Assessing Contractor Implementation of Cybersecurity Requirements

ICR 202009-0750-001

OMB: 0750-0004

Federal Form Document

Forms and Documents
Document
Name
Status
No forms / supporting documents in this ICR. Check IC Document Collections.
IC Document Collections
IC ID
Document
Title
Status
243651
New
243645
New
243644
New
ICR Details
0750-0004 202009-0750-001
Historical Inactive
DOD/DARC
Assessing Contractor Implementation of Cybersecurity Requirements
New collection (Request for a new OMB Control Number)   No
Emergency 09/18/2020
Preapproved 09/17/2020
Retrieve Notice of Action (NOA) 09/17/2020
After 6 months this collection will expire and DoD will need to publish a 60 and 30 day notice.
  Inventory as of this Action Requested Previously Approved
03/31/2021 6 Months From Approved
13,378 0 0
57,601 0 0
6,727,155 0 0

DoD has a requirement to collect information from offerors and contractors regarding the status of their implementation of implement the 110 system security requirements identified in the National Institute of Standards and Technology Special Publication (NIST SP) 800-171 on their information systems that process controlled unclassified information (CUI). This information is being collected through either a contractor’s submission of a Basic self-assessment in DoD’s Supplier Performance Risk System, or a Medium or High assessment of contractors conducted by DoD assessors. Results of a NIST SP 800-171 DoD Assessment reflect the net effect of NIST SP 800-171 security requirements not yet implemented by a contractor.
This collection of information is needed prior to the expiration of the time periods normally associated with a routine submission for review under the provisions of the Paperwork Reduction Act, to enable the Department to immediately begin assessing the current status of contractor implementation of NIST SP 800-171 on their information systems that process CUI. Defense contractors have not fully or consistently implemented the NIST SP 800-171 security requirements on their covered information systems. Authorizing collection of this information on the effective date will motivate defense contractors and subcontractors who have not yet implemented existing NIST SP 800-171 security requirements, to take actions to implement the system security requirements on covered information systems that process controlled unclassified information. The aggregate loss of sensitive controlled unclassified information and intellectual property from the DIB sector could undermine U.S. technological advantages and increase risk to DoD missions.

US Code: 41 USC 1303 Name of Law: null
  
None

0750-AK81 Final or interim final rulemaking

No

3
IC Title Form No. Form Name
Basic Assessment
Medium Assessment
High Assessment

  Total Request Previously Approved Change Due to New Statute Change Due to Agency Discretion Change Due to Adjustment in Estimate Change Due to Potential Violation of the PRA
Annual Number of Responses 13,378 0 0 13,378 0 0
Annual Time Burden (Hours) 57,601 0 0 57,601 0 0
Annual Cost Burden (Dollars) 6,727,155 0 0 6,727,155 0 0
Yes
Changing Regulations
No
DoD is issuing an interim rule amending the DFARS to implement to NIST SP 800-171 DoD Strategic Assessment Methodology. The rule provides a new solicitation provision and contract clause for use in all acquisitions, excluding those exclusively for commercially available off-the-shelf items. Per the new provision, offerors that are required to have implemented NIST SP 800-171 per DFARS clause 252.204-7012, must have at minimum a current "Basic" self-assessment for each covered contractor information system in order to be considered for award. Per the new contract clause, if necessary, certain contractors may be required to provide documentation and demonstrate their implementation of the cyber security requirements during a "Medium" or "High" assessment conducted by DoD assessors

$9,536,160
No
    No
    No
No
No
No
No
Jennifer Hawes 571 372-6115 jennifer.l.hawes2.civ@mail.mil

  No

On behalf of this Federal agency, I certify that the collection of information encompassed by this request complies with 5 CFR 1320.9 and the related provisions of 5 CFR 1320.8(b)(3).
The following is a summary of the topics, regarding the proposed collection of information, that the certification covers:
 
 
 
 
 
 
 
    (i) Why the information is being collected;
    (ii) Use of information;
    (iii) Burden estimate;
    (iv) Nature of response (voluntary, required for a benefit, or mandatory);
    (v) Nature and extent of confidentiality; and
    (vi) Need to display currently valid OMB control number;
 
 
 
If you are unable to certify compliance with any of these provisions, identify the item by leaving the box unchecked and explain the reason in the Supporting Statement.
09/17/2020


© 2024 OMB.report | Privacy Policy