Northrop Grumman CTM-P-ST-005 — Non-U.S. Government Firm Fixed Price Order

Its 6 clauses can ask you for 16 things.

1. A program you have to be running4e.g. Fifteen named controls running on any system of yours that holds or carries the buyer's contract information 52.204-21(b)(1)

   You are either running it or you are not, and what the prime asks for is the date it started.

   • Fifteen named controls running on any system of yours that holds or carries the buyer's contract information — access limits, authentication, media sanitization, boundary protection, timely patching and malware scanning

     Owed when federal contract information — information not intended for public release, provided by or generated for the Government under the order — resides in or transits your own system

     52.204-21(b)(1)

   • The NIST SP 800-171 security requirements, in the version in effect when the solicitation was issued, running on every system of yours that holds or moves the covered information

     Owed when the system is your own — (b)(1) sends an information technology service operated on the Government's behalf to the contract's own terms instead

     252.204-7012(b)(2)(i)

   • A documented counterfeit electronic part detection and avoidance program covering the twelve areas the clause lists — training, inspection and testing, traceability, quarantine, and reporting among them

     DFARS 252.246-7007(c)

   Show 1 moreShow fewer

   • A purchasing process that goes to the original manufacturer or its authorized supplier first, then to a supplier you have approved, and a documented route for the times neither is available

     DFARS 252.246-7008(b)
2. Something somebody else has to issue you2e.g. A DoD-approved medium assurance certificate 252.204-7012(c)(3)

   The same day if the issuer is one of your own suppliers, months if it is an assessor or an underwriter.

   • A DoD-approved medium assurance certificate, bought from an outside certificate authority

     Owed when an incident has to be reported — the certificate is what the reporting channel authenticates against, so it is held before the incident rather than obtained after it

     252.204-7012(c)(3)

   • A cloud service provider meeting security requirements equivalent to the FedRAMP Moderate baseline, and complying with (c) through (g) on reporting and forensics

     Owed when covered information sits on a cloud service you did not build — the paragraph reaches an external provider only

     252.204-7012(b)(2)(ii)(D)
3. Something you write7e.g. Lot-level traceability from the original manufacturer forward DFARS 252.246-7008(c)

   Days to weeks, and nobody outside your company has to agree to it.

   • A written notice to the contracting officer, at least 20 calendar days before the importation

     Owed when foreign supplies over $20,000 are being purchased for the order and imported into the customs territory of the United States

     FAR 52.225-8(c)(1)

   • A system security plan for each of those systems, and a plan of action for the requirements not yet in place

     Owed when the same systems (b)(2)(i) reaches — the plan and the plans of action are named by NIST SP 800-171 itself rather than by the clause's own words

     252.204-7012(b)(2)(i)

   • A written request to vary from a security requirement, for a DoD Chief Information Officer representative to adjudicate

     Owed when a NIST SP 800-171 requirement is not implemented and you are asking to vary from it

     252.204-7012(b)(2)(ii)(B)

   Show 4 moreShow fewer

   • A copy of an approval you already hold, provided when you ask for that earlier adjudication to be recognized on this order

     Owed when a DoD Chief Information Officer representative has already ruled that a requirement is not applicable to you, or that an alternative measure is equally effective

     252.204-7012(b)(2)(ii)(C)

   • A written notice to the administrative contracting officer naming the supplier, the contract number and value, and the delivery dates

     Owed when you close with a foreign supplier for eligible products or qualifying country supplies to be accorded duty-free entry

     DFARS 252.225-7013(h)

   • Lot-level traceability from the original manufacturer forward, and where it cannot be established, the inspection and test records that stand in its place

     DFARS 252.246-7008(c)

   • A documented statement to the buyer that the electronic parts supplied are new or previously unused

     Owed when the order makes that statement the condition for setting aside the notification, inspection, testing and authentication actions at (b)(3)(ii) — the BlueForge purchase order does exactly that

     DFARS 252.246-7008
4. Something you fill in and send back3e.g. A cyber incident report filed at dibnet.dod.mil within 72 hours of discovering the incident 252.204-7012(c)(1)(ii)

   Hours, once you know which one is missing.

   • The shipping documents annotated for the port of entry, carrying the tariff-schedule notation and the instructions to release the shipment and notify the contract administration office

     FAR 52.225-8(g)

   • A cyber incident report filed at dibnet.dod.mil within 72 hours of discovering the incident

     Owed when an incident affecting a covered system, the covered information on it, or your ability to perform the order is discovered

     252.204-7012(c)(1)(ii)

   • The customs entry forms, completed and submitted to the District Director of Customs with a copy to the DCMA St. Louis Duty Free Entry Team, which executes the duty-free entry certificates

     Owed when the shipment is not consigned directly to a military installation — those are released under sections 10.101 and 10.102 of the Customs regulations instead

     DFARS 252.225-7013(f)(1)(i)