administration regulations, international traffic in arms regulations, and munitions list; license applications; and sensitive nuclear technology information. (iv) Any other information, marked or otherwise identified in the contract, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies (e.g., privacy, proprietary business information). system” means a discrete set of information resources organized for “Information the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. [“Media” means physical devices or writing surfaces including, but not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which covered defense information is recorded, stored, or printed within a covered contractor information system.] critical support’’ means supplies or services designated by the ‘‘Operationally Government as critical for airlift, sealift, intermodal transportation services, or logistical support that is essential to the mobilization, deployment, or sustainment of the Armed Forces in a contingency operation. report(ing)” means within 72 hours of discovery of any cyber incident. “Rapid(ly) * * * * * 204.7302 Policy. (a) DoD and its c[C]ontractors and subcontractors will [are required to ]provide adequate security [on all covered contractor information systems] to safeguard covered defense information on their unclassified information systems from unauthorized access and disclosure. (1) Contractors and subcontractors are required to submit to DoD— (i) A cyber incident report; (ii) Malicious software, if detected and isolated; and (iii) (or access to covered contractor information systems and equipment) upon request. (2) Contracting officers shall refer to (a)(1)(ii) for instructions on contractor submissions of media and malicious software. (b) are required to rapidly report cyber [Contractors and s]Subcontractors incidents directly to DoD at http://dibnet.dod.mil and to the prime contractor. Subcontractors shall provide the incident report number from [automatically assigned by] DoD to the prime contractor. Lower-tier subcontractors are required to likewise report the same information [incident report number automatically assigned by DoD] to their higher-tier subcontractor, until the prime contractor is reached. [(1) If a cyber incident occurs, contractors and subcontractors
administration regulations, international traffic in arms regulations, and munitions list; license applications; and sensitive nuclear technology information. (iv) Any other information, marked or otherwise identified in the contract, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Governmentwide policies (e.g., privacy, proprietary business information). “Information system” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. [“Media” means physical devices or writing surfaces including, but not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which covered defense information is recorded, stored, or printed within a covered contractor information system.] ‘‘Operationally critical support’’ means supplies or services designated by the Government as critical for airlift, sealift, intermodal transportation services, or logistical support that is essential to the mobilization, deployment, or sustainment of the Armed Forces in a contingency operation. “Rapid(ly) report(ing)” means within 72 hours of discovery of any cyber incident. * * * * * 204.7302 Policy. (a) DoD and its c[C]ontractors and subcontractors will [are required to ]provide adequate security [on all covered contractor information systems] to safeguard covered defense information on their unclassified information systems from unauthorized access and disclosure. (1) Contractors and subcontractors are required to submit to DoD— (i) A cyber incident report; (ii) Malicious software, if detected and isolated; and (iii) (or access to covered contractor information systems and equipment) upon request. (2) Contracting officers shall refer to (a)(1)(ii) for instructions on contractor submissions of media and malicious software. (b) [Contractors and s]Subcontractors are required to rapidly report cyber incidents directly to DoD at http://dibnet.dod.mil and to the prime contractor. Subcontractors shall provide the incident report number from [automatically assigned by] DoD to the prime contractor. Lower-tier subcontractors are required to likewise report the same information [incident report number automatically assigned by DoD] to their higher-tier subcontractor, until the prime contractor is reached. [(1) If a cyber incident occurs, contractors and subcontractors
2013-D018%20(f)%20DFARS%20Text%20LILO%2020161013%20rev.docx