1252.204-701252.204-70 Contractor Personnel Security and Agency Access.#
As prescribed in 1204.1303, insert the following clause: Contractor Personnel Security and Agency Access (NOV 2022) (a) Definitions. As used in this clause— Agency access means access to DOT facilities, sensitive information, information systems or other DOT resources. Applicant means a contractor employee for whom the Contractor applies for a DOT identification card. Contractor employee means a prime contractor and subcontractor employee who requires agency access to perform work under a DOT contract. Identification card (or “ID card”) means a government issued or accepted identification card such as a Personal Identity Verification (PIV) card, a PIV-Interoperable (PIV-I) card from an authorized PIV-1 issuer, or a non-PIV card issued by DOT, or a nonPIV card issued by another Federal agency and approved by DOT. PIV and PIV-1 cards have physical and electronic attributes that other (non-PIV) ID cards do not have. Issuing office means the DOT entity that issues identification cards to contractor employees. Local security servicing organization means the DOT entity that provides security services to the DOT organization sponsoring the contract. (b) Risk and sensitivity level designations. For contracts requiring access to DOT facilities, sensitive information, information systems or other DOT resources, contractor employees will be required to complete background investigations, identity proofing, and government identification card application procedures to determine suitability for access. DOT will assign a risk and sensitivity level designation to the overall contract and/or to contractor employee positions by category, group or individual. The risk and sensitivity level designations will be the basis for determining the level of personnel security processing required for contractor employees. The following risk and sensitivity level designations and associated level of processing are required, and each level includes the prior levels— (1) Low risk level: National Agency Check with Written Inquiries (NACI); (2) Moderate risk level: Minimum Background Investigation (MBI); and (3) High risk level: Background Investigation. (c) Security clearances. Contractor employees may also be required to obtain security clearances (i.e., Confidential, Secret, or Top Secret). National Security work designated “special sensitive,” “critical sensitive,” or “non-critical sensitive,” will determine the level of clearance required for contractor employees. Personnel security clearances for national security contracts in DOT will be processed according to the Department of Defense National Industrial Security Program Operating Manual (NISPOM). (d) Pre-screening of contractor employees. The Contractor must pre-screen individuals designated for employment under any DOT contract by verifying minimal suitability requirements to ensure that only candidates that appear to meet such requirements are considered for contract employment, and to mitigate the burden on the Government of conducting background investigations on objectionable applicants. The Contractor must exercise due diligence in pre-screening all employees prior to submission to DOT for agency access. DOT may decline to grant agency access to a contractor employee for reasons including, but not limited to— (1) Conviction of a felony, a crime of violence, or a misdemeanor involving moral turpitude; (2) Falsification of information entered on forms or of other documents submitted; (3) Improper conduct including criminal, infamous, dishonest, immoral, or notoriously disgraceful conduct or other conduct adverse to the Government regardless of whether the conduct is directly related to the contract; and (4) Any behavior judged to pose a potential threat to DOT facilities, sensitive information, information systems or other resources. (e) Citizenship status. The Contractor must monitor a non-citizen's continued authorization for employment in the United States. The Contractor must provide documentation to the Contracting Officer or the Contracting Officer's Representative (COR) during the background investigation process that validates that the E-Verify requirement has been met for each contractor employee. (f) Background investigation and adjudication. A contractor employee must have a favorable adjudication of background investigation before DOT will issue an ID card to the contractor employee granting access to DOT facilities, sensitive information, information systems or other DOT resources. DOT may accept favorable adjudications of background investigations from other Federal agencies when applicants have held PIV cards issued by those agencies with no break in service. DOT may also accept PIV-I (Interoperable) cards issued by an authorized PIV-1 issuer as evidence of identity. A favorable adjudication does not preclude DOT from initiating a new investigation when deemed necessary. At a minimum, the FBI National Criminal History Check (fingerprint check) must be favorably completed before a DOT identification card can be issued. Each Contractor must use the Office of Personnel Management's (OPM) e-QIP system to complete any required investigative forms. Instructions for obtaining fingerprints will be provided by the COR or Contracting Officer. The DOT Office of Security, M-40, or a DOT organization delegated authority by M-40, is responsible for adjudicating the suitability of contractor employees. (g) Agency access denied. Upon contract award, DOT will initiate the agency access procedure for all contractor employees requiring access to DOT facilities, sensitive information, information systems and other DOT resources for contract performance. DOT may deny agency access to any individual about whom an adverse suitability determination is made. Failure to submit the required security information or to truthfully answer all questions shall constitute grounds for denial of access. The Contractor must not provide agency access to contractor employees until the COR or Contracting Officer provides notice of approval, which is authorized only by the DOT Office of Security (M-40) or a DOT organization delegated authority by M-40. Where a proposed contractor employee is denied agency access by the Government or, if for any reason a proposed application is withdrawn by the Contractor during the agency access process, the additional costs and administrative burden for conducting additional background investigations caused by a lack of effective prescreening or planning on the part of the Contractor may be considered as part of the Contractor's overall performance evaluation. (h) Identification card application process. The COR will be the DOT ID card Sponsor and point of contact for the Contractor's application for a DOT ID card. The COR shall review and approve the DOT ID card application before an ID card is issued to the applicant. An applicant may be issued either a Personal Identity Verification (PIV) card that meets the standards of Homeland Presidential Security Directive (HSPD-12), or an applicant may be issued a non-PIV card. Generally, a non-PIV card will be issued for contracts that expire in six months or less, including option periods. The COR may request the issuing office to waive the six-month eligibility requirement when it is in DOT's interest for contract performance. The following applies— (1) PIV card. The applicant must complete a DOT on-line application for a PIV card; (2) Non-PIV card. The applicant must complete and submit a hard copy of Form 1681 to the COR/Sponsor; and (3) Regardless of the type of card to be issued (PIV or non-PIV), the applicant must appear in person to provide two forms of identity source documents in original form to DOT. The identity source documents must come from the list of acceptable documents included in Form F-9, OMB No. 1115-0136, Employment Eligibility Verification. At least one document must be a valid State or Federal government-issued picture identification. For a PIV card, the applicant may be required to appear in-person a second time for enrollment and activation. (i) Identification card custody and control. The Contractor is responsible for the custody and control of all forms of government identification issued by DOT to contractor employees for access to DOT facilities, sensitive information, information systems and other DOT resources. The Contractor shall: (1) Provide a listing of personnel for whom an identification (ID) card is requested to the COR or PM who will provide a copy of the listing to the card issuing office. This may include Contractor and subcontractor personnel. Follow issuing office directions for submittal of an application package(s). (2) While visiting or performing work on a DOT facility, as specified by the issuing office, PM or COR, ensure that contractor employees prominently display their ID card. (3) Immediately notify the COR or, if the COR is unavailable, the Contracting Officer when a contractor employee's status changes and no longer requires agency access (e.g., employee's transfer, completion of a project, retirement, removal from work on the contract, or termination of employment) that may affect the employee's eligibility for access to the facility, sensitive information, or resources. (4) Promptly deliver to the issuing office: (a) all ID cards assigned to an employee who no longer requires access to the facility; and (b) all expired ID cards within five (5) days of their expiration or all cards at time of contract termination, whichever occurs first. (5) Immediately report any lost or stolen ID cards to the issuing office and follow its instructions. (i) The Contractor is responsible for maintaining and safeguarding the DOT ID card upon issuance to the contractor employee. The Contractor must ensure that contractor employees comply with DOT requirements concerning the renewal, loss, theft, or damage of an ID card. The Contractor must immediately notify the COR or, if the COR is unavailable, the Contracting Officer when an ID card is lost, stolen or damaged. (ii) Failure to comply with the requirements for custody and control of DOT ID cards may result in withholding final payment or contract termination based on the potential for serious harm caused by inappropriate access to DOT facilities, sensitive information, information systems or other DOT resources. (iii) Specific actions and activities are required in certain events— (A) Renewal. A contractor employee's DOT issued ID card is valid for a maximum of three years or until the contract expiration date (including option periods), whichever occurs first. The renewal process should begin six weeks before the PIV card expiration date. If a PIV card is not renewed before it expires, the contractor employee will be required to sign-in daily for facility access and may have limited access to information systems and other resources. (B) Lost/stolen. Immediately upon detection, the Contractor or contractor employee must report a lost or stolen DOT ID card to the COR, or if the COR is unavailable, the Contracting Officer, the issuing office, or the local servicing security organization. The Contractor must submit an incident report within 48 hours, through the COR or, if the COR is unavailable, the Contracting Officer, the issuing office, or the local security servicing organization describing the circumstances of the loss or theft. The Contractor must also report a lost or stolen PIV card through the DOT on-line registration system. If the loss or theft is reported by the Contractor to the local police, a copy of the police report must be provided to the COR or Contracting Officer. From the date of notification to DOT, the Contractor must wait three days before getting a replacement ID card. During the 3-day wait period, the contractor employee must sign in daily for facility access. (C) Replacement. An ID card will be replaced if it is damaged, contains incorrect data, or is lost or stolen for more than 3 days, provided there is a continuing need for agency access to perform work under the contract. (D) Surrender of ID cards. Upon notification that routine access to DOT facilities, sensitive information, information systems or other DOT resources is no longer required, the Contractor must surrender the DOT issued ID card to the COR, or if the COR is unavailable, the Contracting Officer, the issuing office, or the local security servicing organization in accordance with agency procedures. (j) Flow down of clause. The Contractor is required to include this clause in any subcontracts at any tier that require the subcontractor or subcontractor's employees to have access to DOT facilities, sensitive information, information systems or other resources. (End of clause)
1252.217-731252.217-73 Inspection and Manner of Doing Work.#
As prescribed at 1217.7001(b), insert the following clause: Inspection and Manner of Doing Work (NOV 2022) (a) The Contractor shall perform work in accordance with the contract, any drawings and specifications made a part of the job order, and any change or modification issued under the Changes clause. (b)(1) Except as provided in paragraph (b)(2) of this clause, and unless otherwise specifically provided in the contract, all operational practices of the Contractor and all workmanship, material, equipment, and articles used in the performance of work under this contract shall be in accordance with the best commercial marine practices and the rules and requirements of all appropriate regulatory bodies including, but not limited to the American Bureau of Shipping, the U.S. Coast Guard, and the Institute of Electrical and Electronic Engineers, in effect at the time of Contractor's submission of offer, and shall be intended and approved for marine use. (2) When Navy specifications are specified in the contract, the Contractor shall follow Navy standards of material and workmanship. The solicitation shall prescribe the Navy standard whenever applicable. (c) The Government may inspect and test all material and workmanship at any time during the Contractor's performance of the work. (1) If, prior to delivery, the Government finds any material or workmanship is defective or not in accordance with the contract, in addition to its rights under the Guarantee clause, the Government may reject the defective or nonconforming material or workmanship and require the Contractor to correct or replace it at the Contractor's expense. (2) If the Contractor fails to proceed promptly with the replacement or correction of the material or workmanship, the Government may replace or correct the defective or nonconforming material or workmanship and charge the Contractor the excess costs incurred. (3) As specified in the contract, the Contractor shall provide and maintain an inspection system acceptable to the Government. (4) The Contractor shall maintain complete records of all inspection work and shall make them available to the Government during performance of the contract and for 90 days after the completion of all work required. (d) The Contractor shall not permit any welder to work on a vessel unless the welder is, at the time of the work, qualified to the standards established by the U.S. Coast Guard, American Bureau of Shipping, or Department of the Navy for the type of welding being performed. Qualifications of a welder shall be as specified in the contract. (e) The Contractor shall— (1) Exercise reasonable care to protect the vessel from fire; (2) Maintain a reasonable system of inspection over activities taking place in the vicinity of the vessel's magazines, fuel oil tanks, or storerooms containing flammable materials. (3) Maintain a reasonable number of hose lines ready for immediate use on the vessel at all times while the vessel is berthed alongside the Contractor's pier or in dry dock or on a marine railway; (4) Unless otherwise provided in the contract, provide sufficient security patrols to reasonably maintain a fire watch for protection of the vessel when it is in the Contractor's custody; (5) To the extent necessary, clean, wash, and steam out or otherwise make safe, all tanks under alteration or repair. (6) Furnish the Contracting Officer a “gas-free” or “safe-for-hotwork” certificate before any hot work is done on a tank; (7) Treat the contents of any tank as Government property in accordance with clause 52.245-1, Government Property; and (8) Dispose of the contents of any tank only at the direction, or with the concurrence, of the Contracting Officer. (9) Be responsible for the proper closing of all openings to the vessel's underwater structure upon which work has been performed. The Contractor additionally must advise the COR of the status of all valve closures and openings for which the Contractor's workers were responsible. (f) Except as otherwise provided in the contract, when the vessel is in the custody of the Contractor or in dry dock or on a marine railway and the temperature is expected to go as low as 35 Fahrenheit, the Contractor shall take all necessary steps to— (1) Keep all hose pipe lines, fixtures, traps, tanks, and other receptacles on the vessel from freezing; and (2) Protect the stern tube and propeller hubs from frost damage. (g) The Contractor shall, whenever practicable— (1) Perform the required work in a manner that will not interfere with the berthing and messing of Government personnel attached to the vessel; and (2) Provide Government personnel attached to the vessel access to the vessel at all times. (h) Government personnel attached to the vessel shall not interfere with the Contractor's work or workers. (i)(1) The Government does not guarantee the correctness of the dimensions, sizes, and shapes set forth in any contract, sketches, drawings, plans, or specifications prepared or furnished by the Government, unless the contract requires that the Contractor perform the work prior to any opportunity to inspect. (2) Except as stated in paragraph (i)(1) of this clause, and other than those parts furnished by the Government, and the Contractor shall be responsible for the correctness of the dimensions, sizes, and shapes of parts furnished under this contract. (j) The Contractor shall at all times keep the site of the work on the vessel free from accumulation of waste material or rubbish caused by its employees or the work. At the completion of the work, unless the contract specifies otherwise, the Contractor shall remove all rubbish from the site of the work and leave the immediate vicinity of the work area “broom clean.” (End of clause)
1252.217-761252.217-76 Liability and Insurance.#
As prescribed at 1217.7001(b), insert the following clause: Liability and Insurance (NOV 2022) (a) The Contractor shall exercise its best efforts to prevent accidents, injury, or damage to all employees, persons, and property, in and about the work, and to the vessel or part of the vessel upon which work is done. (b) Loss or damage to the vessel, materials, or equipment. (1) Unless otherwise directed or approved in writing by the Contracting Officer, the Contractor shall not carry insurance against any form of loss or damage to the vessel(s) or to the materials or equipment to which the Government has title or which have been furnished by the Government for installation by the Contractor. The Government assumes the risks of loss of and damage to that property. (2) The Government does not assume any risk with respect to loss or damage compensated for by insurance or otherwise or resulting from risks with respect to which the Contractor has failed to maintain insurance, if available, as required or approved by the Contracting Officer. (3) The Government does not assume risk of and will not pay for any costs of the following: (i) Inspection, repair, replacement, or renewal of any defects in the vessel(s) or material and equipment due to— (A) Defective workmanship performed by the Contractor or its subcontractors; (B) Defective materials or equipment furnished by the Contractor or its subcontractors; or (C) Workmanship, materials, or equipment which do not conform to the requirements of the contract, regardless of whether the defect is latent or whether the nonconformance is the result of negligence. (ii) Loss, damage, liability, or expense caused by, resulting from, or incurred as a consequence of any delay or disruption, willful misconduct or lack of good faith by the Contractor or any of its representatives that have supervision or direction of— (A) All or substantially all of the Contractor's business; or (B) All or substantially all of the Contractor's operation at any one plant. (4) As to any risk that is assumed by the Government, the Government shall be subrogated to any claim, demand or cause of action against third parties that exists in favor of the Contractor. If required by the Contracting Officer, the Contractor shall execute a formal assignment or transfer of the claim, demand, or cause of action. (5) No party other than the Contractor shall have any right to proceed directly against the Government or join the Government as a codefendant in any action. (6) Notwithstanding the foregoing, the Contractor shall bear the first $5,000 of loss or damage from each occurrence or incident, the risk of which the Government would have assumed under the provision of this paragraph (b). (c) Indemnification. The Contractor indemnifies the Government and the vessel and its owners against all claims, demands, or causes of action to which the Government, the vessel or its owner(s) might be subject as a result of damage or injury (including death) to the property or person of anyone other than the Government or its employees, or the vessel or its owner, arising in whole or in part from the negligence or other wrongful act of the Contractor, or its agents or employees, or any subcontractor, or its agents or employees. (1) The Contractor's obligation to indemnify under this paragraph shall not exceed the sum of $300,000 as a consequence of any single occurrence with respect to any one vessel. (2) The indemnity includes, without limitation, suits, actions, claims, costs, or demands of any kind, resulting from death, personal injury, or property damage occurring during the period of performance of work on the vessel or within 90 days after redelivery of the vessel. For any claim, etc., made after 90 days, the rights of the parties shall be as determined by other provisions of this contract and by law. The indemnity applies to death occurring after 90 days where the injury was received during the period covered by the indemnity. (d) Insurance. (1) The Contractor shall, at its own expense, obtain and maintain the following insurance— (i) Casualty, accident, and liability insurance, as approved by the Contracting Officer, insuring the performance of its obligations under paragraph (c) of this clause. (ii) Workers Compensation Insurance (or its equivalent) covering the employees engaged on the work. (2) The Contractor shall ensure that all subcontractors engaged on the work obtain and maintain the insurance required in paragraph (d)(1) of this clause. (3) Upon request of the Contracting Officer, the Contractor shall provide evidence of the insurance required by paragraph (d) of this clause. (e) The Contractor shall not make any allowance in the contract price for the inclusion of any premium expense or charge for any reserve made on account of self-insurance for coverage against any risk assumed by the Government under this clause. (f) The Contractor shall give the Contracting Officer written notice as soon as practicable after the occurrence of a loss or damage for which the Government has assumed the risk. (1) The notice shall contain full details of the loss or damage. (2) If a claim or suit is later filed against the Contractor as a result of the event, the Contractor shall immediately deliver to the Government every demand, notice, summons, or other process received by the Contractor or its employees or representatives. (3) The Contractor shall cooperate with the Government and, upon request, shall assist in effecting settlements, securing and giving evidence, obtaining the attendance of witnesses, and the conduct of suits. The Government shall reimburse the Contractor for expenses incurred in this effort, other than the cost of maintaining the Contractor's usual organization. (4) The Contractor shall not, except at its own expense, voluntarily make any payments, assume any obligation, or incur any expense other than what would be imperative for the protection of the vessel(s) at the time of the event. (g) In the event of loss of or damage to any vessel(s), material, or equipment which may result in a claim against the Government under the insurance provisions of this contract, the Contractor shall promptly notify the Contracting Officer of the loss or damage. The Contracting Officer may, without prejudice to any right of the Government, either— (1) Order the Contractor to proceed with replacement or repair, in which event the Contractor shall effect the replacement or repair; (i) The Contractor shall submit to the Contracting Officer a request for reimbursement of the cost of the replacement or repair together with whatever supporting documentation the Contracting Officer may reasonably require, and shall identify the request as being submitted under the Insurance clause of this contract. (ii) If the Government determines that the risk of the loss or damage is within the scope of the risks assumed by the Government under this clause, the Government will reimburse the Contractor for the reasonable allowable cost of the replacement or repair, plus a reasonable profit (if the work or replacement or repair was performed by the Contractor) less the deductible amount specified in paragraph (b) of this clause. (iii) Payments by the Government to the Contractor under this clause are outside the scope of and shall not affect the pricing structure of the contract, and are additional to the compensation otherwise payable to the Contractor under this contract; or (2) Decide that the loss or damage shall not be replaced or repaired and in that event, the Contracting Officer shall— (i) Modify the contract appropriately, consistent with the reduced requirements reflected by the unreplaced or unrepaired loss or damage; or (ii) Terminate the repair of any part or all of the vessel(s) under the Termination for Convenience of the Government clause of this contract. (End of clause)
1252.235-701252.235-70 Research Misconduct.#
As prescribed in 1235.070-1, insert the following clause: Research Misconduct (NOV 2022) (a) Definitions. As used in this clause— Adjudication means the process of reviewing recommendations from the investigation phase and determining appropriate corrective actions. Complainant means the person who makes an allegation of research misconduct or the person who cooperates with an inquiry or investigation. DOT Oversight Organization is the Department of Transportation (DOT) operating administration or Secretarial office sponsoring or managing Federally-funded research. Evidence includes, but is not limited to, research records, transcripts, or recordings of interviews, committee correspondence, administrative records, grant applications and awards, manuscripts, publications, expert analyses, and electronic data. Fabrication means making up data or results and recording or reporting them. Falsification means manipulating research materials, equipment, or processes, or changing or omitting data or results such that the research is not accurately represented in the research record. Inquiry means preliminary information gathering and fact-finding to determine if an allegation, or apparent instance of research misconduct, warrants an investigation. Investigation means formal collection and evaluation of information and facts to determine if research misconduct can be established, to assess its extent and consequences, and to recommend appropriate action. Plagiarism means the appropriation of another person's ideas, processes, results, or words without giving appropriate credit. Research misconduct does not include honest error or differences of opinion. Research and Technology Coordinating Council (RTCC) is the lead DOT entity for coordination of all actions related to allegations of research misconduct. The respondent in a research misconduct finding may appeal through the RTCC to the Deputy Secretary of Transportation. Research institution includes any Contractor conducting research under DOT-funded contractual instruments, contracts, and similar instruments. Research misconduct means fabrication, falsification, or plagiarism, in proposing, performing, or reviewing research, or in reporting research results. Research misconduct does not include honest error or difference of opinion. Research record means the record of data or results that embody the facts resulting from scientific inquiry, and includes, but is not limited to, research proposals, laboratory records, both physical and electronic, progress reports, abstracts, theses, oral presentations, internal reports, and journal articles. Respondent means the person against whom an allegation of research misconduct has been made, or the person whose actions are the focus of the inquiry or investigation. (b) General guidelines. (1) Confidentiality. DOT organizations, including research organizations, are required to safeguard the confidentiality of the inquiry, investigation and decision-making processes, including maintaining complete confidentiality of all records and identities of respondents and complainants. (2) Retaliation prohibited. If a complainant who has reported possible research misconduct alleges retaliation on the part of DOT organization management, the report will be addressed by management officials who will conduct an inquiry into the allegations followed by an appropriate management action. (3) Separation of phases. DOT organizations and research organizations must ensure the separation of the Inquiry, Investigation and Determination Phases of this process. (4) In general, DOT organizations must strive to protect the interests of the Federal Government and the public in carrying out this process. (c) Elements to support a finding of research misconduct. Research institutions (including Contractors) that receive DOT funds shall respond to allegations of research misconduct. The following elements describe the type of behavior, level of intent, and burden of proof required to support a finding of research misconduct: (1) There must be a significant departure from the accepted practices of the relevant research community; (2) The misconduct must have been committed intentionally, knowingly, or recklessly; and (3) The allegation must be proven by a preponderance of the evidence. (d) DOT Oversight Organization Investigation. The DOT oversight organization may proceed with its own investigation at any time if: (1) DOT determines the research institution is not prepared to handle the allegation in a manner consistent with this policy. (2) DOT involvement is needed to protect the public interest, including public health and safety. (3) The allegation involves an entity of sufficiently small size (or an individual) that it cannot sufficiently conduct the investigation itself. (4) The DOT oversight organization may take, or cause to be taken, interim administrative actions (including special certifications, assurances, or other administrative actions) when deemed appropriate to protect the welfare of human and animal subjects of research, prevent inappropriate use of Federal funds, or otherwise protect the public interest and safety. (e) Investigating research misconduct. Research institutions, or in limited circumstances discussed in paragraph (d) the DOT Oversight Organization shall use the following procedures to investigate allegations of research misconduct: (1) Inquire promptly into the research misconduct allegation and complete an initial inquiry within 60 calendar days after receipt of the allegation. (2) Notify the Contracting Officer immediately, in writing, when an inquiry results in a determination that an investigation is warranted, and promptly begin an investigation. (3) Ensure the objectivity and expertise of the individuals selected to review allegations and conduct investigations. (4) Conduct the investigation according to established internal procedures and complete it within 120 calendar days of completing the initial inquiry. (5) Document the investigation. Include documentation that— (i) Describes the allegation(s); (ii) Lists the investigators; (iii) Describes the methods and procedures used to gather information and evaluate the allegation(s); (iv) Summarizes the records and data compiled, states the findings, and explains the supporting reasons and evidence; (v) States the potential impact of any research misconduct; and (vi) Describes and explains any institutional sanctions or corrective actions recommended or imposed as appropriate within its jurisdiction and as consistent with other relevant laws. (6) Provide the respondent (the person against whom an allegation of research misconduct has been made) with a reasonable opportunity (e.g., 30 calendar days) to review and respond to the investigation report. The respondent's written comments or rebuttal will be made part of the investigative record. (7) Within 30 calendar days after completion of an investigation, forward investigative reports, documentation, and respondent's response to the Contracting Officer who will coordinate with the DOT oversight organization(s) sponsoring and/or monitoring the federally-funded research. (8) Time extensions. Contractors should request time extensions as needed from the Contracting Officer of the appropriate DOT oversight organization. The Contracting Officer has discretion to waive time requirements for good cause. (f) Activity sanctions or corrective actions. Upon receipt of the investigative reports from the contractor, the DOT oversight organization, in conjunction with the Contracting Officer, will review the report, and determine the appropriate administrative action to be taken. In deciding what actions to take, the oversight organizations should consider: the severity of the misconduct; the degree to which the misconduct was knowing, intentional, or reckless; and whether it was an isolated event or part of a pattern. Sanctions or corrective actions may range as follows— (1) Minimal restrictions—such as a letter of reprimand, additional conditions on awards, requiring third-party certification of accuracy or compliance with particular policies, regulations, guidelines, or special terms and conditions; (2) Moderate restrictions—such as limitations on certain activities or expenditures under an active award or special reviews of requests for funding; or (3) More severe restrictions—such as termination of an active award or government-wide suspension or debarment. (g) Appeals and final administrative action. (1) The Federal Acquisition Regulation governs in all matters pertaining to termination of the contract and suspension/debarment. (2) In all other cases, the Contractor may appeal the sanction or corrective action through the DOT Research and Technology Coordinating Council (RTCC) to the Deputy Secretary of Transportation, in writing within 30 calendar days after receiving written notification of the research misconduct finding and associated administrative action(s). The Contractor shall mail a copy of the appeal to the Contracting Officer. (3) If there is no request for appeal within 30 calendar days, the administrative actions of the oversight organization shall be final. (4) If a request for appeal is received by the RTCC within the 30-calendar day limit, the Deputy Secretary may have the RTCC review the appeal and make recommendations. (5) The RTCC on behalf of the Deputy Secretary will normally inform the appellant of the final decision on an appeal within 60 calendar days of receipt. This decision will then be the final DOT administrative action. (h) Criminal or civil fraud violations. When the DOT oversight organization concludes an investigation with a determination of research misconduct, the DOT Office of the Senior Procurement Executive may notify any other sources of research that provide support to the respondent. If criminal or civil fraud violations may have occurred, the oversight organization should promptly refer the matter to the DOT Inspector General, the Department of Justice or other appropriate investigative body. The DOT oversight organization, in conjunction with the Contracting Officer will notify the respondent in writing of its action, sanctions to be imposed if applicable, and the DOT appeal procedures. (i) Subcontract flowdown. The Contractor shall include the substance of this clause in all subcontracts that involve research. (End of clause)
1252.239-701252.239-70 Security Requirements for Unclassified Information Technology Resources.#
As prescribed in 1239.106-70, insert the following clause: Security Requirements for Unclassified Information Technology Resources (NOV 2022) (a) The Contractor shall be responsible for information technology security for all systems connected to a Department of Transportation (DOT) network or operated by the Contractor for DOT, regardless of location. This clause is applicable to all or any part of the contract that includes information technology resources or services in which the Contractor has physical or electronic access to DOT information that directly supports the mission of DOT. The term “information technology,” as used in this clause, means any equipment or interconnected system or subsystem of equipment, including telecommunications equipment, that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information. This includes both major applications and general support systems as defined by OMB Circular A-130. Examples of tasks that require security provisions include— (1) Hosting of DOT e-Government sites or other IT operations; (2) Acquisition, transmission, or analysis of data owned by DOT with significant replacement cost should the contractor's copy be corrupted; and (3) Access to DOT general support systems/major applications at a level beyond that granted the general public, e.g., bypassing a firewall. (b) The Contractor shall develop, provide, implement, and maintain an IT Security Plan. This plan shall describe the processes and procedures that the Contractor will follow to ensure appropriate security of IT resources developed, processed, or used under this contract. The plan shall describe those parts of the contract to which this clause applies. The Contractor's IT Security Plan shall comply with applicable Federal Laws that include, but are not limited to, 40 U.S.C. 11331, the Federal Information Security Management Act (FISMA) of 2002, and the E-Government Act of 2002. The plan shall meet IT security requirements in accordance with Federal and DOT policies and procedures, as amended during the term of this contract, which include, but are not limited to the following: (1) OMB Circular A-130, Managing Information as a Strategic Resource; (2) National Institute of Standards and Technology (NIST) Guidelines; (3) DOT CIO IT Policy (CIOP) compendium and associated guidelines; (4) DOT Order 1630.2C, Personnel Security Management; and (5) DOT Order 1351.37, Departmental Cyber Security Policy. (c) Within 30 days after contract award, the contractor shall submit the IT Security Plan to the DOT Contracting Officer for review. This plan shall detail the approach contained in the offeror's proposal or sealed bid. Upon acceptance by the Contracting Officer, the Plan shall be incorporated into the contract by contract modification. (d) Within six (6) months after contract award, the Contractor shall submit written proof of IT Security accreditation to the Contracting Officer. Such written proof may be furnished either by the Contractor or by a third party. Accreditation shall be in accordance with DOT policy available from the Contracting Officer upon request. The Contractor shall submit along with this accreditation a final security plan, risk assessment, security test and evaluation, and disaster recovery plan/continuity of operations plan. The accreditation and accompanying documents, to include a final security plan, risk assessment, security test and evaluation, and disaster recovery/continuity of operations plan, upon acceptance by the Contracting Officer, will be incorporated into the contract by contract modification. (e) On an annual basis, the Contractor shall verify in writing to the Contracting Officer that the IT Security Plan remains valid. (f) The Contractor shall ensure that the official DOT banners are displayed on all DOT systems (both public and private) operated by the Contractor that contain Privacy Act information before allowing anyone access to the system. The DOT CIO will make official DOT banners available to the Contractor. (g) The Contractor shall screen all personnel requiring privileged access or limited privileged access to systems operated by the Contractor for DOT or interconnected to a DOT network in accordance with DOT Order 1630.2C Personnel Security Management, as amended. (h) The Contractor shall ensure that its employees performing services under this contract receive annual IT security training in accordance with OMB Circular A-130, FISMA, and NIST requirements, as amended, with a specific emphasis on rules of behavior. (i) The Contractor shall provide the Government access to the Contractor's and subcontractors' facilities, installations, operations, documentation, databases and personnel used in performance of the contract. The Contractor shall provide access to enable a program of IT inspection (to include vulnerability testing), investigation, and audit (to safeguard against threats and hazards to the integrity, availability and confidentiality of DOT data or to the function of information technology systems operated on behalf of DOT), and to preserve evidence of computer crime. (j) The Contractor shall incorporate and flow down the substance of this clause to all subcontracts that meet the conditions in paragraph (a) of this clause. (k) The Contractor shall immediately notify the Contracting Officer when an employee who has access to DOT information systems or data terminates employment. (End of clause)
1252.239-731252.239-73 Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information.#
As prescribed in 1239.7003(b), insert the following clause: Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information (NOV 2022) (a) Definitions. As used in this clause— Compromise means disclosure of information to unauthorized persons, or a violation of the security policy of a system, whereby without authorization information is disclosed, modified, destroyed, lost, or copied to unauthorized media—whether intentionally or unintentionally. DOT sensitive data means unclassified information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies, and is— (1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the Contractor by or on behalf of DOT in support of the performance of the contract; or (2) Collected, developed, received, transmitted, used, or stored by or on behalf of the Contractor in support of the performance of the contract. Cyber incident means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein. Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. Media means physical devices or writing surfaces including, but not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which DOT sensitive data is recorded, stored, or printed within a covered contractor information system. DOT technical information means recorded information, regardless of the form or method of the recording, of a scientific or technical nature (including computer software documentation). The term does not include computer software or data incidental to contract administration, such as financial and/or management information. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code. (b) Restrictions. (1) The Contractor agrees that the following conditions apply to any information it receives or creates in the performance of this contract derived from a third-party's reporting of a cyber incident, pursuant to TAR clause, 1252.239-74, Safeguarding DOT Sensitive Data and Cyber Incident Reporting (or derived from such information obtained under that clause): (2) The Contractor shall access and use the information only for the purpose of furnishing advice or technical assistance directly to the Government in support of the Government's activities related to clause 1252.239-74, Safeguarding DOT Sensitive Data and Cyber Incident Reporting, and shall not be used for any other purpose. (3) The Contractor shall protect the information against unauthorized release or disclosure. (4) The Contractor shall ensure that its employees are subject to use and non-disclosure obligations consistent with this clause prior to the employees being provided access to or use of the information. (5) The third-party contractor that reported the cyber incident is a third-party beneficiary of the non-disclosure agreement between the Government and Contractor, as required by paragraph (b)(3) of this clause. (6) A breach of these obligations or restrictions may subject the Contractor to— (i) Criminal, civil, administrative, and contractual penalties and other appropriate remedies; and (ii) Civil actions for damages and other appropriate remedies by the third party that reported the cyber incident, as a third-party beneficiary of this clause. (c) Subcontract flowdown requirement. The Contractor shall include this clause, including this paragraph (c), in subcontracts, or similar contractual instruments, for services that include support for the Government's activities related to safeguarding covered DOT sensitive data and cyber incident reporting, including subcontracts for commercial products or commercial services, without alteration, except to identify the parties. (End of clause)
1252.239-741252.239-74 Safeguarding DOT Sensitive Data and Cyber Incident Reporting.#
As prescribed in 1239.7003(c), insert the following clause: Safeguarding DOT Sensitive Data and Cyber Incident Reporting (NOV 2022) (a) Definitions. As used in this clause— Adequate security means protective measures that are commensurate with the consequences and probability of loss, misuse, or unauthorized access to, or modification of information against the probability of occurrence. Compromise means disclosure of information to unauthorized persons, or a violation of the security policy of a system, whereby without authorization information is disclosed, modified, destroyed, lost, or copied to unauthorized media—whether intentionally or unintentionally. Contractor attributional/proprietary information means information that identifies the Contractor(s), whether directly or indirectly, by the grouping of information that can be traced back to the Contractor(s) (e.g., program description, facility locations), personally identifiable information, trade secrets, commercial or financial information, or other commercially sensitive information not customarily shared outside of a company. Covered contractor information system means an unclassified information system owned or operated by or for a Contractor and that processes, stores, or transmits DOT sensitive data. DOT sensitive data means unclassified information that requires safeguarding or dissemination controls pursuant to and consistent with law, regulation, and Government-wide policies, and is— (1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the Contractor by or on behalf of DOT in support of the performance of the contract; or (2) Collected, developed, received, transmitted, used, or stored by or on behalf of the Contractor in support of the performance of the contract. Cyber incident means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein. Federal record as defined in 44 U.S.C. 3301, includes all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them. The term Federal record— (1) Includes all DOT records; (2) Does not include personal materials; (3) Applies to records created, received, or maintained by Contractors pursuant to a DOT contract; and (4) May include deliverables and documentation associated with deliverables. Forensic analysis means the practice of gathering, retaining, and analyzing computer-related data for investigative purposes in a manner that maintains the integrity of the data. Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. Malicious software means computer software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system. This definition includes a virus, worm, Trojan horse, or other code-based entity that infects a host, as well as spyware and some forms of adware. Media means physical devices or writing surfaces including, but not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which DOT sensitive data is recorded, stored, or printed within a covered contractor information system. Operationally critical support means supplies or services designated by the Government as critical for airlift, sealift, intermodal transportation services, or logistical support that is essential to the mobilization, deployment, or sustainment of the Armed Forces in a contingency operation. Spillage security incident means an incident that results in the transfer of classified or unclassified information onto an information system not accredited (i.e., authorized) for the appropriate security level. Technical information means recorded information, regardless of the form or method of the recording, of a scientific or technical nature (including computer software documentation). The term does not include computer software or data incidental to contract administration, such as financial and/or management information, regardless of whether or not the clause is incorporated in this solicitation or contract. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code. (b) Adequate security. The Contractor shall provide adequate security on all covered contractor information systems. To provide adequate security, the Contractor shall implement, at a minimum, the following information security protections: (1) For covered Contractor information systems that are part of an information technology (IT) service or system operated on behalf of the Government, the following security requirements apply: (i) Cloud computing services shall be subject to the security requirements specified in the clause 1252.239-76, Cloud Computing Services, of this contract. (ii) Any other such IT service or system (i.e., other than cloud computing) shall be subject to the security requirements specified elsewhere in this contract. (2) For covered Contractor information systems that are not part of an IT service or system operated on behalf of the Government and therefore are not subject to the security requirement specified at paragraph (b)(1) of this clause, the following security requirements apply: (i) Except as provided in paragraph (b)(2)(iv) of this clause, the contractor information system shall be subject to the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, Revision 2, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations” (available via the internet at https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final) in effect at the time the solicitation is issued or as authorized by the Contracting Officer. (ii) The Contractor shall implement NIST SP 800-171, Rev. 2, no later than 30 days after the award of this contract. The Contractor shall notify Contract Officer of any security requirements specified by NIST SP 800-171, Rev. 2 not implemented within 30 days of time of contract award. (iii) If the Offeror proposes to vary from any security requirements specified by NIST SP 800-171, Rev. 2 in effect at the time the solicitation is issued or as authorized by the Contracting Officer, the Offeror shall submit to the Contracting Officer, for consideration by the DOT Chief Information Officer (CIO), a written explanation of— (A) Why a particular security requirement is not applicable; or (B) How the Contractor will use an alternative, but equally effective, security measure to satisfy the requirements of NIST SP 800-171, Rev. 2. (iv) The Office of the DOT CIO will evaluate offeror requests to vary from NIST SP 800-171, Rev. 2 requirements and inform the Offeror in writing of its decision before contract award. The Government will incorporate accepted variance(s) from NIST SP 800-171, Rev. 2 into any resulting contract. (v) The Contractor need not implement any security requirement adjudicated by an authorized representative of the DOT CIO to be nonapplicable, or have an alternative, but equally effective, security measure that may be implemented in its place. (vi) If the DOT CIO has previously adjudicated the contractor's requests indicating that a requirement is not applicable or that an alternative security measure is equally effective, a copy of that approval shall be provided to the Contracting Officer when the Contractor requests its recognition under this contract (3) If the Contractor intends to use an external cloud service provider to store, process, or transmit any DOT sensitive data in performance of this contract, the Contractor shall require and ensure that the cloud service provider meets security requirements equivalent to those established by the Government for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline (https://www.fedramp.gov/resources/documents/) and that the cloud service provider complies with requirements in paragraphs (c) through (h) of this clause for cyber incident reporting, malicious software, media preservation and protection, access to additional information and equipment necessary for forensic analysis, and cyber incident damage assessment. (4) The Contractor will apply other information systems security measures when the Contractor reasonably determines that information systems security measures, in addition to those identified in paragraphs (b)(1) and (b)(2) of this clause, may be required to provide adequate security in a dynamic environment or to accommodate special circumstances (e.g., medical devices) and any individual, isolated, or temporary deficiencies based on an assessed risk or vulnerability. These measures may be addressed in a system security plan, as required by, clause 1252.239-70, Security Requirements for Unclassified Information Technology Resources. (c) Cyber incident reporting requirement. (1) When the Contractor discovers a cyber incident that affects a covered contractor information system or the DOT sensitive data residing therein, or that affects the contractor's ability to perform the requirements of the contract that are designated as operationally critical support and identified in the contract, the Contractor shall— (i) Conduct a review for evidence of compromise of DOT sensitive data, including, but not limited to, identifying compromised computers, servers, specific data, and user accounts. This review shall also include analyzing covered contractor information system(s) that were part of the cyber incident, as well as other information systems on the Contractor's network(s), that may have been accessed as a result of the incident in order to identify compromised DOT sensitive data or whether the incident affects the Contractor's ability to provide operationally critical support; and (ii) Rapidly report cyber incidents to DOT Security Operations Center (SOC) 24x7x365 at phone number: 571-209-3080 (Toll Free: 1-866-580-1852). (d) Cyber incident report. The cyber incident report shall be treated as information created by or for DOT and shall include, at a minimum, the required elements in paragraph (c)(1)(i). (e) Spillage. Upon notification by the Government of a spillage, or upon the Contractor's discovery of a spillage, the Contractor shall cooperate with the Contracting Officer to address the spillage in compliance with DOT policy. (f) Malicious software. When the Contractor or subcontractors discover and isolate malicious software in connection with a reported cyber incident, the Contractor shall submit the malicious software to DOT in accordance with instructions provided by the Contracting Officer. Do not send the malicious software to the Contracting Officer. (g) Media preservation and protection. When a Contractor discovers a cyber incident has occurred, the Contractor shall preserve and protect images of all known affected information systems identified in paragraph (c)(1)(i) of this clause and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DOT to request the media or decline interest. (h) Access to additional information or equipment necessary for forensic analysis. Upon request by DOT, the Contractor shall provide DOT with access to additional information or equipment that is necessary to conduct a forensic analysis. (i) Cyber incident damage assessment activities. If DOT elects to conduct a damage assessment, the Contracting Officer will request that the Contractor provide all of the damage assessment information gathered in accordance with paragraph (c) of this clause. (j) DOT safeguarding and use of Contractor attributional/proprietary information. The Government shall protect against the unauthorized use or release of information obtained from the Contractor (or derived from information obtained from the Contractor) under this clause that includes Contractor attributional/proprietary information, including such information submitted in accordance with paragraph (c). To the maximum extent practicable, the Contractor shall identify and mark attributional/proprietary information. In making an authorized release of such information, the Government will implement appropriate procedures to minimize the Contractor attributional/proprietary information that is included in such authorized release consistent with applicable law. (k) Use and release of Contractor attributional/proprietary information not created by or for DOT. Information that is obtained from the Contractor (or derived from information obtained from the Contractor) under this clause that is not created by or for DOT is authorized to be released outside of DOT— (1) To entities with missions that may be affected by such information; (2) To entities that may be called upon to assist in the diagnosis, detection, or mitigation of cyber incidents; (3) To Government entities that conduct counterintelligence or law enforcement investigations; (4) To a support services contractor (“recipient”) that is directly supporting Government activities under a contract that includes the clause at 1252.239-73, Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information; or (5) With Contractor's consent; or (6) As otherwise required by law. (l) Use and release of Contractor attributional/proprietary information created by or for DOT. Information that is obtained from the Contractor (or derived from information obtained from the Contractor) under this clause that is created by or for DOT (including the information submitted pursuant to paragraph (c) of this clause) is authorized to be used and released outside of DOT for purposes and activities authorized by paragraph (j) of this clause, and for any other lawful Government purpose or activity, subject to all applicable statutory, regulatory, and policy based restrictions on the Government's use and release of such information. (m) The Contractor shall conduct activities under this clause in accordance with applicable laws and regulations on the interception, monitoring, access, use, and disclosure of electronic communications and data. (n) Other safeguarding or reporting requirements. The safeguarding and cyber incident reporting required by this clause in no way abrogates the Contractor's responsibility for other safeguarding or cyber incident reporting pertaining to its unclassified information systems as required by other applicable clauses of this contract, or as a result of other applicable Government statutory or regulatory requirements. (o) Subcontract flowdown requirements. The Contractor shall— (1) Include this clause, including this paragraph (o), in subcontracts, or similar contractual instruments, for operationally critical support, or for which subcontract performance will involve DOT sensitive data, including subcontracts for commercial products and commercial services, without alteration, except to identify the parties. The Contractor shall determine if the information required for subcontractor performance retains its identity as DOT sensitive data and will require protection under this clause, and, if necessary, consult with the Contracting Officer; and (2) Require subcontractors to— (i) Notify the prime Contractor (or next higher-tier subcontractor) when submitting a request to vary from a NIST SP 800-171, Rev. 2 security requirement to the Contracting Officer, in accordance with paragraph (b)(2)(iii) of this clause; and (ii) Provide the incident report number, automatically assigned by DOT, to the prime Contractor (or next higher-tier subcontractor) as soon as practicable, when reporting a cyber incident to DOT as required in paragraph (c) of this clause. (End of clause)
1252.239-751252.239-75 DOT Protection of Information About Individuals, PII, and Privacy Risk Management Requirements.#
As prescribed in 1239.7104, insert the following clause: DOT Protection of Information About Individuals, PII, and Privacy Risk Management Requirements (NOV 2022) (a) Compliance with standards. To the extent Contractor creates, maintains, acquires, discloses, uses, or has access to PII in furtherance of the contract, Contractor shall comply with all applicable Federal law, guidance, and standards and DOT policies pertaining to its protection. Contractor shall notify DOT in writing immediately upon the discovery that Contractor is no longer in compliance with DOT data protection standards with respect to any PII. (b) Unanticipated threats. If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party. (c) Privacy Act. The Contractor will— (1) Comply with the Privacy Act of 1974, 5 U.S.C. 552a, DOT implementing regulations (49 CFR part 10), and DOT policies issued under the Act in the design, development, and/or operation of any system of records on individuals to accomplish a DOT function when the contract specifically identifies the work that the Contractor is to perform. (2) Include the Privacy Act notification contained in this contract in every solicitation and resulting subcontract and in every subcontract awarded without a solicitation, when the work statement in the proposed subcontract requires the redesign, development, and/or operation of a system of records on individuals that is subject to the Act; and (3) Include this clause, including this paragraph (c), in all subcontracts awarded under this contract which requires the design, development, and/or operation of such a system of records. (d) Privacy Act records. The Contractor shall not release records subject to the Privacy Act except by the direction of the DOT, regardless of whether DOT or the Contractor maintains the records. (e) Confidentiality agreement. Contractor agrees to execute a confidentiality agreement protecting PII, when necessary, and further agrees not to appropriate such PII for its own use or to disclose such information to third parties unless specifically authorized by DOT in writing. (f) Surrender of records. If at any time during the term of the Contract any part of PII, in any form, that Contractor obtains from or on behalf of DOT ceases to be required by Contractor for the performance of its obligations under the Contract, or upon termination of the Contract, whichever occurs first, Contractor shall, within ten (10) business days, notify DOT and securely return such PII to DOT, or, at DOT's written request destroy, un-install and/or remove all copies of such PII in Contractor's possession or control, or such part of the PII which relates to the part of the Contract which is terminated, or the part no longer required, as appropriate, and certify to DOT that the requested action has been completed. (g) NIST FIPS 140-2. At a minimum, the Contractor shall protect all PII created, collected, used, maintained, or disseminated on behalf of the Department using controls consistent with Federal Information Processing Standard Publication 199 (FIPS 199) moderate confidentiality standards, unless otherwise authorized by the DOT Chief Privacy Officer. (h) Protection of sensitive information. The Contractor shall comply with Government and DOT guidance for protecting PII. (i) Breach. The Contractor shall bear all costs, losses, and damages resulting from the Contractor's breach of these clauses. Contractor agrees to release, defend, indemnify, and hold harmless DOT for claims, losses, penalties, and damages and costs to the extent arising out of Contractor's, or its subcontractor's, negligence, unauthorized use or disclosure of PII and/or Contractor's, or its subcontractor's, breach of its obligations under these clauses. (j) Breach reporting. Contractors shall report breaches involving PII directly to DOT at (202) 385-4357 or 1-(866)-466-5221 within two (2) hours of discovery. Contractor shall provide the incident number automatically assigned by DOT for all breaches reported by the Contractor or any subcontractors to the Contracting Officer. (k) Applicability. Contractor shall inform all principals, officers, employees, agents and subcontractors engaged in the performance of this contract of the obligations contained in these clauses. (l) Training. To the extent necessary and/or required by law, the Contractor shall provide training to employees, agents, and subcontractors to promote compliance with these clauses. The Contractor is liable for any breach of these clauses by any of its principals, officers, employees, agents, and subcontractors. (m) Subcontractor engagement. When the Contractor engages a subcontractor in connection with its performance under the contract, and the Contractor provides such subcontractor access to PII, the Contractor shall provide the Contracting Officer with prompt notice of the identity of the subcontractor and the extent of the role that the subcontractor will play in connection with the performance of the contract. This obligation is in addition to any limitations of subcontracting and consent to subcontract requirements identified elsewhere in the clauses and provisions of this contract. (n) Subcontract flowdown requirements. Contractors shall flow down this clause to all subcontracts and purchase orders or other agreements and require that subcontractors incorporate this clause in their subcontracts, appropriately modified for identification of the parties. The Contractor shall enforce the terms of the clause, including action against its subcontractors, their employees and associates, or third-parties, for noncompliance. All subcontractors given access to any PII must agree to— (1) Abide by the clauses set forth herein, including, without limitation, provisions relating to compliance with data privacy standards for the Protection of Data about Individuals, Breach Notification Controls, and Notice of Security and/or Privacy Incident; (2) Restrict use of PII only for subcontractor's internal business purposes and only as necessary to render services to Contractor in connection with Contractor's performance of its obligations under the contract; (3) Certify in writing, upon completion of services provided by a subcontractor, that the subcontractor has returned to the Contractor all records containing PII within 30 days of subcontractor's completion of services to Contractor. Failure of subcontractor to return all records containing PII within this period will be reported to DOT as a privacy incident; and (4) Report breaches involving PII directly to DOT at (202) 385-4357 or 1-(866)-466-5221 within two (2) hours of discovery. Subcontractors shall provide the incident report number automatically assigned by DOT to the prime contractor. Lower-tier subcontractors, likewise, shall report the incident report number automatically assigned by DOT to their higher-tier subcontractor until the prime contractor is reached. Contractor shall provide the DOT incident number to the Contracting Officer. (End of clause)
1252.239-761252.239-76 Cloud Computing Services.#
As prescribed in 1239.7204(a), insert the following clause: Cloud Computing Services (NOV 2022) (a) Definitions. As used in this clause— Authorizing official, as described in Appendix B of DOT Order 1350.37, Departmental Cybersecurity Policy, means the senior Federal official or executive with the responsibility for operating an information system at an acceptable level of risk to organizational operations (including mission, functions, image, or reputation), organizational assets, individuals, other organizations, and the Nation. Cloud computing means a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This includes other commercial terms, such as on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. It also includes commercial offerings for software-as-a-service, infrastructure-as-a-service, and platform-as-a-service. Compromise means disclosure of information to unauthorized persons, or a violation of the security policy of a system, whereby without authorization information is disclosed, modified, destroyed, lost, or copied to unauthorized media—whether intentionally or unintentionally. Cyber incident means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein. Government data means any information, document, media, or material regardless of physical form or characteristics, that is created or obtained by the Government in the course of official Government business. Government-related data means any information, document, media, or material regardless of physical form or characteristics that is created or obtained by a Contractor through the storage, processing, or communication of Government data. This does not include contractor's business records e.g., financial records, legal records etc. or data such as operating procedures, software coding, or algorithms that are not uniquely applied to the Government data. Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. Media means physical devices or writing surfaces including, but not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which information is recorded, stored, or printed within an information system. Spillage security incident means an incident that results in the transfer of classified information onto an information system not accredited (i.e., authorized) for the appropriate security level. (b) Cloud computing security requirements. The requirements of this clause are applicable when using cloud computing to provide information technology services in the performance of the contract. (1) If the Contractor indicated in its offer that it does not anticipate the use of cloud computing services in the performance of a resultant contract, and after the award of this contract, the Contractor proposes to use cloud computing services in the performance of the contract, the Contractor shall obtain approval from the Contracting Officer prior to utilizing cloud computing services in performance of the contract. (2) The Contractor shall implement and maintain administrative, technical, and physical safeguards and controls with the security level and services required in accordance with the DOT Order 1351.37, Departmental Cybersecurity Policy, and the requirements of DOT Order 1351.18, Departmental Privacy Risk Management Policy (the versions of each that in effect at the time the solicitation is issued or as authorized by the Contracting Officer), unless notified by the Contracting Officer that this requirement has been waived by the DOT Chief Information Officer. (3) The Contractor shall maintain all Government data not physically located on DOT premises within the United States, the District of Columbia, and all territories and possessions of the United States, unless the Contractor receives written notification from the Contracting Officer to use another location, in accordance with DOT Policy. (4) DOT will determine the security classification level for the cloud system in accordance with Federal Information Processing Standard 199; the Contractor will then apply the appropriate set of impact baseline controls as required in the FedRAMP Cloud Computing Security Requirements Baseline document to ensure compliance with security standards. The FedRAMP baseline controls are based on NIST Special Publication 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations, Security Control Baselines and also includes a set of additional controls for use within systems providing cloud services to the Federal government. (5) The Contractor shall maintain a security management continuous monitoring environment that meets or exceeds the requirements in the Reporting and Continuous Monitoring section of this contract/task order ___ [Fill-in: Contracting Officer enter the requirements document paragraph reference number] based upon the latest edition of FedRAMP Cloud Computing Security Requirements Baseline and FedRAMP Continuous Monitoring Requirements. (6) The Contractor shall be responsible for the following privacy and security safeguards: (i) To the extent required to carry out the FedRAMP assessment and authorization process and FedRAMP continuous monitoring, to safeguard against threats and hazards to the security, integrity, and confidentiality of any non-public Government data collected and stored by the Contractor, the Contractor shall provide the Government access to the Contractor's facilities, installations, technical capabilities, operations, documentation, records, and databases. (ii) The Contractor shall also comply with any additional FedRAMP and DOT Orders containing cybersecurity and privacy policies. (7) The Government may perform manual or automated audits, scans, reviews, or other inspections of the vendor's IT environment being used to provide or facilitate services for the Government. In accordance with the Federal Acquisition Regulation (FAR) clause 52.239-1, Privacy or Security Safeguards, the Contractor shall provide the Government access to Contractor's facilities, installations, technical capabilities, operations, documentation, records and databases to carry out a program of inspection. Contractors shall provide access within two hours of notification by the Government. The program of inspection shall include, but is not limited to— (i) Authenticated and unauthenticated operating system/network vulnerability; scans; (ii) Authenticated and unauthenticated web application vulnerability scans; (iii) Authenticated and unauthenticated database application vulnerability scans; and (8) Automated scans can be performed by Government personnel, or agents acting on behalf of the Government, using Government operated equipment, and Government specified tools. (9) If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party. (10) If the vendor chooses to run its own automated scans or audits, results from these scans may, at the Government's discretion, be accepted in lieu of Government performed vulnerability scans. In these cases, the Government will approve scanning tools and their configuration. In addition, the Contractor shall provide complete results of vendor-conducted scans to the Government. (c) Limitations on access to and use and disclosure of Government data and Government-related data. (1) The Contractor shall not access, use, or disclose Government data unless specifically authorized by the terms of this contract or a task order or delivery order issued hereunder. (i) If authorized by the terms of this contract or a task order or delivery order issued hereunder, any access to, or use or disclosure of, Government data shall only be for purposes specified in this contract or task order or delivery order. (ii) The Contractor shall ensure that its employees are subject to all such access, use, and disclosure prohibitions and obligations. (iii) These access, use, and disclosure prohibitions and obligations shall survive the expiration or termination of this contract. (2) The Contractor shall use Government-related data only to manage the operational environment that supports the Government data and for no other purpose unless otherwise permitted with the prior written approval of the Contracting Officer. (d) Cloud computing services cyber incident reporting. The Contractor shall report all cyber incidents related to the cloud computing service provided under this contract. to DOT via the DOT Security Operations Center (SOC) 24 hours-a-day, 7 days-a-week, 365 days a year (24x7x365) at phone number: 571-209-3080 (Toll Free: 866-580-1852) within 2 hours of discovery. (e) Spillage. Upon notification by the Government of a spillage, or upon the Contractor's discovery of a spillage, the Contractor shall cooperate with the Contracting Officer to address the spillage in compliance with agency procedures. (f) Malicious software. The Contractor or subcontractor(s) that discovers and isolates malicious software in connection with a reported cyber incident shall submit the malicious software in accordance with instructions provided by the Contracting Officer. (g) Media preservation and protection. When a Contractor discovers a cyber incident has occurred, the Contractor shall preserve and protect images of all known affected information systems identified in the cyber incident report (see paragraphs (b)(5) and (d) of this clause) and all relevant monitoring/packet capture data for at least 90 days from the submission of the cyber incident report to allow DOT to request the media or decline interest. (h) Access to additional information or equipment necessary for forensic analysis. Upon request by DOT, the Contractor shall provide DOT with access to additional information or equipment that is necessary to conduct a forensic analysis. (i) Cyber incident damage assessment activities. If DOT elects to conduct a damage assessment, the Contracting Officer will request that the Contractor provide all of the damage assessment information gathered in accordance with paragraph (b)(7) of this clause. (j) Subcontract flowdown requirement. The Contractor shall include this clause, including this paragraph (j), in all subcontracts that involve or may involve cloud services, including subcontracts for commercial products or commercial services. (End of clause)
1252.239-911252.239-91 Records Management.#
As prescribed in 1239.7403, insert the following clause: Records Management (NOV 2022) (a) Definition. Federal record, as defined in 44 U.S.C. 3301, means all recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them. The term Federal record: (1) Includes all DOT records. (2) Does not include personal materials. (3) Applies to records created, received, or maintained by Contractors pursuant to a DOT contract. (4) May include deliverables and documentation associated with deliverables. (b) Requirements. (1) Compliance. Contractor shall comply with all applicable records management laws and regulations, as well as National Archives and Records Administration (NARA) records policies, including but not limited to 44 U.S.C. chapters 21, 29, 31, and 33, NARA regulations at 36 CFR chapter XII, subchapter B, and those policies associated with the safeguarding of records covered by Privacy Act of 1974 (5 U.S.C. 552a). These policies include the preservation of all records, regardless of form or characteristics, mode of transmission, or state of completion. (2) Applicability. In accordance with 36 CFR 1222.32, all data created for Government use and delivered to, or falling under, the legal control of the Government, are Federal records subject to the provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy Act of 1974 (5 U.S.C. 552a), as amended. Such Federal records shall be managed and scheduled for disposition only as permitted by the Federal Records Act, other relevant statutes or regulations, and DOT Order 1351.28, Departmental Records Management Policy. (3) Records maintenance. While DOT records are in the Contractor's custody, the Contractor is responsible for preventing the alienation or unauthorized destruction of DOT records, including all forms of mutilation. Records may not be removed from the legal custody of DOT or destroyed except in accordance with the provisions of the agency records schedules and with the written concurrence of the DOT or Component Records Officer, as appropriate. Willful and unlawful destruction, damage or alienation of Federal records is subject to the fines and penalties imposed by 18 U.S.C. 2701. In the event of any unlawful or accidental removal, defacing, alteration, or destruction of records, the Contractor must report the event to the Contracting Officer in accordance with 36 CFR part 1230, Unlawful or Accidental Removal, Defacing, Alteration, or Destruction of Records, for reporting to NARA. (4) Unauthorized disclosure. The Contractor shall notify the Contracting Officer within two hours of discovery of any inadvertent or unauthorized disclosures of information, data, documentary materials, records or equipment. Disclosure of non-public information is limited to authorized personnel with a need-to-know as described in the contract. The Contractor shall ensure that the appropriate personnel, administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, documentary material, records and/or equipment. The Contractor shall not remove material from Government facilities or systems, or facilities or systems operated or maintained on the Government's behalf, without the express written permission of the Contracting Officer. When information, data, documentary material, records and/or equipment is no longer required, it shall be returned to DOT control or the Contractor must hold it until otherwise directed. Items returned to the Government shall be hand carried, mailed, emailed, or securely electronically transmitted to the Contracting Officer or address prescribed in the contract. Destruction of records is expressly prohibited unless in accordance with the contract. (c) Non-public information. The Contractor shall not create or maintain any records containing any non-public DOT information that are not specifically authorized by the contract. (d) Rights in data. Rights in data under this contract are set forth in clauses prescribed by FAR part 27 and included in this contract, (e.g., 52.227-14 Rights in Data—General). The Contractor must make any assertion of copyright in the data or other deliverables under this contract and substantiate such assertions. The Contractor must add or correct all limited rights, restricted rights, or copyright notices and take all other appropriate actions in accordance with the terms of this contract and the clauses included herein. (e) Notification of third-party access requests. The Contractor shall notify the Contracting Officer promptly of any requests from a third party for access to Federal records, including any warrants, seizures, or subpoenas it receives, including those from another Federal, State, or local agency. The Contractor shall cooperate with the Contracting Officer to take all measures to protect Federal records, from any unauthorized disclosure. (f) Training. All Contractor employees assigned to this contract who create, work with, or otherwise handle records are required to take DOT-provided records management training. The Contractor is responsible for confirming to the Contracting Officer that training, including initial training and any annual or refresher training, has been completed in accordance with agency policies. (g) Subcontract flowdown requirements. (1) The Contractor shall incorporate the substance of this clause, its terms and requirements including this paragraph (g), in all subcontracts under this contract, and require written subcontractor acknowledgment of same. (2) Violation by a subcontractor of any provision set forth in this clause will be attributed to the Contractor. (End of clause)