<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE dita
  PUBLIC "-//OASIS//DTD DITA Composite//EN" "ditabase.dtd">
<dita xmlns:ditaarch="http://dita.oasis-open.org/architecture/2005/"
      ditaarch:DITAArchVersion="1.2">
   <concept id="DFARS_252.204-7019"
            ditaarch:DITAArchVersion="1.2"
            class="- topic/topic concept/concept ">
      <title class="- topic/title ">
         <ph props="autonumber" class="- topic/ph ">252.204-7019</ph> Notice of NISTSP 800-171 DoD Assessment Requirements.</title>
      <conbody class="- topic/body  concept/conbody ">
         <p id="qUkUdx" class="- topic/p ">As prescribed in 204.7304(d), use the
following provision:</p>
         <p class="- topic/p " outputclass="Ctr_SmCaps">NOTICE OF NIST SP 800–171 DOD
            ASSESSMENT REQUIREMENTS (NOV 2023)</p>
         <p class="- topic/p " outputclass="List1" id="JKrwWo">(a) <i class="+ topic/ph hi-d/i ">Definitions</i>.</p>
         <p id="wsqlZS" class="- topic/p ">“Basic Assessment”, “Medium Assessment”, and “High
Assessment” have the meaning given in the clause 252.204-7020, NIST
SP 800-171 DoD Assessments.</p>
         <p id="vIcCjF" class="- topic/p ">“Covered contractor information system” has the
meaning given in the clause 252.204-7012, Safeguarding Covered Defense Information
and Cyber Incident Reporting, of this solicitation.</p>
         <p class="- topic/p " outputclass="List1"> (b)
            <i class="+ topic/ph hi-d/i ">Requirement.</i>
             In order to be considered for award, if the Offeror is required to
            implement NIST SP 800–171, the Offeror shall have a current
            assessment (
            <i class="+ topic/ph hi-d/i ">i.e.,</i>
             not more than 3 years old unless a lesser time is specified in the
            solicitation) (see 252.204–7020) for each covered contractor
            information system that is relevant to the offer, contract, task
            order, or delivery order. The Basic, Medium, and High NIST SP
            800–171 DoD Assessments are described in the NIST SP 800–171 DoD
            Assessment Methodology located at
            
               <i class="+ topic/ph hi-d/i "/>
            
            
            https://www.acq.osd.mil/asda/dpc/cp/cyber/docs/safeguarding/NIST-SP-800-171-Assessment-Methodology-Version-1.2.1-6.24.2020.pdf
            .</p>
         <p class="- topic/p " outputclass="List1" id="sDcTZh">(c) <i class="+ topic/ph hi-d/i ">Procedures</i>.</p>
         <p class="- topic/p " outputclass="List2" id="wUNVHv">(1) The Offeror shall verify
that summary level scores of a current NIST SP 800-171 DoD Assessment
(i.e., not more than 3 years old unless a lesser time is specified
in the solicitation) are posted in the Supplier Performance Risk
System (SPRS) () for all covered contractor information systems
relevant to the offer.</p>
         <p class="- topic/p " outputclass="List2" id="LNioiJ">(2) If the Offeror does not
have summary level scores of a current NIST SP 800-171 DoD Assessment
(i.e., not more than 3 years old unless a lesser time is specified
in the solicitation) posted in SPRS, the Offeror may conduct and
submit a Basic Assessment to for posting to SPRS in the format identified
in paragraph (d) of this provision.</p>
         <p class="- topic/p " outputclass="List1" id="ByzCtO">(d) <i class="+ topic/ph hi-d/i ">Summary level scores</i>.
Summary level scores for all assessments will be posted 30 days
post-assessment in SPRS to provide DoD Components visibility into
the summary level scores of strategic assessments.</p>
         <p class="- topic/p " outputclass="List2" id="CjBeos">(1) <i class="+ topic/ph hi-d/i ">Basic Assessments</i>.
An Offeror may follow the procedures in paragraph (c)(2) of this
provision for posting Basic Assessments to SPRS.</p>
         <p class="- topic/p " outputclass="List3" id="oIUGWr">(i) The email shall include
the following information:</p>
         <p class="- topic/p " outputclass="List4" id="oMjZfv">(A) Cybersecurity standard
assessed (e.g., NIST SP 800-171 Rev 1).</p>
         <p class="- topic/p " outputclass="List4" id="JoianN">(B) Organization conducting
the assessment (e.g., Contractor self-assessment).</p>
         <p class="- topic/p " outputclass="List4" id="wXTlHd">(C) For each system security
plan (security requirement 3.12.4) supporting the performance of
a DoD contract—</p>
         <p class="- topic/p " outputclass="List2" id="fZGZuC">(1) All industry Commercial
and Government Entity (CAGE) code(s) associated with the information
system(s) addressed by the system security plan; and</p>
         <p class="- topic/p " outputclass="List2" id="xbgqpP">(2) A brief description of
the system security plan architecture, if more than one plan exists.</p>
         <p class="- topic/p " outputclass="List4" id="fVvlYj">(D) Date the assessment was
completed.</p>
         <p class="- topic/p " outputclass="List4" id="OwdQKn">(E) Summary level score (e.g.,
95 out of 110, NOT the individual value for each requirement).</p>
         <p class="- topic/p " outputclass="List4" id="mLfXcm">(F) Date that all requirements
are expected to be implemented (i.e., a score of 110 is expected
to be achieved) based on information gathered from associated plan(s)
of action developed in accordance with NIST SP 800-171.</p>
         <p class="- topic/p " outputclass="List3" id="igRmzB">(ii) If multiple system security
plans are addressed in the email described at paragraph (d)(1)(i)
of this section, the Offeror shall use the following format for
the report:</p>
         <table frame="all" colsep="1" rowsep="0" class="- topic/table ">
            <tgroup cols="6"
                    colsep="1"
                    rowsep="0"
                    outputclass="Choice"
                    class="- topic/tgroup ">
               <colspec colnum="1"
                        colname="1"
                        colwidth="17*"
                        class="- topic/colspec "
                        rowheader="headers"/>
               <colspec colnum="2"
                        colname="2"
                        colwidth="17*"
                        class="- topic/colspec "
                        rowheader="headers"/>
               <colspec colnum="3"
                        colname="3"
                        colwidth="17*"
                        class="- topic/colspec "
                        rowheader="headers"/>
               <colspec colnum="4"
                        colname="4"
                        colwidth="17*"
                        class="- topic/colspec "
                        rowheader="headers"/>
               <colspec colnum="5"
                        colname="5"
                        colwidth="17*"
                        class="- topic/colspec "
                        rowheader="headers"/>
               <colspec colnum="6"
                        colname="6"
                        colwidth="17*"
                        class="- topic/colspec "
                        rowheader="headers"/>
               <tbody class="- topic/tbody ">
                  <row rowsep="1" class="- topic/row ">
                     <entry colname="1" class="- topic/entry ">
                        <p id="fVAmKe" class="- topic/p ">System Security Plan</p>
                     </entry>
                     <entry colname="2" class="- topic/entry ">
                        <p id="plSHms" class="- topic/p ">CAGE Codes supported by this
plan</p>
                     </entry>
                     <entry colname="3" class="- topic/entry ">
                        <p id="cnvzaY" class="- topic/p ">Brief description of the plan
architecture</p>
                     </entry>
                     <entry colname="4" class="- topic/entry ">
                        <p id="VidOwG" class="- topic/p ">Date of assessment</p>
                     </entry>
                     <entry colname="5" class="- topic/entry ">
                        <p id="ByzhYm" class="- topic/p ">Total Score</p>
                     </entry>
                     <entry colname="6" class="- topic/entry ">
                        <p id="Hhorse" class="- topic/p ">Date score of 110 will achieved</p>
                     </entry>
                  </row>
                  <row rowsep="1" class="- topic/row ">
                     <entry colname="1" class="- topic/entry "/>
                     <entry colname="2" class="- topic/entry "/>
                     <entry colname="3" class="- topic/entry "/>
                     <entry colname="4" class="- topic/entry "/>
                     <entry colname="5" class="- topic/entry "/>
                     <entry colname="6" class="- topic/entry "/>
                  </row>
                  <row rowsep="1" class="- topic/row ">
                     <entry colname="1" class="- topic/entry "/>
                     <entry colname="2" class="- topic/entry "/>
                     <entry colname="3" class="- topic/entry "/>
                     <entry colname="4" class="- topic/entry "/>
                     <entry colname="5" class="- topic/entry "/>
                     <entry colname="6" class="- topic/entry "/>
                  </row>
                  <row rowsep="0" class="- topic/row ">
                     <entry colname="1" class="- topic/entry "/>
                     <entry colname="2" class="- topic/entry "/>
                     <entry colname="3" class="- topic/entry "/>
                     <entry colname="4" class="- topic/entry "/>
                     <entry colname="5" class="- topic/entry "/>
                     <entry colname="6" class="- topic/entry "/>
                  </row>
               </tbody>
            </tgroup>
         </table>
         <p class="- topic/p " outputclass="List2" id="cmzKMA">(2) <i class="+ topic/ph hi-d/i ">Medium and High Assessments</i>.
DoD will post the following Medium and/or High Assessment summary
level scores to SPRS for each system assessed:</p>
         <p class="- topic/p " outputclass="List3" id="lDLNuh">(i) The standard assessed
(e.g., NIST SP 800-171 Rev 1).</p>
         <p class="- topic/p " outputclass="List3" id="bhroqq">(ii) Organization conducting
the assessment, e.g., DCMA, or a specific organization (identified
by Department of Defense Activity Address Code (DoDAAC)).</p>
         <p class="- topic/p " outputclass="List3" id="NAhkBr">(iii) All industry CAGE code(s)
associated with the information system(s) addressed by the system
security plan.</p>
         <p class="- topic/p " outputclass="List3" id="NRYKou">(iv) A brief description
of the system security plan architecture, if more than one system
security plan exists.</p>
         <p class="- topic/p " outputclass="List3" id="EClMON">(v) Date and level of the
assessment, i.e., medium or high.</p>
         <p class="- topic/p " outputclass="List3" id="dIPCNz">(vi) Summary level score
(e.g., 105 out of 110, not the individual value assigned for each
requirement).</p>
         <p class="- topic/p " outputclass="List3" id="oqqNyZ">(vii) Date that all requirements
are expected to be implemented (i.e., a score of 110 is expected
to be achieved) based on information gathered from associated plan(s)
of action developed in accordance with NIST SP 800-171.</p>
         <p class="- topic/p " outputclass="List2" id="PwHfUF">(3) <i class="+ topic/ph hi-d/i ">Accessibility</i>.</p>
         <p class="- topic/p " outputclass="List3" id="VwqmbY">(i) Assessment summary level
scores posted in SPRS are available to DoD personnel, and are protected,
in accordance with the standards set forth in DoD Instruction 5000.79,
Defense-wide Sharing and Use of Supplier and Product Performance
Information (PI).</p>
         <p class="- topic/p " outputclass="List3" id="DvBkxK">(ii) Authorized representatives
of the Offeror for which the assessment was conducted may access
SPRS to view their own summary level scores, in accordance with
the SPRS Software User’s Guide for Awardees/Contractors available at <xref href="https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf"
                  format="pdf"
                  scope="external"
                  class="- topic/xref ">https://www.sprs.csd.disa.mil/pdf/SPRS_Awardee.pdf</xref>.</p>
         <p class="- topic/p " outputclass="List3" id="QZroFC">(iii) A High NIST SP 800-171
DoD Assessment may result in documentation in addition to that listed
in this section. DoD will retain and protect any such documentation
as “Controlled Unclassified Information (CUI)” and intended for
internal DoD use only. The information will be protected against
unauthorized use and release, including through the exercise of
applicable exemptions under the Freedom of Information Act (e.g.,
Exemption 4 covers trade secrets and commercial or financial information
obtained from a contractor that is privileged or confidential).</p>
         <p id="jPDpPf" outputclass="Ctr" class="- topic/p ">(End of provision)</p>
      </conbody>
   </concept>
</dita>
