Cybersecurity CDI/CUI Safeguards Statement

IT systems owned or controlled by federal contractors like Trident must be compliant with safeguards required by the U.S. DoD, NASA and GSA relative to Covered Defense Information (CDI) and Controlled Unclassified Information (CUI).

RATIONALE:

Under a joint Department of Defense (DoD), NASA, and General Services Administration (GSA) rule virtually all future federal contracts may require contractors to implement a set of cybersecurity measures to attain the “basic safeguarding” of contractor systems that process, store, or transmit a newly defined category of “federal contract information.” The result is that many IT systems owned or controlled by federal contractors will need to be compliant with the rules set of required safeguards. Controls mandated by the rule for covered contractor systems include limiting information system access to the types of transactions and functions that authorized users are permitted to execute; monitoring, controlling, and protecting organizational communications. Once a contractor or subcontractor accepts a contract containing FAR 52.204-21, it must comply with the following 15 (fifteen) safeguarding controls:

1. Limit access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).

2. Limit information system access to the types of transactions and functions that authorized users are allowed to execute.

3. Verify and control/limit connections to and use of external information systems.

4. Control information posted or processed on publicly accessible information systems.

5. Identify information system users and processes action on behalf of users or devices.

6. Authenticate (or verify) the identities of users, processes, or devices prior to allowing access to an information system.

7. Sanitize or destroy information system media containing Federal contract information before disposal or release for reuse.

8. Limit physical access to organization information systems, equipment, and operating environments to authorized individuals.

9. Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.

10. Monitor, control, and protect organizational communications at external boundaries and key internal boundaries of the information systems.

11. Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

12. Identify, report, and correct information and information system flaws in a timely manner.

13. Provide protection from malicious code at appropriate locations within organizational information systems.

14. Update malicious code protection mechanisms when new releases are available.

15. Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.

POLICY STATEMENT:

PURPOSE:

The purpose of this policy is to ensure that Trident Maritime Systems (TMS) maintains a controlled environment (BOTH Physical and Electronic) in the handling, storing and transmission of Covered Defense Information (CDI) and Controlled Unclassified Information (CUI)

• Covered Defense Information (CDI) means unclassified controlled technical information

• The CUI registry identifies the categories and sub-categories of protected Government information

  • Controlled Technical Information means technical information with military or space application that is subject to controls on the access, use, reproduction, modification, performance, display, release, disclosure or dissemination

  • Examples of Controlled Technical Information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code

  • Export Control is defined as Unclassified information concerning certain items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect the United States national security and nonproliferation objectives

• All CDI/CUI should be marked as such. A description of such information can be found in the Appendix A CDI – Document Types

• Any CDI/CUI that Trident creates must be treated in accordance with this policy/procedure

• The receipt of Controlled Information is limited to company associates who have been approved as Approved Recipients (AR) of Controlled Information

• The creation of CDI/CUI by Trident can only be done by an AR

• Approved Recipients submissions are communicated to IT by senior management who are empowered to do so. Such senior management will be approved by Executive Management

• The sharing of Controlled information is performed by Approved Recipients

• Controlled information can only be shared with Approved Recipients and 3rd parties who have certified themselves as DFARS compliant

• 3rd Parties who receive controlled information must provide Trident with a current signed Certification of Safeguarding Covered Defense Information and Cyber Reporting document prior to receiving Controlled Information

• Approved Recipients are required to read and understand this document and its references and to certify as such by signing the Approved Recipient Certification document, prior to being approved

• Controlled Information is stored in a Secured File Server accessible only to Approved Recipients

• Approved Recipients are required to use Multi-Factor Authentication and encrypted hard drives where they are accessing electronic information

• Approved Recipients who do not access electronic information do not require to have Multi-factor authentication, but are required to safeguard all hard copy documents in a secure location. The distribution and handling of hard copy must be recorded in a log which will be submitted to IT

• The transmission of controlled information is effected using Trident’s Citrix ShareFile or the 3rd Party’s secure encryption method if agreed upon

• Controlled information should NOT be shared via any electronic method other than aforementioned. Any other methods of sharing must be approved by Information Technology for logging / tracking purposes

• Approved ARs are only authorized to access controlled information required to perform their function. ARs can only share controlled information with other ARs on the AR/ 3rd party approved list maintained by IT, on a need to know basis

PROCEDURES:

1. Approved Recipient set up (Permission to Receive, Store/Retrieve and Transmit controlled information)

a. Senior Management submits the Approved Recipient Certification document, Appendix B to Human Resources

b. Human Resources validates that the associate can indeed access controlled information due to nationality or other such type restrictions and then forwards the document to IT

c. Information Technology grants appropriate permissions and configures a fob (smart card technology) for each AR if they need to access electronic information

d. Information Technology encrypts the AR’s hard drive

e. IT adds the AR to the AR/ 3rd party approved list

2. Approved 3rd Party set up (Permission to Receive, Store/Retrieve and Transmit controlled information)

a. Purchasing or other others secure a signed copy of the “Certification of Safeguarding Covered Defense Information and Cyber Incident Reporting” document and submit it to Senior Management, Appendix C for approval and forwarding to IT

b. IT adds the 3rd Party to the AR/ 3rd party approved list

3. Receipt and Storing of Controlled Information from 3rd Parties

a. 3rd Party Sender notifies Trident in writing that they want to share controlled information

b. Trident and 3rd Party Sender agree in writing on the method of secure transmission (e.g. Citrix ShareFile)

i. Email and Email attachments are NOT an acceptable means of receiving controlled information and is not authorized

ii. Hard copy documents, including faxes, are NOT an acceptable means of receiving controlled information documents and is not authorized

c. Trident notifies Sender of the AR contact name to receive the controlled information

d. AR receives the controlled information and reviews it for appropriate markings

i. Banner Marking is mandatory at the top of the page denoting CDI/CUI

ii. All CDI/CUI must indicate the agency of designation (a best practice is also to include the contact information of the agency)

iii. Archives.gov Markings Introduction: https://www.archives.gov/files/cui/documents/marking-introduction-20170906.pdf

iv. If the controlled information is unmarked the AR will notify the Sender immediately

e. AR stores the controlled information document(s) on the Secure File Server

f. AR enters the transaction in the Controlled Information log

g. Security Information and Event Management (SIEM – pronounced SIM) Reports are produced, reviewed and compared to the Controlled Information log for approved recipient control

4. Retrieval of Controlled Information from the Secure File Server (CDI/CUI)

a. AR retrieves controlled information documents from the Secure File Server to their encrypted hard drive if necessary

b. AR logs the retrieving of controlled information

5. Sharing of Controlled Information (CDI/CUI) with 3rd party Receivers

a. AR and Receiver (Trident associate or 3rd party) agree in writing to share controlled information

b. AR and Receiver agree in writing on the method of secure transmission (e.g. Citrix ShareFile)

i. AR and receiver ensure a “Certification of Safeguarding Covered Defense Information and Cyber Reporting” form has been executed by the Receiver

c. AR retrieves controlled information documents from the Secure File Server

d. AR logs the retrieving of controlled information

e. AR transmits the controlled information via the agreed to secure method

i. Email and Email attachments are NOT an acceptable means of sending controlled information documents and is not authorized

ii. Hard copy documents, including faxes, are NOT an acceptable means of sending controlled information documents and is not authorized

f. AR enters the transaction in the Controlled Information log

g. Security Information and Event Management (SIEM – pronounced SIM) Reports are produced, reviewed and compared to the Controlled Information log for approved recipient control

6. Sharing of Controlled Information (CDI/CUI) with other Approved Recipients

a. Prior to sharing controlled information internally, the AR ensures that the receiving AR is on the AR/ 3rd party approved list

b. AR enters the transaction in the Controlled Information log if hard copy sharing is involved

7. Printing and safeguarding hardcopy controlled information

a. AR prints controlled information to a secure printer and retrieves the hard copy immediately

b. AR ensures that the hard copy is kept in his control or stored in a secure area

8. Creation and Storage of Controlled Information (CDI/CUI) by Trident

a. AR creates a document that may be considered CDI/CUI

b. AR marks the document as CDI/CUI and saves it to the Pending Classification area on the Secure File Server

c. AR notifies another AR who validates that the document is indeed CDI/ CUI and that it is marked correctly

d. AR moves the document to its permanent location on the Secure File Server

PROCESS MAPS: