Covered recipient information system means an unclassified information system that is owned, or operated by or for, a recipient and that processes, stores, or transmits covered defense information.
Covered defense information means unclassified controlled technical information or other information, as described in the Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list.html, that requires safeguarding or dissemination controls pursuant to and consistent with law, regulations, and Government wide policies, and is -
| (1) | Marked or otherwise identified in the agreement and provided to the recipient by or on behalf of DoD in support of the performance of the agreement; or |
| (2) | Collected, developed, received, transmitted, used, or stored by or on behalf of the recipient in support of the performance of the agreement. |
Cyber incident means actions taken through the use of computer networks that result in a compromise or an actual or potentially adverse effect on an information system and/or the information residing therein.
Forensic analysis means the practice of gathering, retaining, and analyzing computer-related data for investigative purposes in a manner that maintains the integrity of the data.
Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information.
Malicious software means computer software or firmware intended to perform an unauthorized process that will have adverse impact on the confidentiality, integrity, or availability of an information system.
This definition includes a virus, worm, Trojan horse, or other code-based entity that infects a host, as well as spyware and some forms of adware.
Media means physical devices or writing surfaces including, but is not limited to, magnetic tapes, optical disks, magnetic disks, large-scale integration memory chips, and printouts onto which covered defense information is recorded, stored, or printed within a covered recipient information system.
Operationally critical support means supplies or services designated by the Government as critical for airlift, sealift, intermodal transportation services, or logistical support that is essential to the mobilization, deployment, or sustainment of the Armed Forces in a contingency operation.
Rapidly report means within 72 hours of discovery of any cyber incident.
Technical information means technical data or computer software. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software executable code and source code.
(b) | Adequate security. The Recipient shall provide adequate security on all covered recipient information systems. To provide adequate security, the Recipient shall implement, at a minimum, the following information security protections: |
| (1) | For covered recipient information systems that are part of an information technology (IT) service or system operated on behalf of the Government, the following security requirements apply: |
| (i) | Cloud computing services shall be subject to the security requirements specified in the 48 CFR §252.239-7010, Cloud Computing Services. |
| (ii) | Any other such IT service or system (i.e., other than cloud computing) shall be subject to the security requirements specified elsewhere in this Agreement. |