CORPDOC 4 — General Provisions for Cost-Reimbursement/T&M Subcontracts under a U.S. Government Prime Contract

Its 5 clauses can ask you for 14 things.

1. A program you have to be running3e.g. The NIST SP 800-171 security requirements 252.204-7012(b)(2)(i)

   You are either running it or you are not, and what the prime asks for is the date it started.

   • Reasonable procedures in place and in use to prevent and detect kickbacks in your own operations and in your direct business relationships

     FAR 52.203-7(c)(1)

   • A listing practice, running for the life of the contract: every employment opening listed immediately with the appropriate employment service delivery system, and at least concurrently with any other recruitment source or effort you use

     41 CFR 60-300.5(a)(2) and (a)(3), which FAR 52.222-35(b) makes a term of your contract

   • The NIST SP 800-171 security requirements, in the version in effect when the solicitation was issued, running on every system of yours that holds or moves the covered information

     Owed when the system is your own — (b)(1) sends an information technology service operated on the Government's behalf to the contract's own terms instead

     252.204-7012(b)(2)(i)
2. Something somebody else has to issue you2e.g. A DoD-approved medium assurance certificate 252.204-7012(c)(3)

   The same day if the issuer is one of your own suppliers, months if it is an assessor or an underwriter.

   • A DoD-approved medium assurance certificate, bought from an outside certificate authority

     Owed when an incident has to be reported — the certificate is what the reporting channel authenticates against, so it is held before the incident rather than obtained after it

     252.204-7012(c)(3)

   • A cloud service provider meeting security requirements equivalent to the FedRAMP Moderate baseline, and complying with (c) through (g) on reporting and forensics

     Owed when covered information sits on a cloud service you did not build — the paragraph reaches an external provider only

     252.204-7012(b)(2)(ii)(D)
3. Something you write6e.g. The notices in the form the Director prescribes 52.222-35

   Days to weeks, and nobody outside your company has to agree to it.

   • A written report to the agency Inspector General, or to the Attorney General where the agency has none

     Owed promptly on reasonable grounds to believe a kickback described in (b) may have occurred

     FAR 52.203-7(c)(2)

   • The notices in the form the Director prescribes, posted in conspicuous places available to employees and applicants for employment

     41 CFR 60-300.5(a)(9), which FAR 52.222-35(b) makes a term of your contract

   • Notice to each labor organization or representative of workers that you are bound by the terms of the veterans' statute

     Owed when you have a collective bargaining agreement or other contract or understanding with a labor organization or representative of workers

     41 CFR 60-300.5(a)(10), which FAR 52.222-35(b) makes a term of your contract

   Show 3 moreShow fewer

   • A system security plan for each of those systems, and a plan of action for the requirements not yet in place

     Owed when the same systems (b)(2)(i) reaches — the plan and the plans of action are named by NIST SP 800-171 itself rather than by the clause's own words

     252.204-7012(b)(2)(i)

   • A written request to vary from a security requirement, for a DoD Chief Information Officer representative to adjudicate

     Owed when a NIST SP 800-171 requirement is not implemented and you are asking to vary from it

     252.204-7012(b)(2)(ii)(B)

   • A copy of an approval you already hold, provided when you ask for that earlier adjudication to be recognized on this order

     Owed when a DoD Chief Information Officer representative has already ruled that a requirement is not applicable to you, or that an alternative measure is equally effective

     252.204-7012(b)(2)(ii)(C)
4. Something you fill in and send back1e.g. A cyber incident report filed at dibnet.dod.mil within 72 hours of discovering the incident 252.204-7012(c)(1)(ii)

   Hours, once you know which one is missing.

   • A cyber incident report filed at dibnet.dod.mil within 72 hours of discovering the incident

     Owed when an incident affecting a covered system, the covered information on it, or your ability to perform the order is discovered

     252.204-7012(c)(1)(ii)
5. Nothing to send now2They are rules you follow while you work.