<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE dita
  PUBLIC "-//OASIS//DTD DITA Composite//EN" "ditabase.dtd">
<dita xmlns:ditaarch="http://dita.oasis-open.org/architecture/2005/"
      ditaarch:DITAArchVersion="1.2"
      domains="(topic task)                            (topic concept)                            (topic concept glossentry)                            (topic concept glossgroup)                            (topic reference)                            (topic troubleshooting++task) (topic task)                            (topic abbrev-d)                            a(props deliveryTarget)                            (topic equation-d)                            (topic hazard-d)                            (topic hi-d)                            (topic indexing-d)                            (topic markup-d)                            (topic mathml-d)                            (topic pr-d)                            (topic relmgmt-d)                            (topic sw-d)                            (topic svg-d)                            (topic ui-d)                            (topic ut-d)                            (topic markup-d xml-d)                            (topic task strictTaskbody-c)   ">
   <concept id="DFARS_239.7602-1"
            ditaarch:DITAArchVersion="1.2"
            class="- topic/topic concept/concept ">
      <title class="- topic/title ">
         <ph props="autonumber" class="- topic/ph ">239.7602-1</ph> General.</title>
      <conbody class="- topic/body  concept/conbody ">
         <p class="- topic/p ">(a) Generally, DoD shall acquire cloud computing services
using commercial terms and conditions that are consistent with Federal
law, and an agency’s needs, including those requirements specified
in this subpart. Some examples of commercial terms and conditions
are license agreements, End User License Agreements (EULAs), Terms
of Service (TOS), or other similar legal instruments or agreements.
Contracting officers shall incorporate any applicable service provider
terms and conditions into the contract by attachment or other appropriate
mechanism. Contracting officers shall carefully review commercial
terms and conditions and consult counsel to ensure these are consistent
with Federal law, regulation, and the agency’s needs.</p>
         <p class="- topic/p ">(b)(1) Except as provided in paragraph (b)(2) of this section,
the contracting officer shall only award a contract to acquire cloud
computing services from a cloud service provider (e.g., contractor
or subcontractor, regardless of tier) that has been granted provisional
authorization by Defense Information Systems Agency, at the level
appropriate to the requirement, to provide the relevant cloud computing
services in accordance with the Cloud Computing Security Requirements
Guide (SRG) (version in effect at the time the solicitation is issued
or as authorized by the contracting officer) found at 
               <i class="+ topic/ph hi-d/i ">
               <xref href="https://public.cyber.mil/dccs/"
                     format="html"
                     scope="external"
                     class="- topic/xref ">https://public.cyber.mil/dccs/</xref>
            </i>
            .</p>
         <p outputclass="List2" class="- topic/p ">(2) The contracting officer may award a
contract to acquire cloud computing services from a cloud service
provider that has not been granted provisional authorization when—</p>
         <p outputclass="List3" class="- topic/p ">(i) The requirement for a provisional authorization
is waived by the DoD Chief Information Officer; or</p>
         <p outputclass="List3" class="- topic/p ">(ii) The cloud computing service requirement
is for a private, on-premises version that will be provided from
U.S. Government facilities. Under this circumstance, the cloud service
provider must obtain a provisional authorization prior to operational
use.</p>
         <p class="- topic/p ">(c) When contracting for cloud computing services, the contracting
officer shall ensure the following information is provided by the
requiring activity:</p>
         <p outputclass="List2" class="- topic/p ">(1) Government data and Government-related
data descriptions.</p>
         <p class="- topic/p ">(2) Data ownership, licensing, delivery and disposition instructions
specific to the relevant types of Government data and Government-related
data (e.g., DD Form 1423, Contract Data Requirements List; work
statement task; line item). Disposition instructions shall provide
for the transition of data in commercially available, or open and
non-proprietary format (and for permanent records, in accordance
with disposition guidance issued by National Archives and Record
Administration).</p>
         <p class="- topic/p ">(3) Appropriate requirements to support applicable inspection,
audit, investigation, or other similar authorized activities specific
to the relevant types of Government data and Government-related
data, or specific to the type of cloud computing services being
acquired.</p>
         <p outputclass="List2" class="- topic/p ">(4) Appropriate requirements to support
and cooperate with applicable system-wide search and access capabilities
for inspections, audits, investigations.</p>
      </conbody>
   </concept>
</dita>
