Minimum Requirements Directed by the Sponsor. (s) Membership in the Consortium may be granted to U.S. firms or institutions organized or existing under the laws of the United States, its territories, or possessions. Membership to any foreign company and/or firms, institutions or business organizations (entities, divisions, etc.) which are owned or substantially controlled by foreign sponsor(s), firms, institutions or individuals, may be granted on a case-by-case basis at the sole discretion of SOSSEC, Inc. When selected to perform on a Prototype Project, Members are solely responsible for complying with all OTA/OTp agreement articles flowed down via a Project Level Agreement (PLA) to the performing Member company(ies). Additionally, members are cautioned that each SOSSEC Consortium OTA has specific Cyber Security requirements that may include but are not limited to the latest versions of the following: 48 CFR 52.204-21 “Basic Safeguarding of Covered Contractor Information Systems:
a. FAR 52.204-21 - Basic Safeguarding of Covered Contractor Information and Systems
b. DFARS 252.204-7012 “Safeguarding Covered Defense Information and Cyber Incident Reporting”
c. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Rev (at the approved revision level at time of project award) “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations”
d. NIST SP 800-171B “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations: Enhanced Security Requirements for Critical Programs and High Value Assets” (at the approved revision level at time of project award) SOSSEC, Inc. will only share protected information with members that have provided assurance and proper supporting documentation (e.g., Military Critical Technical Data Agreement (DD Form 2345)) that demonstrate they are capable of handling protected information. As part of this, each member must confirm that it has a System Security Plan (SSP) in place. SOSSEC, Inc reserves the right to audit members’ compliance with the above provisions (a, b, c, d, and e) and/or require members to provide such documentation as required by a Sponsor.
Minimum Requirements Directed by the Sponsor. (s)
a. FAR 52.204-21 - Basic Safeguarding of Covered Contractor Information and Systems
b. DFARS 252.204-7012 “Safeguarding Covered Defense Information and Cyber Incident Reporting”
c. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Rev (at the approved revision level at time of project award) “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations”
d. NIST SP 800-171B “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations: Enhanced Security Requirements for Critical Programs and High Value Assets” (at the approved revision level at time of project award) SOSSEC, Inc. will only share protected information with members that have provided assurance and proper supporting documentation (e.g., Military Critical Technical Data Agreement (DD Form 2345)) that demonstrate they are capable of handling protected information. As part of this, each member must confirm that it has a System Security Plan (SSP) in place. SOSSEC, Inc reserves the right to audit members’ compliance with the above provisions (a, b, c, d, and e) and/or require members to provide such documentation as required by a Sponsor.
