48 CFR Part 1239 — Acquisition of Information Technology

PART 1239—ACQUISITION OF INFORMATION TECHNOLOGY Authority: 5 U.S.C. 301; 41 U.S.C. 1121(c)(3); 41 U.S.C. 1702; and 48 CFR 1.301 through 1.304. Source: 87 FR 61159, Oct. 7, 2022, unless otherwise noted. 1239.000 Scope of part. In addition to FAR 39.000, this part prescribes acquisition policies and procedures for use in acquiring information technology and information technology-related supplies, services and systems, including information security, to include— (a) Software management and development; (b) Section 508 standards and compliance for contracts; (c) Information security and incident response reporting; (d) Protection of data about individuals; (e) Cloud computing; (f) Technology modernization and upgrade/refreshment; and (g) Record management. 1239.002 Definitions. As used in this part— Information Information system Media Subpart 1239.1—General 1239.101 Policy. 1239.101-70 Policy—software management and development. 1239.101-71 Scope. This subpart applies to all acquisitions of products or services supporting the development or maintenance of software. 1239.101-72 Definitions. As used in this subpart— Application Programming software Software System software 1239.101-73 Policy. The contracting officer will ensure all documents involving the acquisition of products or services supporting the development or maintenance of DOT software applications, systems, infrastructure, and services contain the appropriate clauses as may be required by Federal Acquisition Regulation (FAR) and other Federal authorities, in order to ensure that information system modernization is prioritized accordance with Federal law, OMB Guidance, and DOT policy. 1239.106-70 Contract clauses. The contracting officer shall insert the clause at 1252.239-70, Security Requirements for Unclassified Information Technology Resources, and the clause at 1252.239-71, Information Technology Security Plan and Accreditation, in all solicitations and contracts exceeding the micro-purchase threshold that include information technology services. Subpart 1239.2—Information and Communication Technology 1239.201 Scope of subpart. This subpart applies to the acquisition of Information and Communication Technology (ICT) supplies and services. It concerns the access to and use of information and data, by both Federal employees with disabilities, and members of the public with disabilities in accordance with FAR 39.201. This subpart implements DOT policy on section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as it applies to contracts and acquisitions. 1239.203 Applicability. (a) Solicitations for information and communication technology supplies and services may require submission of a section 508 Checklist available at https://www.section508.gov/sell/vpat. 1239.203-70 Information and communication technology accessibility standards—contract clause and provision. (a) The contracting officer shall insert the provision at 1252.239-92, Information and Communication Technology Accessibility Notice, in all solicitations. (b) The contracting officer shall insert the clause at 1252.239-93, Information and Communication Technology Accessibility, in all contracts and orders. Subpart 1239.70—Information Security and Incident Response Reporting 1239.7000 Scope of subpart. (a) This subpart applies to contracts and subcontracts requiring contractors and subcontractors to safeguard DOT sensitive data that resides in or transits through covered contractor information systems by applying specified network security requirements. It also requires reporting of cyber incidents. (b) This subpart does not abrogate any other requirements regarding contractor physical, personnel, information, technical, or general administrative security operations governing the protection of unclassified information, nor does it affect requirements of the National Industrial Security Program. 1239.7001 Definitions. As used in this subpart— Adequate security Contractor attributional/proprietary information e.g., Contractor information system Cyber incident DOT sensitive data (1) Marked or otherwise identified in the contract, task order, or delivery order and provided to the contractor by or on behalf of DOT in support of the performance of the contract; or (2) Collected, developed, received, transmitted, used, or stored by or on behalf of the contractor in support of the performance of the contract. Rapidly report Technical information 1239.7002 Policy. (a) Contractors and subcontractors are required to provide adequate security on all contractor information systems that will collect, use, process, store, or disseminate DOT sensitive data. (b) Contractors and subcontractors shall report cyber incidents directly to DOT via the DOT Security Operations Center (SOC) 24 hours-a-day, 7 days-a-week, 365 days a year (24x7x365) at phone number: 571-209-3080 (Toll Free: 866-580-1852) within two (2) hours of discovery. Subcontractors will provide to the prime contractor the incident report number automatically assigned by DOT. Lower-tier subcontractors likewise report the incident report number automatically assigned by DOT to their higher-tier subcontractor, until the prime contractor is reached. (c) If a cyber incident occurs, contractors and subcontractors shall submit to DOT, in accordance with the instructions contained in the clause at 1252.239-74, Safeguarding DOT Sensitive Data and Cyber Incident Reporting— (1) A cyber incident report; (2) The malicious software, if detected and isolated; and (3) The medium or media (or access to covered contractor information systems and equipment) upon request. (d) Notwithstanding the requirement in this subpart for the reporting of cyber incidents, if existing safeguards have ceased to function or the Government or Contractor discovers new or unanticipated threats or hazards, the discoverer shall immediately bring the situation to the attention of the other party. (1) Information shared by the contractor may include contractor attributional/proprietary information. The Government will protect against the unauthorized use or release of information that includes contractor attributional/proprietary information. (2) A cyber incident that is reported by a contractor or subcontractor shall not, by itself, be interpreted as evidence that the contractor or subcontractor has failed to provide adequate security on their covered contractor information systems, or has otherwise failed to meet the requirements of the clause at 1252.239-74, Safeguarding DOT Sensitive Data and Cyber Incident Reporting. When a cyber incident is reported, the contracting officer shall consult with the DOT component Chief Information Officer/cyber security office prior to assessing contractor compliance ( see (3) Support services contractors directly supporting Government activities related to safeguarding DOT sensitive data and cyber incident reporting ( e.g., 1239.7003 Contract clauses. (a) The contracting officer shall insert the clause at 1252.239-72, Compliance with Safeguarding DOT Sensitive Data Controls, in all solicitations, including solicitations using FAR part 12 procedures for the acquisition of commercial products and commercial services, except for solicitations solely for the acquisition of commercially available off-the-shelf (COTS) items. (b) The contracting officer shall insert clause at 1252.239-73, Limitations on the Use or Disclosure of Third-Party Contractor Reported Cyber Incident Information, in all solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial products and commercial services, for commercial services that include support for the Government's activities related to safeguarding DOT sensitive data and cyber incident reporting. (c) The contracting officer shall insert clause at 1252.239-74, Safeguarding DOT Sensitive Data and Cyber Incident Reporting, in all solicitations and contracts, including solicitations and contracts using FAR part 12 procedures for the acquisition of commercial products and commercial services, except for solicitations and contracts solely for the acquisition of COTS items. Subpart 1239.71—Protection of Data About Individuals 1239.7100 Scope of subpart. This subpart includes Privacy Act and data protection considerations for DOT contracts. Data protection requirements are in addition to provisions concerning the general protection of individual privacy ( see see 1239.7101 Definitions. As used in this subpart— Breach Data protection Information security (1) Integrity, (2) Confidentiality, (3) Availability, Personally Identifiable Information Privacy incident 1239.7102 Policy. DOT must ensure that data protection is provided for information and information systems in accordance with current policies, procedures, and statutes, including: (a) The Clinger-Cohen Act. (b) The E-Government Act. (c) Federal Information Systems Modernization Act. (d) Federal Information Processing Standards. (e) OMB Circular A-130, Managing Information as a Strategic Resource. (f) 49 CFR part 10, Maintenance of and Access to Records Pertaining to Individuals. (g) DOT Order 1351.18, Privacy Risk Management Policy. (h) DOT Order 1351.19, PII Breach Notification Controls. (i) DOT Order 1351.28, Records Management. (j) DOT Order 1351.37, Departmental Cyber Security Policy. 1239.7103 Responsibilities. (a) The contracting officer will include appropriate data protection requirements in all contracts and other acquisition-related documents for DOT information created, collected, displayed, used, processed, stored, transmitted, and disposed of by contractors. (b) The contracting officer will ensure all contracts with contractors maintaining information systems containing PII contain the appropriate clauses as may be required by the Federal Acquisition Regulation (FAR) and other OMB and agency memorandums and directives, to ensure that PII under the control of the contractor is maintained in accordance with Federal law and DOT policy. (c) The contracting officer and assigned contracting officer's representatives and program and project managers will obtain contractual assurances from third parties working on official DOT business that third parties will protect PII in a manner consistent with the privacy practices of the Department during all phases of the system development lifecycle. (d) Program and project managers and requiring activities will address the need to protect information about individuals and/or PII in the statement of work (SOW), performance work statement (PWS) or statement of objectives (SOO). Contracting officers will notify the appropriate organization or office when it intends to issue a solicitation for items or services requiring access to personal information or PII. Contracting officers will identify the Component Privacy Officer as the point of contact for oversight of privacy protection and identify the Component Information Systems Security Manager for the component for oversight of information security to the contractor after award. (e) See 1252.239-75, DOT Protection of Information about Individuals, PII and Privacy Risk Management Requirements, for additional information regarding the requirements of DOT Order 1351.18, Privacy Risk Management Policy and DOT Order 1351.37, Departmental Cyber Security Policy. 1239.7104 Contract clause. The contracting officer shall insert the clause at 1252.239-75, DOT Protection of Information About Individuals, PII and Privacy Risk Management Requirements, in solicitations and contracts involving contractor performance of data protection functions and for contracts involving the design, development, or operation of an information system with access to personally identifiable information as described in DOT Order 1351.18, Privacy Risk Management, and DOT Order 1351.37, Departmental Cyber Security Policy. Subpart 1239.72—Cloud Computing 1239.7200 Scope of subpart. This subpart prescribes policies and procedures for the acquisition of cloud computing services. 1239.7201 Definitions. As used in this subpart— Authorizing official Cloud computing e.g., Government data Government-related data e.g., 1239.7202 Policy. (a) General. (b) FedRAMP provisional authorization. e.g., (1) The contracting officer may award a contract to acquire cloud computing services from a cloud service provider that has not been granted provisional authorization when— (i) The requirement for a provisional authorization is waived by the DOT CIO; or (ii) The cloud computing service requirement is for a private, on-premises version that will be provided from Government facilities. Under this circumstance, the cloud service provider must obtain a provisional authorization prior to operational use. (2) When contracting for cloud computing services, the contracting officer shall ensure the following information is provided by the requiring activity: (i) Government data and Government-related data descriptions. (ii) Data ownership, licensing, delivery, and disposition instructions specific to the relevant types of Government data and Government-related data ( e.g., (iii) Appropriate requirements to support applicable inspection, audit, investigation, or other similar authorized activities specific to the relevant types of Government data and Government-related data, or specific to the type of cloud computing services being acquired. (iv) Appropriate requirements to support and cooperate with applicable system-wide search and access capabilities for inspections, audits, investigations. (c) Required storage of data within the United States or outlying areas. (2) The contracting officer shall provide written approval to the contractor when the contractor is permitted to maintain Government data at a location outside the 50 States, the District of Columbia, and outlying areas of the United States. 1239.7203 DOT FedRAMP specific requirements. DOT entities shall set forth DOT FedRAMP specific cloud service requirements. DOT cloud service providers shall adhere to specific requirements when providing services to DOT and its operating administrations whenever DOT or other Federal agency information, sensitive information as defined by DOT policy, personally identifiable information, or third-party provided information and data will transit through or reside on the cloud services system and infrastructure and that requires protection according to required National Institute of Standards and Technology (NIST) Federal Information Processing Standards (FIPS). In addition to the requirements found elsewhere in the FAR, the following are required— (a) Validated cryptography for secure communications. (b) Digital signature cryptography—(authentication, data integrity, and non-repudiation). (c) Audit record retention for cloud service providers. (d) Cloud identification and authentication (organizational users) multi-factor authentication. i.e., (e) Identification and authentication (non-organizational users). (f) Incident reporting timeframes. (g) Media transport. (h) Personnel screening—background investigations. (i) Minimum personnel security requirements—U.S. citizenship and clearance. (1) Moderate risk law enforcement and high impact public trust level—a reinvestigation is required during the 5th year; and (2) There is no reinvestigation for other moderate risk positions or any low risk positions. 1239.7204 Contract clauses. (a) The contracting officer shall insert the clause at 1252.239-76, Cloud Computing Services, in solicitations and contracts, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, for information technology services involving cloud computing services. (b) The contracting officer shall insert a clause substantially as follows at 1252.239-77, Data Jurisdiction, in solicitations and contracts, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, for information technology services involving cloud computing services. (c) The contracting officer shall insert a clause substantially as follows at 1252.239-78, Validated Cryptography for Secure Communications, in solicitations and contracts, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, for information technology services involving cloud computing services. (d) The contracting officer shall insert a clause substantially as follows at 1252.239-79, Authentication, Data Integrity, and Non-Repudiation, in solicitations and contracts, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, for information technology services involving cloud computing services. (e) The contracting officer shall insert a clause substantially as follows at 1252.239-80, Audit Record Retention for Cloud Service Providers, in solicitations and contracts, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, for information technology services involving cloud computing services. (f) The contracting officer shall insert a clause substantially as follows at 1252.239-81, Cloud Identification and Authentication (Organizational Users) Multi-Factor Authentication, in solicitations and contracts, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, for information technology services involving cloud computing services. (g) The contracting officer shall insert a clause substantially as follows at 1252.239-82, Identification and Authentication (Non-Organizational Users), in solicitations and contracts, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, for information technology services involving cloud computing services. (h) The contracting officer shall insert a clause substantially as follows at 1252.239-83, Incident Reporting Timeframes, in solicitations and contracts, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, for information technology services involving cloud computing services. (i) The contracting officer shall insert a clause substantially as follows at 1252.239-84, Media Transport, in solicitations and contracts, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, for information technology services involving cloud computing services. (j) The contracting officer shall insert a clause substantially as follows at 1252.239-85, Personnel Screening—Background Investigations, in all services solicitations and contracts, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, for information technology services involving cloud computing services. (k) The contracting officer shall insert a clause substantially as follows at 1252.239-86, Boundary Protection—Trusted Internet Connections, in solicitations and contracts, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, for information technology services involving cloud computing services. (l) The contracting officer shall insert a clause substantially as follows at 1252.239-87, Protection of Information at Rest, in solicitations and contracts, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, for information technology services involving cloud computing services. (m) The contracting officer shall insert a clause substantially as follows at 1252.239-88, Security Alerts, Advisories, and Directives, in solicitations and contracts, including those using FAR part 12 procedures for the acquisition of commercial products and commercial services, for information technology services involving cloud computing services. Subpart 1239.73—Technology Modernization and Upgrades/Refreshment 1239.7300 Scope of subpart. This subpart prescribes policies and procedures for incorporating technology modernization, upgrades, and refreshment into acquisitions involving information technology products or services supporting the development of applications, information systems, or system software. 1239.7301 Definitions. As used in this subpart— Application Modernization Refresh System software Upgrade 1239.7302 Policy. Contracting officers will ensure all documents involving the acquisition of development or maintenance of DOT applications, systems, infrastructure, and services contain the appropriate clauses as may be required by the Federal Acquisition Regulation (FAR) and other Federal authorities, in order to ensure that information system modernization is prioritized accordance with Federal law, OMB Guidance, and DOT policy. 1239.7303 Contract clauses. (a) The contracting officer shall insert the clause at 1252.239-89, Technology Modernization, in solicitations and contracts when the contractor or a subcontractor, at any tier, proposes a modernization approach to develop or maintain information systems, applications, infrastructure, or services. (b) The contracting officer shall insert the clause at 1252.239-90, Technology Upgrades/Refreshment, in solicitations and contracts when the contractor or a subcontractor at any tier, proposes technology improvements (upgrades/refreshments) to develop or maintain information systems, applications, infrastructure, or services. Subpart 1239.74—Records Management 1239.7400 Scope of subpart. This subpart prescribes policies for records management requirements for contractors who create, work with, or otherwise handle Federal records, regardless of the medium in which the records exist. 1239.7401 Definition. As used in this subpart— Federal record, (1) Includes all DOT records. (2) Does not include personal materials. (3) Applies to records created, received, or maintained by contractors pursuant to a DOT contract. (4) May include deliverables and documentation associated with deliverables. 1239.7402 Policy. (a) Requirements Compliance. (2) Applicability. (3) Records maintenance. (4) Unauthorized disclosure. (b) Non-public information. 1239.7403 Contract clause. The contracting officer shall insert the clause at 1239.239-91, Records Management, in all solicitations and contracts involving services where contractors or subcontractors and their employees or associates collect, access, maintain, use, disseminate, or otherwise handle Federal records.

Related documents

• 48 CFR Part 2939 — Acquisition of Information Technology#511606
• 48 CFR Part 2839 — Acquisition of Information Technology#511582
• 48 CFR Part 639 — Acquisition of Information Technology#511087
• 48 CFR Part 739 — Acquisition of Information Technology#511126
• 48 CFR Part 2439 — Acquisition of Information Technology#511537