PDF Version

[Federal Register: March 4, 2010 (Volume 75, Number 42)]
[Proposed Rules]               
[Page 9860-9864]
                       

=======================================================================
-----------------------------------------------------------------------

NATIONAL AERONAUTICS AND SPACE ADMINISTRATION

48 CFR Parts 1809, 1827, 1837, and 1852

RIN 4700-AD43

 
Release, Handling, and Protection of Restricted Information

AGENCY: National Aeronautics and Space Administration.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: This proposed rule amends the NASA Federal Acquisition 
Regulation (FAR) Supplement (NFS) to clarify the policy and procedures 
regarding the release of contractors' restricted information and the 
handling and protection of restricted information by contractors. This 
document proposes to change the term ``sensitive information'' to 
``restricted information;'' clarify what data constitutes restricted 
information; and revise and move the coverage relative to providing 
contractors access to restricted information and release of 
contractors' restricted information to another part. These changes are 
required to clarify the applicability of clauses addressing contractor 
handling and protection of restricted information and to clarify what 
data constitutes restricted information. Additionally, these changes 
will provide for consistent application of clauses and understanding of 
what constitutes restricted information. This proposed rule would also 
update NASA's waiver of the requirements of FAR 9.505-4 to reflect the 
policy and procedures regarding the release of contractors' restricted 
information and the handling and protection of restricted information 
by contractors. This proposed rulemaking would monitor and work to 
align with recent administration efforts to review the controlled 
unclassified information (CUI) framework to the extent that it impacts 
information designation, protection, release, and handling procedures 
addressed in this proposed rule.

DATES: Comments should be submitted on or before May 3, 2010 to be 
considered in formulation of the final rule.

ADDRESSES: Interested parties may submit comments, identified by RIN 
number 2700-AD43, via the Federal eRulemaking Portal: http://
www.regulations.gov. Follow the instructions for submitting comments. 
Comments may also be submitted to Leigh Pomponio, NASA Headquarters, 
Office of Procurement, Contract Management Division, Washington, DC 
20546. Comments may also be submitted by e-mail to 
[email protected]

FOR FURTHER INFORMATION CONTACT: Leigh Pomponio, Office of Procurement, 
Contract Management Division, (202) 358-0592, e-mail: 
leigh.pomponio.@nasa.gov.

SUPPLEMENTARY INFORMATION:

A. Background

    Currently the NFS addresses the release of contractors' sensitive 
information and access to sensitive information in NFS Part 1837, 
Service Contracting and NFS Subpart 1837.2, Advisory and Assistance 
Services, uses the term ``sensitive information'' to describe data that 
may be subject to certain restrictions or subject to special handling 
procedures and protection from inappropriate disclosure. This rule 
changes the term ``sensitive information'' to ``restricted 
information'' as well as amends and moves from NFS Subpart 1837.2 to 
NFS Subpart 1827.4, Rights in Data and Copyrights, NASA's policy on 
release and protection and handling of such information. This action 
serves to clarify the nature of the information and

[[Page 9861]]

better reflect NASA's existing policy and application of the clauses to 
more than service contracts. NASA's waiver of the requirements of FAR 
9.505-4 is updated in this rule to reflect the changes made in 
1827.405. This rule also removes clauses 1852.237-72, Access to 
Sensitive Information, and 1852.237-73, Release of Sensitive 
Information, and adds clauses 1852.227-73, Handling and Protection of 
Restricted Information, and 1852.227-74, Release of Restricted 
Information, respectively, in their place.
    To better reflect the nature of the information, the new NFS 
section, 1827.405-70, more specifically identifies ``restricted 
information'' as recorded information, regardless of form or the media 
on which it may be recorded, the use and dissemination of which is 
restricted, and includes: (1) Limited rights data, (2) restricted 
computer software, (3) information incidental to contract 
administration, such as financial, administrative, cost or pricing, or 
management information that embody trade secrets or are commercial or 
financial and confidential or privileged, and (4) information 
designated by NASA as Sensitive But Unclassified (SBU). This change 
does not expand the universe of ``data'' that clauses 1852.237-72 and 
1852.237-73 address. The original definition for ``sensitive 
information'' contained in 1837.203-70 covered information that a 
contractor has developed at private expense, or that the Government has 
generated that qualifies for exception to the Freedom of Information 
Act, which is not currently in the public domain, and which may embody 
trade secrets or commercial or financial information, and which may be 
sensitive or privileged. Commercial or financial information which may 
be sensitive or privileged is specifically covered in both the original 
and new clauses. The only other ``trade secret'' information provided 
by contractors under existing FAR and NFS clauses is Limited Rights 
Data and Restricted Computer Software that may be delivered under Alt 
II and III of FAR clause 52.227-14, Rights in Data-General. These are 
now specifically listed. Information that the Government has generated 
that qualifies for an exception to the Freedom of Information Act is 
now referred to as information designated by NASA as SBU.
    The new NFS section 1827.405-70(b) clarifies applicability by 
removing reference to the term ``service provider.'' If, in performance 
of NASA contracts, contractors and their subcontractors may require 
access to restricted information in the Government's possession, which 
may be entitled to protection from unauthorized use or disclosure, then 
the clause at 1852.227-73, Handling and Protection of Restricted 
Information, shall be included in the contract. NFS Clause 1852.227-73 
provides restrictions on use and disclosure of restricted information 
provided by the Government to the contractor if the information is 
suitably marked with a legend indicating that its use and disclosure is 
restricted or the information is specifically identified in the 
contract or in writing by the Contracting Officer as being subject to 
the clause. Further, this rule clarifies that contractor access to 
restricted information that comprises third party limited rights data 
or restricted computer software will be provided to contractors only as 
authorized by the clause at 52.227-14, Rights in Data--General, 
Alternates II and III.
    NASA's waiver of the requirements of FAR 9.505-4 is updated in this 
rule to reflect the changes made in 1827.405 as it relates to the 
acquisition of services to support mission activities and management 
and administrative functions.
    This proposed rule removes clause 1852.237-72, Access to Sensitive 
Information, and adds a new clause 1852.227-73, Handling and Protection 
of Restricted Information, in its place. This new clause addresses 
contractor responsibilities when performance of its contract requires 
access to restricted information; defines ``restricted information;'' 
provides restrictions on use and disclosure of restricted information 
provided by the Government; identifies exceptions; establishes that 
this clause is subordinate to all other contract clauses or 
requirements that specifically address the access, use, handling, 
protection or disclosure of information; identifies remedies for breach 
of any conditions of the clause; and requires flow-down of the clause 
requirements to all subcontractors. The effect of this clause is to 
create a non-disclosure agreement within the contract, eliminating the 
need for separate non-disclosure agreements between contractors. Since 
the clause at 1852.227-73, Handling and Protection of Restricted 
Information, functions as a contractual non-disclosure agreement, the 
clause may also be used, in conjunction with other appropriate 
measures, as part of a plan to mitigate organizational conflicts of 
interest resulting from unfair access to restricted information. This 
clause alone does not create an adequate firewall to mitigate OCIs 
resulting from unfair access to data.
    This proposed rule also removes clause 1852.237-73, Release of 
Sensitive Information, and adds a new clause 1852.227-74, Release of 
Restricted Information, in its place. Consistent with 1852.227-73, this 
clause includes the same definition of ``restricted information.'' 
Through this clause offerors and contractors agree that NASA may 
release their restricted information to other contractors in accordance 
with the procedures prescribed in 1827.405-70 and subject to the 
safeguards and protections delineated in the clause at 1852.227-73, 
Handling and Protection of Restricted Information. The clause at 
1852.227-74 requires offerors and contractors to identify information 
they claim to be restricted information provided to the Government in 
the course of submitting proposals for a contract and performing a 
contract by suitably marking such restricted information with a legend 
indicating that use and disclosure of the information is restricted.

B. Regulatory Flexibility Act

    This rule is not expected to have a significant economic impact on 
a substantial number of small entities within the meaning of the 
Regulatory Flexibility Act, 5 U.S.C. 601 et seq., because the proposed 
rule only clarifies existing NFS requirements.

C. Paperwork Reduction Act

    The Paperwork Reduction Act (Pub. L. 96-511) does not apply because 
the changes to the NFS do not impose information collection 
requirements that require the approval of OMB under 44 U.S.C. 3501, et 
seq.

William P. McNally,
Assistant Administrator for Procurement.

    This proposed rule was subject to Office of Management and Budget 
review under Executive Order 12866, dated September 30, 1993.
    Accordingly, 48 CFR parts 1809, 1827, 1837, and 1852 are proposed 
to be amended as follows:
    1. The authority citation for 48 CFR parts 1809, 1827, 1837, and 
1852 continues to read as follows:

    Authority: 42 U.S.C. 2473(c)(1).

PART 1809--CONTRACTOR QUALIFICATIONS

    2. Revise section 1809.505-4 to read as follows:


1809.505-4  Obtaining access to restricted information.

    (b) In accordance with FAR 9.503, the Assistant Administrator for 
Procurement has determined that it would not be in the Government's

[[Page 9862]]

interests for NASA to comply strictly with FAR 9.505-4(b) when 
acquiring services to support mission activities and management and 
administrative functions. The Assistant Administrator for Procurement 
has, therefore, waived the requirement that before gaining access to 
other companies' restricted information (see 1827.405-70) contractors 
must enter specific agreements with each of those other companies to 
protect their information from unauthorized use or disclosure. 
Accordingly, NASA will not require contractors and subcontractors and 
their employees in procurements that support NASA mission activities 
and management and administrative functions to enter into separate, 
interrelated third party agreements to protect restricted information 
from unauthorized use or disclosure. As an alternative to numerous, 
separate third party agreements, 1827.405-70 prescribes detailed policy 
and procedures to protect contractors from unauthorized use or 
disclosure of their restricted information. Nothing in this section 
waives the requirements of FAR 37.204 and 1837.204.

PART 1827--PATENTS, DATA, AND COPYRIGHTS

    3. Add sections 1827.405-70, 1827.405-71, and 1827.405-72 to read 
as follows:


1827.405-70  Providing contractors access to restricted information.

    (a)(1) As used in this subpart, ``restricted information'' means 
recorded information, regardless of form or the media on which it may 
be recorded, the use and dissemination of which is restricted, and 
includes:
    (i) Limited rights data;
    (ii) Restricted computer software;
    (iii) Information incidental to contract administration, such as 
financial, administrative, cost or pricing, or management information 
that embody trade secrets or are commercial or financial and 
confidential or privileged; and
    (iv) Information designated by NASA as Sensitive But Unclassified 
(SBU).
    (2) As used in this subpart, ``requiring organization'' refers to 
the NASA organizational element or activity that requires specified 
services or products to be provided under a contract.
    (b)(1) In performance of NASA contracts, contractors, and their 
subcontractors, may require access to restricted information in the 
Government's possession, which may be entitled to protection from 
unauthorized use or disclosure. The clause at 1852.227-73, Handling and 
Protection of Restricted Information, will be used in contracts to 
ensure that restricted information is properly protected from 
unauthorized use or disclosure.
    (2) Since the clause at 1852.227-73, Handling and Protection of 
Restricted Information, functions as a contractual non-disclosure 
agreement, the clause may also be used, as deemed appropriate and in 
conjunction with other appropriate measures as necessary, to mitigate 
organizational conflicts of interest resulting from unequal access to 
restricted information.
    (3) After contract award, the requiring organization shall review 
any contractor's requests for access to restricted information to 
determine whether the access is necessary to performance of the 
contract and whether the information requested is considered 
``restricted'' as defined in paragraph (a)(1) of this section, and 
shall notify the Contracting Officer of such determination. If it is 
determined that performance will necessitate access to restricted 
information and the clause at 1852.227-73 is in the contract, the 
restricted information may be provided to the contractor. If the clause 
at 1852.227-73 was not initially included in the contract, the 
contracting officer shall add the clause before restricted information 
is provided to the contractor.
    (4) Access to restricted information that comprises third party 
limited rights data or restricted computer software will be provided to 
contractors only as authorized by the clause at 52.227-14, Rights in 
Data--General, Alternates II and III (see also FAR 27.402(c) and (d), 
27.409(b)(3) and (b)(4), and 1827.409(c) and (d) for authorization to 
revise Limited Rights and Restricted Rights notices to provide the 
Government greater rights in limited rights data and restricted 
computer software). All other restricted information will be provided 
to contractors in compliance with the clause at 1852.227-74, Release of 
Restricted Information. All restricted information provided to a 
contractor will be handled by the contractor in compliance with 
1852.227-73, Handling and Protection of Restricted Information.
    (5)(i) The clause at 1852.227-73 provides restrictions on use and 
disclosure of restricted information provided by the Government to the 
contractor if the information is suitably marked with a legend 
indicating that its use and disclosure is restricted or the information 
is specifically identified in the contract or in writing by the 
Contracting Officer as being subject to the clause. This includes 
information incidental to contract administration, such as financial, 
administrative, cost or pricing, or management information that 
embodies trade secrets or are commercial or financial and confidential 
or privileged, as well as information designated by NASA as Sensitive 
But Unclassified (SBU).
    (ii) Additionally, paragraph (d)(1) of the clause at 52.227-14, 
Rights in Data--General, permits the Government to restrict a 
contractor's right to use, release to others, reproduce, distribute, or 
publish any data first produced or specifically used by the contractor 
in the performance of a contract provided such restriction is expressly 
set forth in the contract. Pursuant to this authority, the clause at 
1852.227-73 provides restrictions on use and disclosure of third party 
limited rights data and restricted computer software that may be 
provided by the Government to its contactors.
    (c) When a contractor is given access to restricted information in 
performance of a contract and such restricted information is either 
marked with a restrictive legend indicating that use and disclosure of 
the information is restricted or is specifically identified in the 
contract or in writing by the Contracting Officer as being subject to 
restrictions, the contractor, and its subcontractors given access to 
such restricted information, shall follow the steps outlined in the 
clause at 1852.227-73, Handling and Protection of Restricted 
Information, to protect the restricted information from unauthorized 
use or disclosure.
    (d) If the contractor will be operating an information technology 
system for NASA that contains restricted information, the operating 
contract shall include the clause at 1852.204-76, Security Requirements 
for Unclassified Information Technology Resources, which requires the 
implementation of an Information Technology Security Plan to protect 
information processed, stored, or transmitted from unauthorized access, 
alteration, disclosure, or use.
    (e) The contracting officer may require the contractor to 
demonstrate how it is complying with the clause at 1852.227-73, 
Handling and Protection of Restricted Information, to protect from 
unauthorized use or disclosure any restricted information provided 
under the contract that is either marked with a restrictive legend 
indicating that use and disclosure of the information is restricted or 
is specifically identified in the contract or in writing by the 
Contracting Officer as being subject to restrictions.

[[Page 9863]]

1827.405-71  Release of contractors' restricted information.

    Pursuant to the clause at 1852.227-74, Release of Restricted 
Information, offerors and contractors agree that NASA may release their 
restricted information to other contractors in accordance with the 
procedures prescribed in 1827.405-70 and subject to the safeguards and 
protections delineated in the clause at 1852.227-73, Handling and 
Protection of Restricted Information. As required by the clause at 
1852.227-74, contractors must identify information they claim to be 
restricted information submitted in the course of performing a contract 
by suitably marking such restricted information with a legend 
indicating that use and disclosure of the information is restricted. 
The contracting officer shall evaluate all contractor claims regarding 
such restricted information in deciding how NASA should respond to 
requests from requiring organizations and contractors for access to 
restricted information.


1827.405-72  NASA contract clauses.

    (a) The contracting officer shall insert the clause at 1852.227-73, 
Handling and Protection of Restricted Information, in all 
solicitations, contracts, and basic ordering agreements, unless the 
contracting officer determines that contract performance will not 
require access to restricted information.
    (b) The contracting officer shall insert the clause at 1852.227-74, 
Release of Restricted Information, in all solicitations, contracts, and 
basic ordering agreements.

PART 1837--SERVICE CONTRACTING


1837.203-70, 1837.203-71, and 1837.203-72  [Removed]

    4. Remove sections 1837.203-70, 1837.203-71, and 1837.203-72.

PART 1852--SOLICITATION PROVISIONS AND CONTRACT CLAUSES

    5. Add sections 1852.227-73 and 1852.227-74 to read as follows:


1852.227-73  Handling and Protection of Restricted Information.

    As prescribed in 1827.405-72(a), insert the following clause:

HANDLING AND PROTECTION OF RESTRICTED INFORMATION

    (XX/XX)
    (a) Definition. ``Restricted information,'' as used in this 
clause, means recorded information, regardless of form or the media 
on which it may be recorded, the use and dissemination of which is 
restricted, and includes:
    (1) Limited rights data;
    (2) Restricted computer software;
    (3) Information incidental to contract administration, such as 
financial, administrative, cost or pricing, or management 
information that embody trade secrets or are commercial or financial 
and confidential or privileged; and
    (4) Information designated by NASA as Sensitive But Unclassified 
(SBU).
    (b) Restrictions on use and disclosure of restricted 
information. With regard to any restricted information to which the 
Contractor is given access in performance of this contract that is 
either marked with a restrictive legend indicating that use and 
disclosure of the information is restricted or is specifically 
identified in this contract or in writing by the Contracting Officer 
as being subject to this clause, the Contractor agrees to:
    (1) Use such restricted information only for the purposes of 
performing the services specified in this contract, and not 
appropriate the restricted information to its own or another's use;
    (2) Safeguard the restricted information from unauthorized use 
and disclosure;
    (3) Allow access to the restricted information only to those 
employees and subcontractors that need it to perform services under 
this contract;
    (4) Preclude access and disclosure of the restricted information 
to persons and entities outside of the Contractor's or its 
subcontractor's organization(s);
    (5) Inform employees who may require access to the restricted 
information about obligations to use it only to perform the services 
specified in this contract and to safeguard it from unauthorized use 
and disclosure;
    (6) Require that each employee that has access to restricted 
information complies with the obligations regarding restricted 
information included in this clause; and
    (7) Return or dispose of the restricted information, as NASA may 
direct, when the restricted information is no longer needed for 
performance of work under this contract.
    (c) Exceptions.
    (1) The obligations and prohibitions of paragraph (b) do not 
apply to restricted information which the Contractor can demonstrate 
to the Contracting Officer--
    (i) Was publicly available at the time of receipt by the 
Contractor or thereafter becomes publicly available without breach 
of this contract;
    (ii) Was known to, in the possession of, or developed by or for 
the Contractor independently of the restricted information received 
from the Government and such knowledge, possession, or independent 
development can be shown;
    (iii) Was received by the Contractor from a party other than the 
owner of the restricted information, who has the authority to 
release the restricted information and did not require the 
Contractor to hold it in confidence; or
    (iv) Is released to or becomes available to a third party on an 
unrestricted basis from the owner of the restricted information, 
someone acting under the owner's control, or with the prior written 
approval of the owner.
    (2) Under a valid order of a court or Government agency, the 
Contractor may release restricted information to which the 
Contractor is given access in performance of this contract, provided 
that the Contractor provides prior written notice to the owner of 
the restricted information of such obligation and the opportunity to 
oppose such disclosure. The Contractor shall provide a copy of the 
notice to the Contracting Officer.
    (d) In the event that restricted information provided to the 
Contractor includes a restrictive legend that the Contractor deems 
to be ambiguous or unauthorized, the Contractor must notify the 
Contracting Officer of such condition. Notwithstanding such a 
notification, as long as the restrictive legend provides an 
indication that a restriction on use or disclosure was intended, the 
Contractor will treat the restricted information pursuant to the 
requirements of this clause unless otherwise directed in writing by 
the Contracting Officer or the owner of the restricted information.
    (e) Other contractual restrictions on restricted information. 
This clause is subordinate to all other contract clauses or 
requirements that specifically address the access, use, handling, 
protection or disclosure of information. If any restrictions or 
authorizations in this clause are inconsistent with a requirement of 
any other clause of this contract, the requirement of the other 
clause shall take precedence over the requirement of this clause. 
Third party limited rights data and restricted computer software 
will be provided under this contract only as authorized by the 
clause at 52.227-14, Rights in Data--General, Alternates II and III 
(as modified by 1852.227-14, if applicable). If the Contractor 
believes there is a conflict between this clause and another clause 
in this contract regarding the access, use, handling, protection or 
disclosure of restricted information, the Contractor must consult 
with the Contracting Officer before taking subsequent actions under 
the other clause.
    (f) The Contracting Officer may require the Contractor to 
demonstrate how it is complying with this Handling and Protection of 
Restricted Information clause.
    (g) Remedies. Recognizing that this contract establishes a high 
standard of accountability and trust, the Contractor's breach of any 
of the conditions of this clause may provide grounds for the 
Government to--
    (1) Disqualify the Contractor from subsequent related 
contractual efforts;
    (2) Debar the Contractor for serious misconduct affecting 
present responsibility;
    (3) Terminate the Contractor for default; or
    (4) Pursue such other remedies as may be permitted by law, 
regulation, or this contract.
    (h) Subcontracts. The Contractor shall insert, or require the 
insertion of, this clause, including this paragraph (h), suitably 
modified to reflect the relationship of the parties, in all 
subcontracts (regardless of tier).

    (End of clause)


1852.227-74  Release of restricted information.

    As prescribed in 1827.405-72(b), insert the following clause:


[[Page 9864]]



RELEASE OF RESTRICTED INFORMATION

    (XX/XX)
    (a) Definition. ``Restricted information,'' as used in this 
clause, means recorded information, regardless of form or the media 
on which it may be recorded, the use and dissemination of which is 
restricted, and includes:
    (1) Limited rights data;
    (2) Restricted computer software;
    (3) Information incidental to contract administration, such as 
financial, administrative, cost or pricing, or management 
information that embody trade secrets or are commercial or financial 
and confidential or privileged; and
    (4) Information designated by NASA as Sensitive But Unclassified 
(SBU).
    (b) In performance of NASA contracts, contractors, as well as 
their subcontractors and their individual employees, may require 
access to restricted information in the Government's possession. The 
Contractor agrees that, where needed for the performance of a NASA 
contract, NASA may release to its contractors, and their 
subcontractors, restricted information delivered during the course 
of this contract. Additionally, offerors agree that restricted 
information submitted with their proposals may be provided to NASA 
service contractors that assist NASA with contract closeout. If 
suitably marked with a legend indicating that use and disclosure of 
restricted information is restricted, such restricted information 
will be subject to the enumerated protections mandated by this 
clause and the clause at 1852.227-73, Handling and Protection of 
Restricted Information. The Contractor's limited rights data and 
restricted computer software will be provided to other NASA 
contractors or subcontractors only as authorized by the clause at 
52.227-14, Rights in Data--General, Alternates II and III (as 
modified by 1852-227-14, if applicable).
    (c) For purposes of marking such restricted information, the 
Contractor may, in addition to any other notice or legend otherwise 
required (e.g., notices required under the clause at 52.227-14, 
Rights in Data--General, Alternates II and III), use a notice 
similar to the following:
    Mark the title page with the following legend:
    This document was submitted by [insert submitter's name] in 
performance Contract No. [insert contract no.]. Submitter asserts 
that this document contains restricted information that embodies 
trade secrets or is commercial or financial and privileged or 
confidential. Such information shall not be disclosed outside of 
NASA except in accordance with the clause at NFS 1852.227-73, 
Handling and Protection of Restricted Information. This restriction 
does not limit the Government's right to use this restricted 
information if it is obtained from another source without 
restriction. The restricted information subject to this notice is 
contained in pages [insert page numbers or other identification of 
pages].
    Mark each page containing restricted information the Contractor 
wishes to restrict with the following legend:
    This page contains restricted information and is subject to the 
restriction on the title page of this document.
    (d) The Contracting Officer shall evaluate restricted 
information marked in accordance with paragraph (c) of this clause. 
Unless the Contracting Officer decides, with the advice of Center 
legal counsel, that reasonable grounds exist to challenge the 
markings, NASA and its contractors and subcontractors, shall comply 
with all of the safeguards contained in paragraph (e) of this clause 
and the clause at 1852.227-73, Handling and Protection of Restricted 
Information.
    (e) To receive access to restricted information needed to assist 
NASA in accomplishing NASA mission activities and management and 
administrative functions, the Contractor or subcontractor must be 
operating under a contract that contains the clause at 1852.227-73, 
Handling and Protection of Restricted Information, which obligates 
the Contractor or subcontractor, with respect to restricted 
information marked with a legend indicating that use and disclosure 
of the information is restricted, to do the following:
    (1) Use such restricted information only for the purpose of 
performing the services specified in its contract, and not 
appropriate the restricted information to its own or another's use;
    (2) Safeguard such restricted information from unauthorized use 
and disclosure;
    (3) Allow access to such restricted information only to those 
employees and subcontractors that need it to perform services under 
the contract;
    (4) Preclude access and disclosure of such restricted 
information to persons and entities outside of the contractor's or 
its subcontractor's organization(s);
    (5) Inform employees who may require access to such restricted 
information about obligations to use it only to perform the services 
specified in its contract and to safeguard it from unauthorized use 
and disclosure;
    (6) Require that each employee that has access to restricted 
information complies with the obligations regarding restricted 
information included in this clause; and
    (7) Return or dispose of such restricted information, as NASA 
may direct, when the restricted information is no longer needed for 
performance of work under the contract.
    (f) Exceptions. The obligations and prohibitions of paragraph 
(e) of this clause do not apply to restricted information which the 
receiving contractor can demonstrate to the Contracting Officer--
    (1) Was publicly available at the time of receipt by the 
receiving contractor or thereafter becomes publicly available 
without breach of the receiving contractor's contract;
    (2) Was known to, in the possession of, or developed by or for 
the receiving contractor independently of the restricted information 
received from the Government and such knowledge, possession, or 
independent development can be shown;
    (3) Was received by the receiving contractor from a party other 
than the owner of the restricted information, who has the authority 
to release the restricted information and did not require the 
receiving contractor to hold it in confidence;
    (4) Is released to or becomes available to a third party on an 
unrestricted basis from the owner of the restricted information, 
someone acting under the owner's control, or with the prior written 
approval of the owner; or
    (5) Is required to be released under a valid order of a court or 
Government agency, provided that the Contractor provides prior 
written notice to the owner of the restricted information of such 
obligation and the opportunity to oppose such disclosure.
    (g) When a contractor will have primary responsibility for 
operating an information technology system for NASA that contains 
restricted information, the contractor's contract shall also include 
the clause at 1852.204-76, Security Requirements for Unclassified 
Information Technology Resources. The Security Requirements clause 
requires the contractor to implement an Information Technology 
Security Plan to protect information processed, stored, or 
transmitted from unauthorized access, alteration, disclosure, or 
use. Contractor personnel requiring privileged access or limited 
privileged access to these information technology systems are 
subject to screening using the standard National Agency Check (NAC) 
forms appropriate to the level of risk for adverse impact to NASA 
missions. The Contracting Officer may allow the Contractor to 
conduct its own screening, provided the contractor employs 
substantially equivalent screening procedures.
    (h) This clause does not affect NASA's responsibilities under 
the Freedom of Information Act.
    (i) Subcontracts. The Contractor shall insert, or require the 
insertion of, this clause, including this paragraph (i), suitably 
modified to reflect the relationship of the parties, in all 
subcontracts (regardless of tier).

    (End of clause)


1852.237-72 and 1852.237-73  [Removed]

    6. Remove sections 1852.237-72 and 1852.237-73.

[FR Doc. 2010-4408 Filed 3-3-10; 8:45 am]
BILLING CODE 7510-01-P