|
@@ -1,56 +1,76 @@
|
|
|
1
1
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
2
|
-
<!DOCTYPE dita
|
|
3
|
-
|
|
4
|
-
<
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
class="- topic/topic concept/concept ">
|
|
10
|
-
<title class="- topic/title ">
|
|
11
|
-
<ph props="autonumber" class="- topic/ph ">252.204-7009</ph> Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information.</title>
|
|
12
|
-
<conbody outputclass="clause" class="- topic/body concept/conbody ">
|
|
13
|
-
<p class="- topic/p ">As prescribed in
|
|
14
|
-
<xref outputclass="fm:ParaNumOnly"
|
|
15
|
-
class="- topic/xref "
|
|
16
|
-
base="DFARS-204.7304"
|
|
17
|
-
href="204.7304.dita#DFARS_204.7304">204.7304</xref>
|
|
2
|
+
<!DOCTYPE dita PUBLIC "-//OASIS//DTD DITA Composite//EN" "ditabase.dtd">
|
|
3
|
+
<dita xmlns:ditaarch="http://dita.oasis-open.org/architecture/2005/" domains="(topic task) (topic concept) (topic concept glossentry) (topic concept glossgroup) (topic reference) (topic troubleshooting++task) (topic task) (topic abbrev-d) a(props deliveryTarget) (topic equation-d) (topic hazard-d) (topic hi-d) (topic indexing-d) (topic markup-d) (topic mathml-d) (topic pr-d) (topic relmgmt-d) (topic sw-d) (topic svg-d) (topic ui-d) (topic ut-d) (topic markup-d xml-d) (topic task strictTaskbody-c) " ditaarch:DITAArchVersion="1.3">
|
|
4
|
+
<concept id="DFARS_252.204-7009" ditaarch:DITAArchVersion="1.3" class="- topic/topic concept/concept ">
|
|
5
|
+
<title class="- topic/title "><ph props="autonumber" class="- topic/ph ">252.204-7009</ph> Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information.</title>
|
|
6
|
+
<conbody outputclass="clause" class="- topic/body concept/conbody ">
|
|
7
|
+
<p class="- topic/p ">As prescribed in
|
|
8
|
+
<xref outputclass="fm:ParaNumOnly" class="- topic/xref " base="DFARS-204.7304" href="204.7304.dita#DFARS_204.7304">204.7304</xref>
|
|
18
9
|
(b), use the following clause:</p>
|
|
19
|
-
|
|
20
|
-
|
|
10
|
+
<p class="- topic/p " outputclass="Ctr_SmCaps">LIMITATIONS ON THE USE OR DISCLOSURE OF THIRD-PARTY CONTRACTOR REPORTED CYBER INCIDENT INFORMATION (JAN 2023)</p>
|
|
11
|
+
<info li_elems="0"/>
|
|
12
|
+
<ol>
|
|
13
|
+
<li>
|
|
14
|
+
<p outputclass="List1" class="- topic/p "><ph props="autonumber" class="-topic/ph">(a)</ph><i class="+ topic/ph hi-d/i ">Definitions.</i> As used in this clause<i class="+ topic/ph hi-d/i ">—</i>
|
|
21
15
|
</p>
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
16
|
+
<p class="- topic/p ">“Compromise” means disclosure of information to unauthorized persons, or a violation of the security policy of a system, in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object, or the copying of information to unauthorized media may have occurred.</p>
|
|
17
|
+
<p class="- topic/p ">“Controlled technical information” means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. Controlled technical information would meet the criteria, if disseminated, for distribution statements B through F using the criteria set forth in DoD Instruction 5230.24, Distribution Statements on Technical Documents. The term does not include information that is lawfully publicly available without restrictions.</p>
|
|
18
|
+
<p class="- topic/p ">“Covered defense information” means unclassified controlled technical information or other information (as described in the Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list.html) that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies, and is—</p>
|
|
19
|
+
<info li_elems="0"/>
|
|
20
|
+
<ol>
|
|
21
|
+
<li>
|
|
22
|
+
<p outputclass="List2" class="- topic/p "><ph props="autonumber" class="-topic/ph">(1)</ph> Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DoD in support of the performance of the contract; or</p>
|
|
23
|
+
</li>
|
|
24
|
+
<li>
|
|
25
|
+
<p outputclass="List2" class="- topic/p "><ph props="autonumber" class="-topic/ph">(2)</ph> Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract.</p>
|
|
26
|
+
</li>
|
|
27
|
+
</ol>
|
|
28
|
+
<p class="- topic/p ">“Cyber incident” means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein.</p>
|
|
29
|
+
<p class="- topic/p ">“Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.</p>
|
|
30
|
+
<p class="- topic/p ">“Media” means physical devices or writing surfaces including, but is not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which covered defense information is recorded, stored, or printed within a covered contractor information system.</p>
|
|
31
|
+
<p class="- topic/p ">“Technical information” means technical data or computer software, as those terms are defined in the clause at DFARS <xref outputclass="fm:ParaNumOnly" class="- topic/xref " base="i1382636" href="252.227-7013.dita#DFARS_252.227-7013">252.227-7013</xref> , Rights in Technical Data-Other Than Commercial Products and Commercial Services, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.</p>
|
|
32
|
+
<info li_elems="2"/>
|
|
33
|
+
</li>
|
|
34
|
+
<li>
|
|
35
|
+
<p outputclass="List1" class="- topic/p "><ph props="autonumber" class="-topic/ph">(b)</ph><i class="+ topic/ph hi-d/i ">Restrictions. </i>The Contractor agrees that the following conditions apply to any information it receives or creates in the performance of this contract that is information obtained from a third-party's reporting of a cyber incident pursuant to DFARS clause
|
|
36
|
+
<xref outputclass="fm:ParaNumOnly" class="- topic/xref " base="i1380987" href="252.204-7012.dita#DFARS_252.204-7012">252.204-7012</xref>
|
|
39
37
|
, Safeguarding Covered Defense Information and Cyber Incident Reporting (or derived from such information obtained under that clause):</p>
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
38
|
+
<info li_elems="0"/>
|
|
39
|
+
<ol>
|
|
40
|
+
<li>
|
|
41
|
+
<p outputclass="List2" class="- topic/p "><ph props="autonumber" class="-topic/ph">(1)</ph> The Contractor shall access and use the information only for the purpose of furnishing advice or technical assistance directly to the Government in support of the Government's activities related to clause
|
|
42
|
+
<xref outputclass="fm:ParaNumOnly" class="- topic/xref " base="i1380987" href="252.204-7012.dita#DFARS_252.204-7012">252.204-7012</xref>
|
|
45
43
|
, and shall not be used for any other purpose.</p>
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
44
|
+
</li>
|
|
45
|
+
<li>
|
|
46
|
+
<p outputclass="List2" class="- topic/p "><ph props="autonumber" class="-topic/ph">(2)</ph> The Contractor shall protect the information against unauthorized release or disclosure.</p>
|
|
47
|
+
</li>
|
|
48
|
+
<li>
|
|
49
|
+
<p outputclass="List2" class="- topic/p "><ph props="autonumber" class="-topic/ph">(3)</ph> The Contractor shall ensure that its employees are subject to use and non-disclosure obligations consistent with this clause prior to the employees being provided access to or use of the information.</p>
|
|
50
|
+
</li>
|
|
51
|
+
<li>
|
|
52
|
+
<p outputclass="List2" class="- topic/p "><ph props="autonumber" class="-topic/ph">(4)</ph> The third-party contractor that reported the cyber incident is a third-party beneficiary of the non-disclosure agreement between the Government and Contractor, as required by paragraph (b)(3) of this clause.</p>
|
|
53
|
+
</li>
|
|
54
|
+
<li>
|
|
55
|
+
<p outputclass="List2" class="- topic/p "><ph props="autonumber" class="-topic/ph">(5)</ph> A breach of these obligations or restrictions may subject the Contractor to—</p>
|
|
56
|
+
<info li_elems="0"/>
|
|
57
|
+
<ol>
|
|
58
|
+
<li>
|
|
59
|
+
<p outputclass="List3" class="- topic/p "><ph props="autonumber" class="-topic/ph">(i)</ph> Criminal, civil, administrative, and contractual actions in law and equity for penalties, damages, and other appropriate remedies by the United States; and</p>
|
|
60
|
+
</li>
|
|
61
|
+
<li>
|
|
62
|
+
<p outputclass="List3" class="- topic/p "><ph props="autonumber" class="-topic/ph">(ii)</ph> Civil actions for damages and other appropriate remedies by the third party that reported the cyber incident, as a third party beneficiary of this clause.</p>
|
|
63
|
+
<info li_elems="3"/>
|
|
64
|
+
</li>
|
|
65
|
+
</ol>
|
|
66
|
+
</li>
|
|
67
|
+
</ol>
|
|
68
|
+
</li>
|
|
69
|
+
<li>
|
|
70
|
+
<p outputclass="List1" class="- topic/p "><ph props="autonumber" class="-topic/ph">(c)</ph><i class="+ topic/ph hi-d/i ">Subcontracts</i>. The Contractor shall include this clause, including this paragraph (c), in subcontracts, or similar contractual instruments, for services that include support for the Government's activities related to safeguarding covered defense information and cyber incident reporting, including subcontracts for commercial items, without alteration, except to identify the parties.</p>
|
|
71
|
+
</li>
|
|
72
|
+
</ol>
|
|
73
|
+
<p outputclass="Endofclause" class="- topic/p ">(End of clause)</p>
|
|
74
|
+
</conbody>
|
|
75
|
+
</concept>
|
|
56
76
|
</dita>
|