<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE dita
  PUBLIC "-//OASIS//DTD DITA Composite//EN" "ditabase.dtd">
<dita xmlns:ditaarch="http://dita.oasis-open.org/architecture/2005/"
      ditaarch:DITAArchVersion="1.2"
      domains="(topic task)                            (topic concept)                            (topic concept glossentry)                            (topic concept glossgroup)                            (topic reference)                            (topic troubleshooting++task) (topic task)                            (topic abbrev-d)                            a(props deliveryTarget)                            (topic equation-d)                            (topic hazard-d)                            (topic hi-d)                            (topic indexing-d)                            (topic markup-d)                            (topic mathml-d)                            (topic pr-d)                            (topic relmgmt-d)                            (topic sw-d)                            (topic svg-d)                            (topic ui-d)                            (topic ut-d)                            (topic markup-d xml-d)                            (topic task strictTaskbody-c)   ">
   <concept id="DFARS_204.7302"
            ditaarch:DITAArchVersion="1.2"
            class="- topic/topic concept/concept ">
      <title class="- topic/title ">
         <ph props="autonumber" class="- topic/ph ">204.7302</ph> Policy.</title>
      <conbody class="- topic/body  concept/conbody ">
         <p outputclass="List1" class="- topic/p ">(a)(1) Contractors and subcontractors
are required to provide adequate security on all covered contractor
information systems.</p>
         <p outputclass="List2" class="- topic/p ">(2) <?FM MARKER [Cross-Ref] _Hlk37870006?>Contractors required to implement NIST
SP 800-171, in accordance with the clause at 252.204-7012, Safeguarding Covered
Defense Information and Cyber incident Reporting, are required at
time of award to have at least a Basic NIST SP 800-171 DoD Assessment
that is current (i.e., not more than 3 years old unless a lesser
time is specified in the solicitation) (see 252.204-7019).</p>
         <p outputclass="List2" class="- topic/p ">(3) The NIST SP 800-171 DoD Assessment
Methodology is located at
               <xref href="https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171"
                  format="html"
                  scope="external"
                  class="- topic/xref "> https://www.acq.osd.mil/asda/dpc/cp/cyber/safeguarding.html#nistSP800171</xref>
            .</p>
         <p outputclass="List2" class="- topic/p ">(4) High NIST SP 800-171 DoD Assessments
will be conducted by Government personnel using NIST SP 800-171A, “Assessing
Security Requirements for Controlled Unclassified Information.”</p>
         <p outputclass="List2" class="- topic/p ">(5) The NIST SP 800-171 DoD Assessment
will not duplicate efforts from any other DoD assessment or the
Cybersecurity Maturity Model Certification (CMMC) (see subpart 204.75),
except for rare circumstances when a re-assessment may be necessary,
such as, but not limited to, when cybersecurity risks, threats,
or awareness have changed, requiring a re-assessment to ensure current
compliance.</p>
         <p outputclass="List1" class="- topic/p ">(b) Contractors and subcontractors are
required to rapidly report cyber incidents directly to DoD at http://dibnet.dod.mil.
Subcontractors provide the incident report number automatically
assigned by DoD to the prime contractor. Lower-tier subcontractors
likewise report the incident report number automatically assigned
by DoD to their higher-tier subcontractor, until the prime contractor
is reached.</p>
         <p outputclass="List2" class="- topic/p ">(1) If a cyber incident occurs, contractors
and subcontractors submit to DoD—</p>
         <p outputclass="List3" class="- topic/p ">(i) A cyber incident report;</p>
         <p outputclass="List3" class="- topic/p ">(ii) Malicious software, if detected and
isolated; and</p>
         <p outputclass="List3" class="- topic/p ">(iii) Media (or access to covered contractor
information systems and equipment) upon request.</p>
         <p outputclass="List2" class="- topic/p ">(2) Contracting officers shall refer to
PGI <xref href="PGI_204.7303-4.dita#DFARS_PGI_PGI_204.7303-4"
                  base="DFARS-PGI_PGI_204.7303-4"
                  outputclass="fm:ParaNumOnly"
                  xtrc="204.7303-4"
                  class="- topic/xref ">204.7303-4</xref> (c) for instructions on
contractor submissions of media and malicious software.</p>
         <p outputclass="List1" class="- topic/p ">(c) Information shared by the contractor
may include contractor attributional/ proprietary information that
is not customarily shared outside of the company, and that the unauthorized
use or disclosure of such information could cause substantial competitive
harm to the contractor that reported the information. The Government
shall protect against the unauthorized use or release of information
that includes contractor attributional/proprietary information.</p>
         <p outputclass="List1" class="- topic/p ">(d) A cyber incident that is reported by
a contractor or subcontractor shall not, by itself, be interpreted
as evidence that the contractor or subcontractor has failed to provide
adequate security on their covered contractor information systems,
or has otherwise failed to meet the requirements of the clause at <xref href="252.204-7012.dita#DFARS_252.204-7012"
                  base="i1380987"
                  outputclass="fm:ParaNumOnly"
                  xtrc="252.204-7012"
                  class="- topic/xref ">252.204-7012</xref> ,
Safeguarding Covered Defense Information and Cyber Incident Reporting.
When a cyber incident is reported, the contracting officer shall
consult with the DoD component Chief Information Officer/cyber security
office prior to assessing contractor compliance (see PGI <xref href="PGI_204.7303-3.dita#DFARS_PGI_PGI_204.7303-3"
                  base="DFARS-PGI_PGI_204.7303-3"
                  outputclass="fm:ParaNumOnly"
                  xtrc="204.7303-3"
                  class="- topic/xref ">204.7303-3</xref> (a)(3)). The contracting
officer shall consider such cyber incidents in the context of an
overall assessment of a contractor’s compliance with the requirements
of the clause at <xref href="252.204-7012.dita#DFARS_252.204-7012"
                  base="i1380987"
                  outputclass="fm:ParaNumOnly"
                  xtrc="252.204-7012"
                  class="- topic/xref ">252.204-7012</xref> .</p>
         <p outputclass="List1" class="- topic/p ">(e) Support services contractors directly
supporting Government activities related to safeguarding covered
defense information and cyber incident reporting (e.g., forensic
analysis, damage assessment, or other services that require access
to data from another contractor) are subject to restrictions on
use and disclosure of reported information.</p>
      </conbody>
   </concept>
</dita>
