Assessing Contractor Implementation of Cybersecurity Requirements

ICR 202010-0750-001

OMB: 0750-0004

Federal Form Document

Forms and Documents
Document
Name
Status
Supporting Statement A
2020-09-17
Supplementary Document
2020-09-17
Supplementary Document
2020-09-17
Supplementary Document
2020-09-17
IC Document Collections
IC ID
Document
Title
Status
243651
New
243645
New
243644
New
ICR Details
0750-0004 202010-0750-001
Active 202009-0750-001
DOD/DARC
Assessing Contractor Implementation of Cybersecurity Requirements
New collection (Request for a new OMB Control Number)   No
Regular
Approved without change 10/07/2020
Retrieve Notice of Action (NOA) 10/07/2020
After 6 months this collection will expire and DoD will need to publish a 60 and 30 day notice.
  Inventory as of this Action Requested Previously Approved
04/30/2021 6 Months From Approved
13,378 0 0
57,601 0 0
6,727,155 0 0

DoD has a requirement to collect information from offerors and contractors regarding the status of their implementation of implement the 110 system security requirements identified in the National Institute of Standards and Technology Special Publication (NIST SP) 800-171 on their information systems that process controlled unclassified information (CUI). This information is being collected through either a contractor’s submission of a Basic self-assessment in DoD’s Supplier Performance Risk System, or a Medium or High assessment of contractors conducted by DoD assessors. Results of a NIST SP 800-171 DoD Assessment reflect the net effect of NIST SP 800-171 security requirements not yet implemented by a contractor.

US Code: 41 USC 1303 Name of Law: null
  
None

0750-AK81 Final or interim final rulemaking 85 FR 61505 09/29/2020

No

3
IC Title Form No. Form Name
Basic Assessment
Medium Assessment
High Assessment

  Total Approved Previously Approved Change Due to New Statute Change Due to Agency Discretion Change Due to Adjustment in Estimate Change Due to Potential Violation of the PRA
Annual Number of Responses 13,378 0 0 13,378 0 0
Annual Time Burden (Hours) 57,601 0 0 57,601 0 0
Annual Cost Burden (Dollars) 6,727,155 0 0 6,727,155 0 0
Yes
Changing Regulations
No
DoD is issuing an interim rule amending the DFARS to implement to NIST SP 800-171 DoD Strategic Assessment Methodology. The rule provides a new solicitation provision and contract clause for use in all acquisitions, excluding those exclusively for commercially available off-the-shelf items. Per the new provision, offerors that are required to have implemented NIST SP 800-171 per DFARS clause 252.204-7012, must have at minimum a current "Basic" self-assessment for each covered contractor information system in order to be considered for award. Per the new contract clause, if necessary, certain contractors may be required to provide documentation and demonstrate their implementation of the cyber security requirements during a "Medium" or "High" assessment conducted by DoD assessors

$9,536,160
No
    No
    No
No
No
No
No
Jennifer Hawes 571 372-6115 jennifer.l.hawes2.civ@mail.mil

  No

On behalf of this Federal agency, I certify that the collection of information encompassed by this request complies with 5 CFR 1320.9 and the related provisions of 5 CFR 1320.8(b)(3).
The following is a summary of the topics, regarding the proposed collection of information, that the certification covers:
 
 
 
 
 
 
 
    (i) Why the information is being collected;
    (ii) Use of information;
    (iii) Burden estimate;
    (iv) Nature of response (voluntary, required for a benefit, or mandatory);
    (v) Nature and extent of confidentiality; and
    (vi) Need to display currently valid OMB control number;
 
 
 
If you are unable to certify compliance with any of these provisions, identify the item by leaving the box unchecked and explain the reason in the Supporting Statement.
09/17/2020


© 2024 OMB.report | Privacy Policy