<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE dita
  PUBLIC "-//OASIS//DTD DITA Composite//EN" "ditabase.dtd">
<dita xmlns:ditaarch="http://dita.oasis-open.org/architecture/2005/"
      domains="(topic task)                            (topic concept)                            (topic concept glossentry)                            (topic concept glossgroup)                            (topic reference)                            (topic troubleshooting++task) (topic task)                            (topic abbrev-d)                            a(props deliveryTarget)                            (topic equation-d)                            (topic hazard-d)                            (topic hi-d)                            (topic indexing-d)                            (topic markup-d)                            (topic mathml-d)                            (topic pr-d)                            (topic relmgmt-d)                            (topic sw-d)                            (topic svg-d)                            (topic ui-d)                            (topic ut-d)                            (topic markup-d xml-d)                            (topic task strictTaskbody-c)   "
      ditaarch:DITAArchVersion="1.3">
   <concept id="DFARS_PGI_204.7303-3"
            outputclass="4"
            ditaarch:DITAArchVersion="1.3"
            class="- topic/topic concept/concept ">
      <title class="- topic/title ">
         <ph props="autonumber" class="- topic/ph ">PGI 204.7303-3</ph> Cyber incident and compromise reporting.</title>
      <conbody class="- topic/body  concept/conbody ">
         <p outputclass="List1" class="- topic/p ">(a) When a cyber incident is reported by a contractor, the DoD Cyber Crime Center (DC3) will send an unclassified encrypted email containing the cyber incident report to the contracting officer(s) identified on the Incident Collection Format (ICF). The DC3 may request the contracting officer send a digitally signed e-mail to DC3.</p>
         <p outputclass="List2" class="- topic/p ">(1) The procuring contracting officer (PCO) shall notify the requiring activities that have contracts identified in the ICF. In cases where an administrative contracting officer (ACO) receives the cyber incident report, in lieu of the PCO, the ACO shall notify the PCO for each affected contract, who will then notify the requiring activity.</p>
         <p outputclass="List2" class="- topic/p ">(2) In cases of cyber incidents involving multiple contracts, the DoD components will collaboratively designate a single contracting officer to coordinate additional actions required of the contractor, on behalf of the affected DoD components. The requiring activity will notify the contracting officer once a lead is designated. </p>
         <p outputclass="List2" class="- topic/p ">(3) If the requiring activity requests an assessment of compliance with the requirements of the clause at DFARS <xref outputclass="fm:ParaNumOnly"
                  class="- topic/xref "
                  base="DFARS-252.204-7012"
                  href="252.204-7012.dita#DFARS_252.204-7012">252.204-7012</xref> related to the cyber incident, the contracting officer shall—</p>
         <p outputclass="List3" class="- topic/p ">(i) Consult with the DoD component Chief Information Officer (CIO)/cyber security office;</p>
         <p outputclass="List3" class="- topic/p ">(ii) Request a description of the contractor’s implementation of the security requirements in NIST SP 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (see http://dx.doi.org/10.6028/NIST.SP.800-171) in order to support evaluation of whether any of the controls were inadequate, or if any of the controls were not implemented at the time of the incident; and</p>
         <p outputclass="List3" class="- topic/p ">(iii) Provide a copy of the assessment of contractor compliance to the requiring activity, the DoD CIO at osd.dibcsia@mail.mil, and the other contracting officers listed in the cyber incident report.</p>
         <p outputclass="List1" class="- topic/p ">(b) When requested by the contractor, the contracting officer shall provide the contractor with the “Instructions for Malware Submission” document available at http://www.acq.osd.mil/dpap/pdi/docs/Instructions_for_Malware_Submission.docx. The contracting officer should never receive malicious software directly from the contractor. </p>
         <p outputclass="List1" class="- topic/p ">(c) If the requiring activity requests access to contractor information or equipment, in accordance with DFARS <xref outputclass="fm:ParaNumOnly"
                  class="- topic/xref "
                  base="DFARS-252.204-7012"
                  href="252.204-7012.dita#DFARS_252.204-7012">252.204-7012</xref>(f), the contracting officer shall provide a written request to the contractor.</p>
         <p outputclass="List1" class="- topic/p ">(d) For additional information on cyber incident reporting, see the Frequently Asked Questions document at http://www.acq.osd.mil/dpap/pdi/network_penetration_reporting_and_contracting.html.</p>
      </conbody>
   </concept>
</dita>
