2010-4408. Release, Handling, and Protection of Restricted Information

AGENCY:

National Aeronautics and Space Administration.

ACTION:

Proposed rule.

SUMMARY:

This proposed rule amends the NASA Federal Acquisition Regulation (FAR) Supplement (NFS) to clarify the policy and procedures regarding the release of contractors' restricted information and the handling and protection of restricted information by contractors. This document proposes to change the term “sensitive information” to “restricted information;” clarify what data constitutes restricted information; and revise and move the coverage relative to providing contractors access to restricted information and release of contractors' restricted information to another part. These changes are required to clarify the applicability of clauses addressing contractor handling and protection of restricted information and to clarify what data constitutes restricted information. Additionally, these changes will provide for consistent application of clauses and understanding of what constitutes restricted information. This proposed rule would also update NASA's waiver of the requirements of FAR 9.505-4 to reflect the policy and procedures regarding the release of contractors' restricted information and the handling and protection of restricted information by contractors. This proposed rulemaking would monitor and work to align with recent administration efforts to review the controlled unclassified information (CUI) framework to the extent that it impacts information designation, protection, release, and handling procedures addressed in this proposed rule.

DATES:

Comments should be submitted on or before May 3, 2010 to be considered in formulation of the final rule.

ADDRESSES:

Interested parties may submit comments, identified by RIN number 2700-AD43, via the Federal eRulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments. Comments may also be submitted to Leigh Pomponio, NASA Headquarters, Office of Procurement, Contract Management Division, Washington, DC 20546. Comments may also be submitted by e-mail to [e-mail].

FOR FURTHER INFORMATION CONTACT:

Leigh Pomponio, Office of Procurement, Contract Management Division, [phone], e-mail: [e-mail].

SUPPLEMENTARY INFORMATION:

A. Background

Currently the NFS addresses the release of contractors' sensitive information and access to sensitive information in NFS Part 1837, Service Contracting and NFS Subpart 1837.2, Advisory and Assistance Services, uses the term “sensitive information” to describe data that may be subject to certain restrictions or subject to special handling procedures and protection from inappropriate disclosure. This rule changes the term “sensitive information” to “restricted information” as well as amends and moves from NFS Subpart 1837.2 to NFS Subpart 1827.4, Rights in Data and Copyrights, NASA's policy on release and protection and handling of such information. This action serves to clarify the nature of the information and better reflect NASA's existing policy and application of the clauses to more than service contracts. NASA's waiver of the requirements of FAR 9.505-4 is updated in this rule to reflect the changes made in 1827.405. This rule also removes clauses 1852.237-72, Access to Sensitive Information, and 1852.237-73, Release of Sensitive Information, and adds clauses 1852.227-73, Handling and Protection of Restricted Information, and 1852.227-74, Release of Restricted Information, respectively, in their place.

To better reflect the nature of the information, the new NFS section, 1827.405-70, more specifically identifies “restricted information” as recorded information, regardless of form or the media on which it may be recorded, the use and dissemination of which is restricted, and includes: (1) Limited rights data, (2) restricted computer software, (3) information incidental to contract administration, such as financial, administrative, cost or pricing, or management information that embody trade secrets or are commercial or financial and confidential or privileged, and (4) information designated by NASA as Sensitive But Unclassified (SBU). This change does not expand the universe of “data” that clauses 1852.237-72 and 1852.237-73 address. The original definition for “sensitive information” contained in 1837.203-70 covered information that a contractor has developed at private expense, or that the Government has generated that qualifies for exception to the Freedom of Information Act, which is not currently in the public domain, and which may embody trade secrets or commercial or financial information, and which may be sensitive or privileged. Commercial or financial information which may be sensitive or privileged is specifically covered in both the original and new clauses. The only other “trade secret” information provided by contractors under existing FAR and NFS clauses is Limited Rights Data and Restricted Computer Software that may be delivered under Alt II and III of FAR clause 52.227-14, Rights in Data-General. These are now specifically listed. Information that the Government has generated that qualifies for an exception to the Freedom of Information Act is now referred to as information designated by NASA as SBU.

The new NFS section 1827.405-70(b) clarifies applicability by removing reference to the term “service provider.” If, in performance of NASA contracts, contractors and their subcontractors may require access to restricted information in the Government's possession, which may be entitled to protection from unauthorized use or disclosure, then the clause at 1852.227-73, Handling and Protection of Restricted Information, shall be included in the contract. NFS Clause 1852.227-73 provides restrictions on use and disclosure of restricted information provided by the Government to the contractor if the information is suitably marked with a legend indicating that its use and disclosure is restricted or the information is specifically identified in the contract or in writing by the Contracting Officer as being subject to the clause. Further, this rule clarifies that contractor access to restricted information that comprises third party limited rights data or restricted computer software will be provided to contractors only as authorized by the clause at 52.227-14, Rights in Data—General, Alternates II and III.

NASA's waiver of the requirements of FAR 9.505-4 is updated in this rule to reflect the changes made in 1827.405 as it relates to the acquisition of services to support mission activities and management and administrative functions.

This proposed rule removes clause 1852.237-72, Access to Sensitive Information, and adds a new clause 1852.227-73, Handling and Protection of Restricted Information, in its place. This new clause addresses contractor responsibilities when performance of its contract requires access to restricted information; defines “restricted information;” provides restrictions on use and disclosure of restricted information provided by the Government; identifies exceptions; establishes that this clause is subordinate to all other contract clauses or requirements that specifically address the access, use, handling, protection or disclosure of information; identifies remedies for breach of any conditions of the clause; and requires flow-down of the clause requirements to all subcontractors. The effect of this clause is to create a non-disclosure agreement within the contract, eliminating the need for separate non-disclosure agreements between contractors. Since the clause at 1852.227-73, Handling and Protection of Restricted Information, functions as a contractual non-disclosure agreement, the clause may also be used, in conjunction with other appropriate measures, as part of a plan to mitigate organizational conflicts of interest resulting from unfair access to restricted information. This clause alone does not create an adequate firewall to mitigate OCIs resulting from unfair access to data.

This proposed rule also removes clause 1852.237-73, Release of Sensitive Information, and adds a new clause 1852.227-74, Release of Restricted Information, in its place. Consistent with 1852.227-73, this clause includes the same definition of “restricted information.” Through this clause offerors and contractors agree that NASA may release their restricted information to other contractors in accordance with the procedures prescribed in 1827.405-70 and subject to the safeguards and protections delineated in the clause at 1852.227-73, Handling and Protection of Restricted Information. The clause at 1852.227-74 requires offerors and contractors to identify information they claim to be restricted information provided to the Government in the course of submitting proposals for a contract and performing a contract by suitably marking such restricted information with a legend indicating that use and disclosure of the information is restricted.

B. Regulatory Flexibility Act

This rule is not expected to have a significant economic impact on a substantial number of small entities within the meaning of the Regulatory Flexibility Act, 5 U.S.C. 601 et seq., because the proposed rule only clarifies existing NFS requirements.

C. Paperwork Reduction Act

The Paperwork Reduction Act (Pub. L. 96-511) does not apply because the changes to the NFS do not impose information collection requirements that require the approval of OMB under 44 U.S.C. 3501, et seq.

William P. McNally,

Assistant Administrator for Procurement.

This proposed rule was subject to Office of Management and Budget review under Executive Order 12866, dated September 30, 1993.

Accordingly, 48 CFR parts 1809, 1827, 1837, and 1852 are proposed to be amended as follows:

1. The authority citation for 48 CFR parts 1809, 1827, 1837, and 1852 continues to read as follows:

Authority: 42 U.S.C. 2473(c)(1).

PART 1809—CONTRACTOR QUALIFICATIONS

2. Revise section 1809.505-4 to read as follows:

1809.505-4

Obtaining access to restricted information.

(b) In accordance with FAR 9.503, the Assistant Administrator for Procurement has determined that it would not be in the Government's interests for NASA to comply strictly with FAR 9.505-4(b) when acquiring services to support mission activities and management and administrative functions. The Assistant Administrator for Procurement has, therefore, waived the requirement that before gaining access to other companies' restricted information (see 1827.405-70) contractors must enter specific agreements with each of those other companies to protect their information from unauthorized use or disclosure. Accordingly, NASA will not require contractors and subcontractors and their employees in procurements that support NASA mission activities and management and administrative functions to enter into separate, interrelated third party agreements to protect restricted information from unauthorized use or disclosure. As an alternative to numerous, separate third party agreements, 1827.405-70 prescribes detailed policy and procedures to protect contractors from unauthorized use or disclosure of their restricted information. Nothing in this section waives the requirements of FAR 37.204 and 1837.204.

PART 1827—PATENTS, DATA, AND COPYRIGHTS

3. Add sections 1827.405-70, 1827.405-71, and 1827.405-72 to read as follows:

1827.405-70

Providing contractors access to restricted information.

(a)(1) As used in this subpart, “restricted information” means recorded information, regardless of form or the media on which it may be recorded, the use and dissemination of which is restricted, and includes:

(i) Limited rights data;

(ii) Restricted computer software;

(iii) Information incidental to contract administration, such as financial, administrative, cost or pricing, or management information that embody trade secrets or are commercial or financial and confidential or privileged; and

(iv) Information designated by NASA as Sensitive But Unclassified (SBU).

(2) As used in this subpart, “requiring organization” refers to the NASA organizational element or activity that requires specified services or products to be provided under a contract.

(b)(1) In performance of NASA contracts, contractors, and their subcontractors, may require access to restricted information in the Government's possession, which may be entitled to protection from unauthorized use or disclosure. The clause at 1852.227-73, Handling and Protection of Restricted Information, will be used in contracts to ensure that restricted information is properly protected from unauthorized use or disclosure.

(2) Since the clause at 1852.227-73, Handling and Protection of Restricted Information, functions as a contractual non-disclosure agreement, the clause may also be used, as deemed appropriate and in conjunction with other appropriate measures as necessary, to mitigate organizational conflicts of interest resulting from unequal access to restricted information.

(3) After contract award, the requiring organization shall review any contractor's requests for access to restricted information to determine whether the access is necessary to performance of the contract and whether the information requested is considered “restricted” as defined in paragraph (a)(1) of this section, and shall notify the Contracting Officer of such determination. If it is determined that performance will necessitate access to restricted information and the clause at 1852.227-73 is in the contract, the restricted information may be provided to the contractor. If the clause at 1852.227-73 was not initially included in the contract, the contracting officer shall add the clause before restricted information is provided to the contractor.

(4) Access to restricted information that comprises third party limited rights data or restricted computer software will be provided to contractors only as authorized by the clause at 52.227-14, Rights in Data—General, Alternates II and III (see also FAR 27.402(c) and (d), 27.409(b)(3) and (b)(4), and 1827.409(c) and (d) for authorization to revise Limited Rights and Restricted Rights notices to provide the Government greater rights in limited rights data and restricted computer software). All other restricted information will be provided to contractors in compliance with the clause at 1852.227-74, Release of Restricted Information. All restricted information provided to a contractor will be handled by the contractor in compliance with 1852.227-73, Handling and Protection of Restricted Information.

(5)(i) The clause at 1852.227-73 provides restrictions on use and disclosure of restricted information provided by the Government to the contractor if the information is suitably marked with a legend indicating that its use and disclosure is restricted or the information is specifically identified in the contract or in writing by the Contracting Officer as being subject to the clause. This includes information incidental to contract administration, such as financial, administrative, cost or pricing, or management information that embodies trade secrets or are commercial or financial and confidential or privileged, as well as information designated by NASA as Sensitive But Unclassified (SBU).

(ii) Additionally, paragraph (d)(1) of the clause at 52.227-14, Rights in Data—General, permits the Government to restrict a contractor's right to use, release to others, reproduce, distribute, or publish any data first produced or specifically used by the contractor in the performance of a contract provided such restriction is expressly set forth in the contract. Pursuant to this authority, the clause at 1852.227-73 provides restrictions on use and disclosure of third party limited rights data and restricted computer software that may be provided by the Government to its contactors.

(c) When a contractor is given access to restricted information in performance of a contract and such restricted information is either marked with a restrictive legend indicating that use and disclosure of the information is restricted or is specifically identified in the contract or in writing by the Contracting Officer as being subject to restrictions, the contractor, and its subcontractors given access to such restricted information, shall follow the steps outlined in the clause at 1852.227-73, Handling and Protection of Restricted Information, to protect the restricted information from unauthorized use or disclosure.

(d) If the contractor will be operating an information technology system for NASA that contains restricted information, the operating contract shall include the clause at 1852.204-76, Security Requirements for Unclassified Information Technology Resources, which requires the implementation of an Information Technology Security Plan to protect information processed, stored, or transmitted from unauthorized access, alteration, disclosure, or use.

(e) The contracting officer may require the contractor to demonstrate how it is complying with the clause at 1852.227-73, Handling and Protection of Restricted Information, to protect from unauthorized use or disclosure any restricted information provided under the contract that is either marked with a restrictive legend indicating that use and disclosure of the information is restricted or is specifically identified in the contract or in writing by the Contracting Officer as being subject to restrictions.

1827.405-71

Release of contractors' restricted information.

Pursuant to the clause at 1852.227-74, Release of Restricted Information, offerors and contractors agree that NASA may release their restricted information to other contractors in accordance with the procedures prescribed in 1827.405-70 and subject to the safeguards and protections delineated in the clause at 1852.227-73, Handling and Protection of Restricted Information. As required by the clause at 1852.227-74, contractors must identify information they claim to be restricted information submitted in the course of performing a contract by suitably marking such restricted information with a legend indicating that use and disclosure of the information is restricted. The contracting officer shall evaluate all contractor claims regarding such restricted information in deciding how NASA should respond to requests from requiring organizations and contractors for access to restricted information.

1827.405-72

NASA contract clauses.

(a) The contracting officer shall insert the clause at 1852.227-73, Handling and Protection of Restricted Information, in all solicitations, contracts, and basic ordering agreements, unless the contracting officer determines that contract performance will not require access to restricted information.

(b) The contracting officer shall insert the clause at 1852.227-74, Release of Restricted Information, in all solicitations, contracts, and basic ordering agreements.

PART 1837—SERVICE CONTRACTING

1837.203-70, 1837.203-71, and 1837.203-72

[Removed]

4. Remove sections 1837.203-70, 1837.203-71, and 1837.203-72.

PART 1852—SOLICITATION PROVISIONS AND CONTRACT CLAUSES

5. Add sections 1852.227-73 and 1852.227-74 to read as follows:

1852.227-73

Handling and Protection of Restricted Information.

As prescribed in 1827.405-72(a), insert the following clause:

HANDLING AND PROTECTION OF RESTRICTED INFORMATION

(XX/XX)

(a) Definition. “Restricted information,” as used in this clause, means recorded information, regardless of form or the media on which it may be recorded, the use and dissemination of which is restricted, and includes:

(1) Limited rights data;

(2) Restricted computer software;

(3) Information incidental to contract administration, such as financial, administrative, cost or pricing, or management information that embody trade secrets or are commercial or financial and confidential or privileged; and

(4) Information designated by NASA as Sensitive But Unclassified (SBU).

(b) Restrictions on use and disclosure of restricted information. With regard to any restricted information to which the Contractor is given access in performance of this contract that is either marked with a restrictive legend indicating that use and disclosure of the information is restricted or is specifically identified in this contract or in writing by the Contracting Officer as being subject to this clause, the Contractor agrees to:

(1) Use such restricted information only for the purposes of performing the services specified in this contract, and not appropriate the restricted information to its own or another's use;

(2) Safeguard the restricted information from unauthorized use and disclosure;

(3) Allow access to the restricted information only to those employees and subcontractors that need it to perform services under this contract;

(4) Preclude access and disclosure of the restricted information to persons and entities outside of the Contractor's or its subcontractor's organization(s);

(5) Inform employees who may require access to the restricted information about obligations to use it only to perform the services specified in this contract and to safeguard it from unauthorized use and disclosure;

(6) Require that each employee that has access to restricted information complies with the obligations regarding restricted information included in this clause; and

(7) Return or dispose of the restricted information, as NASA may direct, when the restricted information is no longer needed for performance of work under this contract.

(c) Exceptions.

(1) The obligations and prohibitions of paragraph (b) do not apply to restricted information which the Contractor can demonstrate to the Contracting Officer—

(i) Was publicly available at the time of receipt by the Contractor or thereafter becomes publicly available without breach of this contract;

(ii) Was known to, in the possession of, or developed by or for the Contractor independently of the restricted information received from the Government and such knowledge, possession, or independent development can be shown;

(iii) Was received by the Contractor from a party other than the owner of the restricted information, who has the authority to release the restricted information and did not require the Contractor to hold it in confidence; or

(iv) Is released to or becomes available to a third party on an unrestricted basis from the owner of the restricted information, someone acting under the owner's control, or with the prior written approval of the owner.

(2) Under a valid order of a court or Government agency, the Contractor may release restricted information to which the Contractor is given access in performance of this contract, provided that the Contractor provides prior written notice to the owner of the restricted information of such obligation and the opportunity to oppose such disclosure. The Contractor shall provide a copy of the notice to the Contracting Officer.

(d) In the event that restricted information provided to the Contractor includes a restrictive legend that the Contractor deems to be ambiguous or unauthorized, the Contractor must notify the Contracting Officer of such condition. Notwithstanding such a notification, as long as the restrictive legend provides an indication that a restriction on use or disclosure was intended, the Contractor will treat the restricted information pursuant to the requirements of this clause unless otherwise directed in writing by the Contracting Officer or the owner of the restricted information.

(e) Other contractual restrictions on restricted information. This clause is subordinate to all other contract clauses or requirements that specifically address the access, use, handling, protection or disclosure of information. If any restrictions or authorizations in this clause are inconsistent with a requirement of any other clause of this contract, the requirement of the other clause shall take precedence over the requirement of this clause. Third party limited rights data and restricted computer software will be provided under this contract only as authorized by the clause at 52.227-14, Rights in Data—General, Alternates II and III (as modified by 1852.227-14, if applicable). If the Contractor believes there is a conflict between this clause and another clause in this contract regarding the access, use, handling, protection or disclosure of restricted information, the Contractor must consult with the Contracting Officer before taking subsequent actions under the other clause.

(f) The Contracting Officer may require the Contractor to demonstrate how it is complying with this Handling and Protection of Restricted Information clause.

(g) Remedies. Recognizing that this contract establishes a high standard of accountability and trust, the Contractor's breach of any of the conditions of this clause may provide grounds for the Government to—

(1) Disqualify the Contractor from subsequent related contractual efforts;

(2) Debar the Contractor for serious misconduct affecting present responsibility;

(3) Terminate the Contractor for default; or

(4) Pursue such other remedies as may be permitted by law, regulation, or this contract.

(h) Subcontracts. The Contractor shall insert, or require the insertion of, this clause, including this paragraph (h), suitably modified to reflect the relationship of the parties, in all subcontracts (regardless of tier).

(End of clause)

1852.227-74

Release of restricted information.

As prescribed in 1827.405-72(b), insert the following clause:

RELEASE OF RESTRICTED INFORMATION

(XX/XX)

(a) Definition. “Restricted information,” as used in this clause, means recorded information, regardless of form or the media on which it may be recorded, the use and dissemination of which is restricted, and includes:

(1) Limited rights data;

(2) Restricted computer software;

(3) Information incidental to contract administration, such as financial, administrative, cost or pricing, or management information that embody trade secrets or are commercial or financial and confidential or privileged; and

(4) Information designated by NASA as Sensitive But Unclassified (SBU).

(b) In performance of NASA contracts, contractors, as well as their subcontractors and their individual employees, may require access to restricted information in the Government's possession. The Contractor agrees that, where needed for the performance of a NASA contract, NASA may release to its contractors, and their subcontractors, restricted information delivered during the course of this contract. Additionally, offerors agree that restricted information submitted with their proposals may be provided to NASA service contractors that assist NASA with contract closeout. If suitably marked with a legend indicating that use and disclosure of restricted information is restricted, such restricted information will be subject to the enumerated protections mandated by this clause and the clause at 1852.227-73, Handling and Protection of Restricted Information. The Contractor's limited rights data and restricted computer software will be provided to other NASA contractors or subcontractors only as authorized by the clause at 52.227-14, Rights in Data—General, Alternates II and III (as modified by 1852-227-14, if applicable).

(c) For purposes of marking such restricted information, the Contractor may, in addition to any other notice or legend otherwise required (e.g., notices required under the clause at 52.227-14, Rights in Data—General, Alternates II and III), use a notice similar to the following:

Mark the title page with the following legend:

This document was submitted by [insert submitter's name] in performance Contract No. [insert contract no.]. Submitter asserts that this document contains restricted information that embodies trade secrets or is commercial or financial and privileged or confidential. Such information shall not be disclosed outside of NASA except in accordance with the clause at NFS 1852.227-73, Handling and Protection of Restricted Information. This restriction does not limit the Government's right to use this restricted information if it is obtained from another source without restriction. The restricted information subject to this notice is contained in pages [insert page numbers or other identification of pages].

Mark each page containing restricted information the Contractor wishes to restrict with the following legend:

This page contains restricted information and is subject to the restriction on the title page of this document.

(d) The Contracting Officer shall evaluate restricted information marked in accordance with paragraph (c) of this clause. Unless the Contracting Officer decides, with the advice of Center legal counsel, that reasonable grounds exist to challenge the markings, NASA and its contractors and subcontractors, shall comply with all of the safeguards contained in paragraph (e) of this clause and the clause at 1852.227-73, Handling and Protection of Restricted Information.

(e) To receive access to restricted information needed to assist NASA in accomplishing NASA mission activities and management and administrative functions, the Contractor or subcontractor must be operating under a contract that contains the clause at 1852.227-73, Handling and Protection of Restricted Information, which obligates the Contractor or subcontractor, with respect to restricted information marked with a legend indicating that use and disclosure of the information is restricted, to do the following:

(1) Use such restricted information only for the purpose of performing the services specified in its contract, and not appropriate the restricted information to its own or another's use;

(2) Safeguard such restricted information from unauthorized use and disclosure;

(3) Allow access to such restricted information only to those employees and subcontractors that need it to perform services under the contract;

(4) Preclude access and disclosure of such restricted information to persons and entities outside of the contractor's or its subcontractor's organization(s);

(5) Inform employees who may require access to such restricted information about obligations to use it only to perform the services specified in its contract and to safeguard it from unauthorized use and disclosure;

(6) Require that each employee that has access to restricted information complies with the obligations regarding restricted information included in this clause; and

(7) Return or dispose of such restricted information, as NASA may direct, when the restricted information is no longer needed for performance of work under the contract.

(f) Exceptions. The obligations and prohibitions of paragraph (e) of this clause do not apply to restricted information which the receiving contractor can demonstrate to the Contracting Officer—

(1) Was publicly available at the time of receipt by the receiving contractor or thereafter becomes publicly available without breach of the receiving contractor's contract;

(2) Was known to, in the possession of, or developed by or for the receiving contractor independently of the restricted information received from the Government and such knowledge, possession, or independent development can be shown;

(3) Was received by the receiving contractor from a party other than the owner of the restricted information, who has the authority to release the restricted information and did not require the receiving contractor to hold it in confidence;

(4) Is released to or becomes available to a third party on an unrestricted basis from the owner of the restricted information, someone acting under the owner's control, or with the prior written approval of the owner; or

(5) Is required to be released under a valid order of a court or Government agency, provided that the Contractor provides prior written notice to the owner of the restricted information of such obligation and the opportunity to oppose such disclosure.

(g) When a contractor will have primary responsibility for operating an information technology system for NASA that contains restricted information, the contractor's contract shall also include the clause at 1852.204-76, Security Requirements for Unclassified Information Technology Resources. The Security Requirements clause requires the contractor to implement an Information Technology Security Plan to protect information processed, stored, or transmitted from unauthorized access, alteration, disclosure, or use. Contractor personnel requiring privileged access or limited privileged access to these information technology systems are subject to screening using the standard National Agency Check (NAC) forms appropriate to the level of risk for adverse impact to NASA missions. The Contracting Officer may allow the Contractor to conduct its own screening, provided the contractor employs substantially equivalent screening procedures.

(h) This clause does not affect NASA's responsibilities under the Freedom of Information Act.

(i) Subcontracts. The Contractor shall insert, or require the insertion of, this clause, including this paragraph (i), suitably modified to reflect the relationship of the parties, in all subcontracts (regardless of tier).

(End of clause)

1852.237-72 and 1852.237-73

[Removed]

6. Remove sections 1852.237-72 and 1852.237-73.