'' and adding ``privileged or
confidential information, or other controlled unclassified
information'' in its place;
0
e. Revising paragraph (f); and
0
f. Removing from paragraphs (g), (h) introductory text and (h)(1) the
term ``legend'' and adding ``administrative marking'' in its place.
The revisions read as follows:
15.609 Limited use of data.
* * * * *
(c) The agency point of contact shall return to the offeror any
unsolicited proposal marked with an administrative marking different
from that provided in paragraph (a) of this section. The return letter
will state that the proposal cannot be considered because it is
impracticable for the Government to comply with the administrative
marking and that the agency will consider the proposal if it is
resubmitted with the proper administrative marking.
* * * * *
(f) When an agency receives an unsolicited proposal without any
restrictive administrative marking from an educational or nonprofit
organization or institution, and an evaluation outside the Government
is necessary, the agency point of contact shall--
(1) Attach a cover sheet clearly marked with the administrative
marking in paragraph (d) of this section;
(2) Change the beginning of this administrative marking by deleting
``All Government personnel'' and adding ``All Government and non-
Government personnel''; and
(3) Require any non-Government evaluator to agree in writing that
data in the proposal will not be disclosed to others outside the
Government.
* * * * *
PART 27--PATENTS, DATA AND COPYRIGHTS
0
31. Revise the heading of section 27.203 to read as follows:
27.203 Security requirements for patent applications and other patent
information.
* * * * *
0
32. Redesignate sections 27.203-1 and 27.203-2 as sections 27.203-2 and
27.203-3, and adding a new section 27.203-1 to read as follows:
27.203-1 Security requirements for controlled unclassified
information.
Contracts involving patent applications or other patent-related
controlled unclassified information require safeguarding or
dissemination controls that must be identified in the SF XXX,
Controlled Unclassified Information (CUI) Requirements. See 4.403.
0
33. Revise the heading of newly redesignated section 27.203-2 to read
as follows:
27.203-2 Security requirements for classified information.
* * * * *
PART 33--PROTESTS, DISPUTES, AND APPEALS
0
34. Amend section 33.104 by--
0
a. Revising paragraph (a)(2); and
0
b. Removing from paragraph (a)(5) introductory text the phrase
``development or commercial information'' and adding ``development,
commercial information, or other controlled unclassified information''
in its place.
The revision reads as follows:
33.104 Protests to GAO.
* * * * *
(a) * * *
(2) Immediately after receipt of the GAO's written notice that a
protest has been filed, the agency shall give notice of the protest to
the contractor if the award has been made, or, if no award has been
made, to all parties who appear to have a reasonable prospect of
receiving award if the protest is denied.
[[Page 4296]]
The agency shall furnish copies of the protest submissions to such
parties with instructions to--
(i) Communicate directly with the GAO; and
(ii) Provide copies of any such communication to the agency and to
other participating parties when they become known. However, if the
protester has identified controlled unclassified information and
requests a protective order, then the contracting officer shall obtain
a redacted version from the protester to furnish to other interested
parties, if one has not already been provided.
* * * * *
PART 42--CONTRACT ADMINISTRATION AND AUDIT SERVICES
42.302 [Amended]
0
35. Amend section 42.302 by removing from paragraph (a)(21) the phrase
``Subpart 4.4'' and adding ``4.402'' in its place.
PART 52--SOLICITATION PROVISIONS AND CONTRACT CLAUSES
0
36. Amend section 52.204-2 by revising the section heading, the
introductory text, the clause heading, and the date of the clause to
read as follows:
52.204-2 Security Requirements for Classified Information.
As prescribed in 4.402-3(a), insert the following clause:
Security Requirements for Classified Information (DATE)
* * * * *
0
37. Amend section 52.204-9 by--
0
a. Revising the date of the clause;
0
b. Removing from paragraph (a) the phrase ``(FIPS PUB) Number'' and
adding ``(FIPS)'' in its place; and
0
c. Removing from paragraph (d) the phrase ``Federally-controlled
information'' and adding ``Federal information'' in its place.
The revision reads as follows:
52.204-9 Personal Identity Verification of Contractor Personnel.
* * * * *
Personal Identity Verification of Contractor Personnel (DATE)
* * * * *
0
38. Amend section 52.204-16 by--
0
a. Revising the date of the clause; and
0
b. Removing from paragraph (g) the phrase ``Security Requirements'' and
adding ``Security Requirements for Classified Information'' in its
place.
The revision reads as follows:
52.204-16 Commercial and Government Entity Code Reporting.
* * * * *
Commercial and Government Entity Code Reporting (DATE)
* * * * *
0
39. Amend section 52.204-18 by--
0
a. Revising the date of the clause; and
0
b. Removing from paragraph (f) the phrase ``Security Requirements'' and
adding ``Security Requirements for Classified Information'' in its
place.
The revision reads as follows:
52.204-18 Commercial and Government Entity Code Maintenance.
* * * * *
Commercial and Government Entity Code Maintenance (DATE)
* * * * *
40. Amend section 52.204-21 by--
0
a. Revising the introductory text and date of the clause;
0
b. In paragraph (a):
0
i. Revising the definition of ``Covered contractor information
system'';
0
ii. Adding in alphabetical order the definition for ``Covered Federal
information'';
0
iii. Removing the definition for ``Federal contract information'';
0
iv. Revising the definition of ``Information'';
0
c. Removing from paragraph (b)(1)(vii) the phrase ``Federal Contract
Information'' and adding ``covered Federal information'' in its place.
0
d. Removing from paragraph (b)(2) the phrase ``controlled unclassified
information (CUI)'' and adding ``CUI'' in its place;
0
e. Adding paragraph (b)(3); and
0
f. Removing from paragraph (c) the phrase ``Federal contract
information'' and adding ``covered Federal information'' in its place.
The revisions and additions read as follows:
52.204-21 Basic Safeguarding of Covered Contractor Information
Systems.
As prescribed in 4.404-3, insert the following clause:
Basic Safeguarding of Covered Contractor Information Systems (DATE)
(a) * * *
Covered contractor information system means an information system
owned or operated by a contractor on which the contractor processes,
stores, or transmits covered Federal information.
Covered Federal information means information provided by or
created for the Government when that information is other than--
(1) Simple transactional information (such as that necessary to
process payments);
(2) Information already publicly released (such as on public
websites), or marked for public release, by the Government;
(3) Federally-funded basic and applied research in science,
technology, and engineering at colleges, universities, and laboratories
in accordance with National Security Decision Directive 189;
(4) Controlled unclassified information (CUI); or
(5) Classified information.
Information means any communication or representation of knowledge
such as facts, data, or opinions, in any medium or form, including
textual, numerical, graphic, cartographic, narrative, electronic, or
audiovisual forms (OMB Circular A-130, Managing Information as a
Strategic Resource).
* * * * *
(b) * * *
(3) Identification of covered Federal information. While covered
Federal information is not required to be marked or identified by the
Government, some administrative markings (e.g., draft, deliberative
process, predecisional, not for public release) can indicate that the
information is covered Federal information. If the Contractor is not
sure whether specific information is covered Federal information, the
Contractor can request clarification from the Contracting Officer.
* * * * *
0
41. Add sections 52.204-WW, 52.204-XX, and 52.204-YY to read as
follows:
52.204-WW Notice of Controlled Unclassified Information Requirements.
As prescribed in 4.403-7(a), insert the following provision:
Notice of Controlled Unclassified Information Requirements (DATE)
(a) Definitions. As used in this provision, contractor-
attributional information, contractor bid or proposal information,
controlled unclassified information (CUI), CUI incident, and handling
have the meaning provided in the clause 52.204-XX, Controlled
Unclassified Information.
(b) Government-provided information.
(1) The Offeror shall not use Government-provided information for
its own purposes, whether or not the information is marked as CUI,
unless the information is in the public domain, or unless the
information was lawfully made available to the Offeror by someone other
than the Government.
[[Page 4297]]
(2) If Offerors require access to CUI, the Government will provide
agency procedures on handling the CUI to ensure compliance with the
requirements in 32 CFR part 2002. Offerors shall comply with these
agency procedures when handling CUI.
(c) Offeror-provided information. The Offeror shall appropriately
identify information the Offeror owns and provides to the Government,
which is contractor bid or proposal information, contractor-
attributional information, or Offeror proprietary business information.
The Government will determine in accordance with agency procedures
whether the information provided by the Offeror is CUI or entitled to
other protections (e.g., contractor-attributional information
associated with a CUI incident).
(d) Unmarked CUI or mismarked CUI. The Offeror should notify the
Contracting Officer within 8 hours of discovery if the Offeror
discovers any CUI that is not marked, not properly marked, not
identified on the SF XXX, or is involved in a suspected or confirmed
CUI incident. The Offeror should take action to appropriately safeguard
any information the Offeror believes is CUI that is not identified in
the SF XXX or is not marked or properly marked as required in the SF
XXX until a Contracting Officer makes a determination.
(End of provision)
52.204-XX Controlled Unclassified Information.
As prescribed in 4.403-7(b), insert the following clause:
Controlled Unclassified Information (DATE)
(a) Identifying controlled unclassified information. The SF XXX,
Controlled Unclassified Information, that is incorporated into this
contract identifies what controlled unclassified information (CUI) is
involved in the contract. The Contractor is required to safeguard only
the CUI that is identified in the SF XXX. However, see paragraph (c)(2)
of this clause.
(b) Definitions. As used in this clause--
Adequate security means security protections commensurate with the
risk of harm resulting from unauthorized access, use, disclosure,
disruption, modification, or destruction of information.
Contractor-attributional information means information that
identifies the Contractor or its employees directly or identifies them
indirectly by grouping information that can be traced back to the
Contractor (e.g., program description or facility locations).
Contractor bid or proposal information means any of the following
information submitted to a Federal agency as part of or in connection
with a bid or proposal to enter into a Federal agency procurement
contract, if that information has not been previously made available to
the public or disclosed publicly:
(1) Cost or pricing data as defined by 10 U.S.C. 3701(1), with
respect to procurements subject to that section, and 41 U.S.C.
3501(a)(2), with respect to procurements subject to that section.
(2) Indirect costs and direct labor rates.
(3) Proprietary information about manufacturing processes,
operations, or techniques marked by the Contractor in accordance with
applicable law or regulation.
(4) Information marked by the Contractor as ``Contractor bid or
proposal information'' in accordance with applicable law or regulation.
(5) Information marked in accordance with 52.215-1(e).
Controlled unclassified information (CUI) means information that
the Government creates or possesses, or that an entity creates or
possesses for or on behalf of the Government, that a law, regulation,
or Governmentwide policy requires or permits an agency to handle using
safeguarding or dissemination controls. CUI does not include--
(1) Classified information;
(2) Covered Federal information;
(3) Information a Contractor possesses and maintains in its own
systems that did not come from, or was not created or possessed by or
for, an executive branch agency or an entity acting for an agency (see
32 CFR 2002.4); or
(4) Federally-funded basic and applied research in science,
technology, and engineering at colleges, universities, and laboratories
in accordance with National Security Decision Directive 189.
CUI Basic means the subset of CUI for which the authorizing law,
regulation, or Governmentwide policy does not set out specific handling
or dissemination controls. CUI Basic must be handled according to the
uniform set of controls set forth in 32 CFR part 2002 and the CUI
Registry.
CUI categories means those types of information for which laws,
regulations, or Governmentwide policies require or permit agencies to
exercise safeguarding or dissemination controls, and which has been
listed in the CUI Registry.
CUI incident means improper access, use, disclosure, modification,
or destruction of CUI, in any form or medium.
CUI Registry means the online repository for all information,
guidance, policy, and requirements on handling CUI. Among other
information, the CUI Registry identifies all approved CUI categories
and subcategories, provides general descriptions for each, identifies
the basis for controls, establishes markings, and includes guidance on
handling procedures (see https://archives.gov/cui).
CUI Specified means the subset of CUI for which the authorizing
law, regulation, or Governmentwide policy contains specific handling
controls that it requires or permits agencies to use and that differ
from those for CUI Basic. The CUI Registry indicates which laws,
regulations, and Governmentwide policies include such specific
requirements.
Federal information system means an information system (44 U.S.C.
3502(8)) used or operated by an agency, or by a contractor of an agency
or by another organization, on behalf of an agency.
Handling means any use of CUI, including but not limited to
collecting, developing, receiving, transmitting, storing, marking,
safeguarding, transporting, disseminating, re-using, and disposing of
the information.
Information means any communication or representation of knowledge
such as facts, data, or opinions in any medium or form, including
textual, numerical, graphic, cartographic, narrative, electronic, or
audiovisual forms (see Office of Management and Budget (OMB) Circular
No. A-130, Managing Information as a Strategic Resource).
Information system means a discrete set of information resources
organized for the collection, processing, maintenance, use, sharing,
dissemination, or disposition of information (44 U.S.C. 3502(8)).
Lawful Government purpose means any activity, mission, function,
operation, or endeavor that the Government authorizes or recognizes as
within the scope of its legal authorities or the legal authorities of
non-executive branch entities such as state and local law enforcement.
Limited dissemination control means any control identified on the
CUI Registry that agencies may use to limit or specify CUI
dissemination.
On behalf of an agency means a Contractor uses or operates an
information system or maintains or collects information for the purpose
of processing, storing, or transmitting Federal information, and those
activities
[[Page 4298]]
are not incidental to providing a service or product to the Government.
(c) Identifying and reporting information the Contractor believes
or has reason to know is potentially CUI.
(1) The Contractor shall notify the Contracting Officer within 8
hours of discovery if--
(i) The Contractor discovers any information that the Contractor
believes is CUI that is not identified in the SF XXX or is not marked
or properly marked as required in the SF XXX; or
(ii) There is any inconsistency between this clause and an SF XXX
incorporated into the contract.
(2) The Contractor shall take action to appropriately safeguard any
information the Contractor believes is CUI that is not identified in
the SF XXX or is not marked or properly marked as required in the SF
XXX until a Contracting Officer makes a determination.
(3) If the Contractor discovers any information that the contractor
believes is CUI that is not identified in the SF XXX that is involved
in a suspected or confirmed CUI incident, the Contractor shall notify
the Contracting Officer and comply with paragraph (g) of this clause.
(4) The Contractor is not entitled to use Government-provided
information for its own purposes, whether or not the information is
marked as CUI, unless the information is in the public domain, or
unless the information was lawfully made available to the Contractor by
someone other than the Government.
(5) The Contractor shall appropriately identify information the
Contractor owns and provides to the Government (e.g., contractor bid or
proposal information, contractor-attributional information, or
contractor proprietary business information). The Government will
determine in accordance with agency procedures whether the information
provided by the Contractor is CUI or entitled to other protections
(e.g., contractor-attributional information associated with a CUI
incident).
(d) Safeguarding CUI.
(1) The Contractor shall safeguard CUI that the Government
identifies in the SF XXX and ensure handling consistent with 32 CFR
2002.14.
(i) This includes CUI that the Government provides to the
Contractor or CUI that the Contractor collects, develops, receives,
transmits, uses, handles, or stores in performance of the contract.
(ii) For CUI located within a Federally-controlled facility, the
Contractor shall follow agency CUI policies and shall ensure that any
Contractor employees handling CUI within Federally-controlled
facilities meet the prerequisites identified within Part B on the SF
XXX for training and for access to CUI.
(iii) For CUI located within a non-Federally-controlled facility,
the Contractor shall follow CUI policies and shall ensure that any
Contractor employees handling CUI within the non-Federally-controlled
facility comply with the requirements identified in Part C of the SF
XXX.
(iv) Any applicable agency-specific policies for safeguarding or
handling CUI will be identified in the SF XXX.
(v) When information is not identified as CUI, it may be covered
Federal information requiring information system security controls in
accordance with Federal Acquisition Regulation clause 52.204-21, Basic
Safeguarding of Covered Contractor Information Systems.
(2) The Contractor shall permit access to CUI only as described in
the SF XXX.
(3) Except for its own information, the Contractor is not
responsible for identifying or marking unmarked or mismarked CUI unless
doing so is specifically included in the SF XXX, such as when the
Contractor generates or develops the CUI.
(4) No Contractor employee shall be permitted to have or retain
access to, create, collect, use, process, store, maintain, disseminate,
disclose, dispose of, or otherwise handle CUI unless the employee has
completed training on properly handling CUI that, at a minimum,
includes the elements required in the SF XXX.
(5) Contractors operating information systems that access, use,
process, store, maintain, or transmit CUI identified in the contract,
shall implement the following requirements:
(i) When the Contractor is operating an information system
identified in the SF XXX as a Federal information system--
(A) The Contractor shall comply with agency-identified security
requirements from the latest version of National Institute of Standards
and Technology (NIST) Special Publication (SP) 800-53 and any CUI
Specified requirements identified in the SF XXX; and
(B) If using cloud computing services, the Contractor shall comply
with agency-identified security requirements, but at no less than the
Federal Risk and Authorization Management Program (FedRAMP) Moderate
baseline (https://www.fedramp.gov/documents/).
(ii) When the Contractor is operating a non-Federal information
system, the Contractor shall--
(A) Comply with the security requirements of NIST SP 800-171
Revision 2, ``Protecting Controlled Unclassified Information in Non-
Federal Information Systems and Organizations'' (available via the
internet at https://dx.doi.org/10.6028/NIST.SP.800-171) or as
authorized by the Contracting Officer. Additional controls other than
NIST SP 800-171 Revision 2 may be specified in the contract's
requirements document, in accordance with 32 CFR 2002.14(h)(2), to
address unique requirements to protect CUI Basic at higher than the
moderate confidentiality level;
(B) Comply with all additional security requirements for CUI
Specified identified by the agency in the SF XXX;
(C) Implement additional information security requirements the
Contractor reasonably determines necessary to provide adequate security
in a dynamic environment;
(D) Comply with any requirements from NIST SP 800-172, Enhanced
Security Requirements for Protecting Controlled Unclassified
Information, identified by the agency. For any requirements in NIST SP
800-172 identified by the agency, the organizational defined parameters
(ODP) provided in Attachment 1 of SF XXX shall be applied for
applicable security requirements;
(E) Ensure that, if the Contractor uses a cloud service provider to
store, process, or transmit any CUI identified in SF XXX--
(1) The cloud service provider meets security requirements
established by the Government for the FedRAMP Moderate baseline
(https://www.fedramp.gov/documents/); and
(2) The additional requirements in paragraphs (d)(5)(ii)(B) and
(C), and (g) of this clause are met; and
(F) Submit the system security plan, and any associated plans of
action required by NIST SP 800-171, Revision 2, for any planned
implementations or mitigations to the Government upon request to
demonstrate the Contractor's implementation or planned implementation
of the security requirements.
(e) Compliance.
(1) The Contracting Officer may require the submission of
supporting documentation to verify compliance with the contract's
security requirements, or may require access to Contractor facilities
or systems, as listed in SF XXX.
(2) For applicable non-Federal information systems, the agency may
conduct validation actions in accordance with NIST SP 800-171A,
Assessing Security Requirements for Controlled Unclassified Information
and, if applicable, NIST SP 800-172A,
[[Page 4299]]
Assessing Enhanced Security Requirements for Controlled Unclassified
Information.
(f) Training.
(1) General CUI training. All Contractor employees who will handle
CUI shall complete general CUI training before doing so, and
periodically complete refresher training thereafter, as described in
the training sections at Section II of Part B and Section III of Part C
of the SF XXX. The Contractor shall maintain documentation of employee
training and shall provide it to the Contracting Officer upon request.
(2) Additional training.
Additional agency-specific training. Contractor employees shall
also take any additional training described in the SF XXX sections on
training. This additional training augments the general CUI training
and may include specialized training for a particular category of CUI
or for certain employees handling CUI in a specific situation, or other
similar circumstances.
(g) CUI incidents.
(1) For CUI in a Federally-controlled facility, the Contractor
shall report CUI incidents in accordance with agency policy.
(2) For CUI in a non-Federally-controlled facility, the Contractor
shall report--
(i) Any suspected or confirmed CUI incident to the agency website
or single point of contact identified in Part C, Section IV of the SF
XXX; if there is no point of contact identified there the Contractor
should contact the Contracting Officer for instructions;
(ii) Within 8 hours of discovery; and
(iii) As many of the applicable data elements located at https://dibnet.dod.mil/portal/intranet/ as are available in the initial report
and provide any remaining applicable data elements as soon as they
become available.
(3) When the Contractor discovers a suspected or confirmed CUI
incident, the Contractor shall--
(i) Determine and inventory what CUI was or could have been
improperly accessed, created, collected, used, processed, stored,
maintained, disseminated, disclosed, or disposed of;
(ii) Construct a timeline of user activity;
(iii) Determine methods and techniques used to access CUI; and
(iv) Cooperate and exchange information with agency officials, as
determined necessary by the agency, in order to effectively report and
manage a suspected or confirmed CUI incident.
(4) If the suspected or confirmed CUI incident has occurred on an
information system, preserve and protect images of all known affected
information systems and all relevant monitoring and packet capture data
until the Government declines interest or 90 days from the date of the
submission of the report passes without the Government requesting the
media and data, whichever is sooner.
(5) Unmarked or mismarked CUI is not considered a CUI incident
unless the mismarking or lack of marking has resulted in the
mishandling or improper dissemination of the information.
(6) If the Contractor is a FedRAMP authorized (Joint Authorization
Board or Agency) cloud service provider, the Contractor shall also
report to the point(s) of contact specified in the FedRAMP incident
reporting guidelines as documented in the Cloud Service Provider
Incident Response Plan.
(7) The reporting requirements of this clause do not relieve the
Contractor from the requirement to follow any applicable laws,
regulations, or policies outside of this clause.
(8) If the Contractor is determined to be at fault for a CUI
incident (e.g., not safeguarding CUI in accordance with contract
requirements), the Contractor may be financially liable for Government
costs incurred in the course of the response and mitigation efforts in
addition to any other damages at law or remedies available to the
Government for noncompliance.
(9)(i) The Government will protect contractor bid or proposal
information, contractor proprietary business information, and
contractor-attributional information related to a CUI incident, against
unauthorized use or release to the extent required by law.
(ii) The agency may release outside the Government contractor bid
or proposal information, contractor proprietary business information,
and contractor-attributional information that is not created by or for
the Government, but that is related to a CUI incident--
(A) To entities with missions that may be affected by such
information;
(B) To entities that may be called upon to assist in the diagnosis,
detection, or mitigation of CUI incidents; or
(C) For national security purposes, including cyber situational
awareness.
(iii) The Government may use and release contractor bid or proposal
information, contractor proprietary business information, and
contractor-attributional information, created by or for the Government
and related to a CUI incident, outside of the Government for purposes
and activities associated with responding to a CUI incident and for any
other lawful Government purpose or activity.
(iv) In any authorized release, the Government will minimize the
contractor proprietary business information and contractor-
attributional information that it includes.
(10) An agency, at its sole discretion, may obtain assistance from
Federal agencies or entities outside the Government, such as third-
party firms to aid incident response activities.
(11) The SF XXX will list in Part C, Section IV incident reporting
requirements that differ from or are in addition to those in this
clause, such as requirements for CUI in a CUI Specified category.
(h) Subcontracts.
(1) Except for the acquisitions in paragraph (h)(2), in
subcontracts at any tier, or other contractual instruments, for which
performance involves CUI identified in the SF XXX, Controlled
Unclassified Information (CUI) Requirements, the Contractor shall--
(i) Include this clause, including this paragraph (h), without
alteration except to identify the parties;
(ii) Include the information in the SF XXX, Controlled Unclassified
Information (CUI) Requirements, modified as required to address the CUI
that applies to the subcontract; and
(iii) Require subcontractors to notify the prime Contractor or next
higher tier subcontractor within 8 hours of discovery of a suspected or
confirmed CUI incident.
(2) Paragraph (h)(1) of this clause does not apply to acquisitions
exclusively for commercially available off-the-shelf items or
Federally-funded basic and applied research in science, technology, and
engineering at colleges, universities, and laboratories in accordance
with National Security Decision Directive 189 when the Contractor does
not provide any CUI to the subcontractor.
(End of clause)
52.204-YY Identifying and Reporting Information That Is Potentially
Controlled Unclassified Information.
As prescribed in 4.403-7(c), insert the following clause:
Identifying and Reporting Information That is Potentially Controlled
Unclassified Information (DATE)
(a) Definitions. As used in this clause--
Contractor-attributional information means information that
identifies the Contractor or its employees directly or identifies them
indirectly by grouping information that can be traced back to the
Contractor (e.g., program description or facility locations).
Contractor bid or proposal information means any of the following
[[Page 4300]]
information submitted to a Federal agency as part of or in connection
with a bid or proposal to enter into a Federal agency procurement
contract, if that information has not been previously made available to
the public or disclosed publicly:
(1) Cost or pricing data as defined by 10 U.S.C. 3701(1), with
respect to procurements subject to that section, and 41 U.S.C.
3501(a)(2), with respect to procurements subject to that section.
(2) Indirect costs and direct labor rates.
(3) Proprietary information about manufacturing processes,
operations, or techniques marked by the Contractor in accordance with
applicable law or regulation.
(4) Information marked by the Contractor as ``Contractor bid or
proposal information'' in accordance with applicable law or regulation.
(5) Information marked in accordance with 52.215-1(e).
Controlled unclassified information (CUI) means information that
the Government creates or possesses, or that an entity creates or
possesses for or on behalf of the Government, that a law, regulation,
or Governmentwide policy requires or permits an agency to handle using
safeguarding or dissemination controls. CUI does not include--
(1) Classified information;
(2) Covered Federal information;
(3) Information a Contractor possesses and maintains in its own
systems that did not come from, or was not created or possessed by or
for, an executive branch agency or an entity acting for an agency (see
32 CFR 2002.4); or
(4) Federally-funded basic and applied research in science,
technology, and engineering at colleges, universities, and laboratories
in accordance with National Security Decision Directive 189.
CUI incident means improper access, use, disclosure, modification,
or destruction of CUI, in any form or medium.
Information means any communication or representation of knowledge
such as facts, data, or opinions in any medium or form, including
textual, numerical, graphic, cartographic, narrative, electronic, or
audiovisual forms (see Office of Management and Budget (OMB) Circular
No. A-130, Managing Information as a Strategic Resource).
Lawful Government purpose means any activity, mission, function,
operation, or endeavor that the Government authorizes or recognizes as
within the scope of its legal authorities or the legal authorities of
non-executive branch entities such as state and local law enforcement.
(b) Identifying and reporting information the contractor believes
or has reason to know is potentially CUI. This contract does not
identify CUI as being involved in the contract; nonetheless:
(1) The Contractor shall notify the Contracting Officer within 8
hours of discovery if the Contractor discovers any information that the
contractor believes, or has reason to know, is CUI. The potential
unidentified CUI may be marked, unmarked, or improperly marked. The
Contractor shall take action to appropriately safeguard any information
the Contractor believes is CUI, until a Contracting Officer makes a
determination.
(2) If the Contractor discovers any information that the Contractor
believes is CUI and it is involved in a suspected or confirmed CUI
incident, the Contractor shall notify the Contracting Officer as
outlined in paragraph (b)(1), determine and inventory what CUI was or
could have been improperly accessed, created, collected, used,
processed, stored, maintained, disseminated, disclosed, or disposed of
as part of the incident, and follow any additional incident response
requirements the Contracting Officer provides if the Government
determines the information is CUI.
(3) The reporting requirements of this clause do not relieve the
Contractor from the requirement to follow any applicable laws,
regulations, or policies outside of this clause.
(c) Government-provided information. The Contractor is not entitled
to use Government-provided information for its own purposes, whether or
not the information is marked as CUI, unless the information is in the
public domain, or unless the information was lawfully made available to
the Contractor by someone other than the Government.
(d) Contractor information. The Contractor shall appropriately
identify information the Contractor owns and provides to the Government
(i.e., contractor bid or proposal information, contractor-attributional
information, or contractor proprietary business information). The
Government will determine in accordance with agency procedures whether
the information provided by the Contractor is CUI or entitled to other
protections (e.g., contractor-attributional information associated with
a CUI incident).
(1) If it is CUI or entitled to other protections, the Government
will protect against the improper use or release of the information to
the extent required by law.
(2) The agency may release outside the Government Contractor bid or
proposal information, Contractor proprietary business information, and
contractor-attributional information that is not created by or for the
Government, but that is related to a CUI incident--
(i) To entities with missions that may be affected by such
information;
(ii) To entities that may be called upon to assist in the
diagnosis, detection, or mitigation of CUI incidents; or
(iii) For national security purposes, including cyber situational
awareness.
(3) The Government may use and release Contractor bid or proposal
information, Contractor proprietary business information, and
contractor-attributional information, created by or for the Government
and related to a CUI incident, outside of the Government for purposes
and activities associated with responding to a CUI incident and for any
other lawful Government purpose or activity.
(4) In any authorized release, the Government will include the
Contractor proprietary business information or contractor-attributional
information only to the extent necessary, as determined by the
Government, to advance a lawful Government purpose or activity.
(e) Subcontracts. The Contractor shall include this clause,
including this paragraph (e) and without alteration except to identify
the parties, in all subcontracts and other contractual instruments. The
Contractor shall require subcontractors to notify the prime Contractor
or next higher tier subcontractor within 8 hours of discovery of a
suspected or confirmed CUI incident.
(End of clause)
0
42. Amend section 52.212-5 by--
0
a. Revising the date of the clause;
0
b. Redesignating paragraphs (b)(12) through (65) as paragraphs (b)(14)
through (67) and adding new paragraphs (b)(12) and (13);
0
c. Redesignating paragraphs (e)(1)(viii) through (xxvii) as paragraphs
(e)(1)(x) through (xxix) and adding new paragraphs (e)(1)(viii) and
(ix);
0
d. In Alternate II:
0
i. Revising the date of the alternate; and
0
ii. Redesignating paragraphs (e)(1)(ii)(H) through (Z) as paragraphs
(e)(1)(ii)(J) through (BB); and
0
iii. Adding new paragraphs (H) and (I).
The revisions read as follows:
[[Page 4301]]
52.212-5 Contract Terms and Conditions Required To Implement Statutes
or Executive Orders--Commercial Products and Commercial Services.
* * * * *
Contract Terms and Conditions Required To Implement Statutes or
Executive Orders--Commercial Products and Commercial Services (DATE)
* * * * *
(b) * * *
(12) 52.204-XX, Controlled Unclassified Information (DATE) (E.O.
13556).
(13) 52.204-YY, Identifying and Reporting Information That Is
Potentially Controlled Unclassified Information (DATE).
* * * * *
(e)(1) * * *
(viii) 52.204-XX, Controlled Unclassified Information (DATE) (E.O.
13556).
(ix) 52.204-YY, Identifying and Reporting Information That Is
Potentially Controlled Unclassified Information (DATE).
* * * * *
Alternate II (DATE) * * *
(e)(1) * * *
(ii) * * *
(H) 52.204-XX, Controlled Unclassified Information (DATE) (E.O.
13556).
(I) 52.204-YY, Identifying and Reporting Information That Is
Potentially Controlled Unclassified Information (DATE).
0
43. Amend section 52.213-4 by--
0
a. Revising the date of the clause;
0
b. Removing from paragraph (a)(2)(vii) ``NOV 2024'' and adding
``(DATE)'' in its place; and
0
c. Revising paragraph (b)(2)(i);
0
d. Redesignating paragraphs (b)(2)(ii) through (v) as paragraphs
(b)(2)(iv) through (vii); and
e. Adding new paragraphs (b)(2)(ii) and (b)(2)(iii).
The revisions and addition read as follows:
52.213-4 Terms and Conditions--Simplified Acquisitions (Other Than
Commercial Products and Commercial Services).
* * * * *
Terms and Conditions--Simplified Acquisitions (Other Than Commercial
Products and Commercial Services) (DATE)
(b) * * *
(2) * * *
(i) 52.204-21, Basic Safeguarding of Covered Contractor Information
Systems (DATE) (Applies to solicitations and contracts, except
acquisitions solely for commercially available off-the-shelf items or
Federally-funded basic and applied research in science, technology, and
engineering at colleges, universities, and laboratories in accordance
with National Security Decision Directive 189 when the agency does not
provide any covered Federal information to the Contractor.)
(ii) 52.204-XX, Controlled Unclassified Information (DATE) (Applies
to solicitations and contracts, except acquisitions solely for
commercially available off-the-shelf items).
(iii) 52.204-YY, Identifying and Reporting Information That Is
Potentially Controlled Unclassified Information (DATE).
* * * * *
52.227-10 [Amended]
0
44. Amend section 52.227-10 by removing from the introductory text the
phrase ``27.203-2'' and adding ``27.203-3'' in its place.
0
45. Amend section 52.244-6 by--
0
a. Revising the date of the clause;
0
b. Removing from paragraph (c)(1)(v) ``NOV 2021'' and ``FAR clause
52.204-21'' and adding ``DATE'' and ``clause 52.204-21'' in their
places, respectively; and
0
c. Redesignating paragraphs (c)(1)(x) through (xxiv) as paragraphs
(c)(1)(xii) through (xxvi) and adding new paragraphs (c)(1)(x) through
(xi).
The revision and additions reads as follows:
52.244-6 Subcontracts for Commercial Products and Commercial Services.
* * * * *
Subcontracts for Commercial Products and Commercial Services (DATE)
* * * * *
(c)(1) * * *
(x) 52.204-XX, Controlled Unclassified Information (DATE), if flow
down is required in accordance with paragraph (e) of clause 52.204-XX.
(xi) 52.204-YY, Identifying and Reporting Information That Is
Potentially Controlled Unclassified Information (DATE), if flow down is
required in accordance with paragraph (e) of clause 52.204-YY.
* * * * *
PART 53--FORMS
0
46. Revise the heading of section 53.204 to read as follows:
53.204 Administrative and information matters.
* * * * *
0
47. Amend section 53.204-1 by--
0
a. Revising the section heading;
0
b. Removing from the introductory text the phrase ``subpart 4.4'' and
adding ``4.402'' in its place;
0
c. Removing from paragraph (a) the phrase ``See 4.403 (c)(1).)'' and
adding ``See 4.402-2 (c)(1).)'' in its place.
The revision reads as follows:
53.204-1 Safeguarding information and information systems (DD Form
254, DD Form 441).
* * * * *
0
48. Add section 53.204-2 to read as follows:
53.204-2 Controlled unclassified information (CUI) Requirements (SF
XXX)
SF XXX (DATE) Controlled Unclassified Information (CUI)
Requirements. SF XXX is described in 4.403 and 11.002(i). Except for
solicitations and contracts solely for the acquisition of COTS items,
the contracting officer shall insert the clause at 52.204-XX,
Controlled Unclassified Information, and include an SF XXX Controlled
Unclassified Information (CUI) Requirements, in solicitations and
contracts if the requiring activity has marked the ``Yes'' box in Part
A of the SF XXX.
0
49. Amend section 53.300 in the table following paragraph (a) by adding
at the beginning of the table, the entry for ``SF XXX Controlled
Unclassified Information (CUI) Requirements'' to read as follows:
53.300 Listing of Standard, Optional, and Agency forms.
* * * * *
(a) * * *
Table 53-1--Forms in the GSA Forms Library
------------------------------------------------------------------------
Form No. Form title
------------------------------------------------------------------------
SF XXX.................................... Controlled Unclassified
Information (CUI)
Requirements.
* * * * *
------------------------------------------------------------------------
* * * * *
Note: The following form, Controlled Unclassified Information
(CUI) Requirements, will not be published in the CFR.
BILLING CODE 6820-EP-P
[[Page 4302]]
[GRAPHIC] [TIFF OMITTED] TP15JA25.033
[[Page 4303]]
[GRAPHIC] [TIFF OMITTED] TP15JA25.034
[[Page 4304]]
[GRAPHIC] [TIFF OMITTED] TP15JA25.035
[[Page 4305]]
[GRAPHIC] [TIFF OMITTED] TP15JA25.036
[[Page 4306]]
[GRAPHIC] [TIFF OMITTED] TP15JA25.037
[[Page 4307]]
[GRAPHIC] [TIFF OMITTED] TP15JA25.038
[[Page 4308]]
[GRAPHIC] [TIFF OMITTED] TP15JA25.039
[[Page 4309]]
[GRAPHIC] [TIFF OMITTED] TP15JA25.040
[[Page 4310]]
[GRAPHIC] [TIFF OMITTED] TP15JA25.041
[[Page 4311]]
[GRAPHIC] [TIFF OMITTED] TP15JA25.042
[[Page 4312]]
[GRAPHIC] [TIFF OMITTED] TP15JA25.043
[[Page 4313]]
[GRAPHIC] [TIFF OMITTED] TP15JA25.044
[[Page 4314]]
[GRAPHIC] [TIFF OMITTED] TP15JA25.045
[[Page 4315]]
[GRAPHIC] [TIFF OMITTED] TP15JA25.046
[[Page 4316]]
[GRAPHIC] [TIFF OMITTED] TP15JA25.047
[[Page 4317]]
[GRAPHIC] [TIFF OMITTED] TP15JA25.048
[FR Doc. 2024-30437 Filed 1-14-25; 8:45 am]
BILLING CODE 6820-EP-C