Section H 

H.16.3 CAR 1352.239 73 SECURITY REQUIREMENTS FOR INFORMATION 

TECHNOLOGY RESOURCES 

(a)  This clause is applicable to all contracts that include information technology 

resources or services in which the Contractor must have physical or electronic 

access to DOC's sensitive or classified information, which is contained in 

systems that directly support the mission of the Agency. For purposes of this 

clause the term  Sensitive  is defined by the guidance set forth in: 

(1) The DOC IT Security Program Policy and Minimum Implementation 

Standards (

http://www.osec.doc.gov/cio/itmhweb/itmhweb1.html

); 

(2)  The Office of Management and Budget (OMB) Circular A 130, Appendix 

III, Security of Federal Automated Information Resources, 

(

http://csrc.nist.gov/secplcy/a130app3.txt

) which states that there is a 

 presumption that all [general support systems] contain some sensitive 

information  and; 

(3)  The Computer Security Act of 1987 (P.L. 100 235) 

(

http://www.epic.org/crypto/csa/csa.html

), including the following definition 

of the term sensitive information    any information, the loss, misuse, or 

unauthorized access, to or modification of which could adversely affect 

the national interest or the, conduct of federal programs, or the privacy to 

which individuals are entitled under section 552 a of title 5, Unites States 

Code (The Privacy Act), but which has not been specifically authorized 

under criteria established by an Executive Order or an Act of Congress to 

be kept secret in the interest of national defense or foreign policy.  

For purposes of this clause, the term  Classified  is defined by the guidance set 

forth in: 

(1) The DOC IT Security Program Policy and Minimum Implementation 

Standards, Section 3.3.1.4 

(

http://www.osec.doc.gov/cio/itmhweb/itmhweb1.html

). 

(2) The DOC Security Manual, Chapter 18 

http://www.osec.doc.gov/osy/

). 

(3) Executive Order 12958, as amended, Classified National Security 

Information. Classified or national security information is information 

that has been specifically authorized to be protected from 

unauthorized disclosure in the interest of national defense or foreign 

policy under an Executive Order or Act of Congress. 

Information technology resources include, but are not limited to, hardware, 

application software, system software, and information (data). Information 

technology services include, but are not limited to, the management, operation 

(including input, processing, transmission, and output), maintenance, 

programming, and system administration of computer systems, networks, and 

telecommunications systems. The Contractor shall be responsible for 

implementing sufficient Information Technology security, to reasonably  

33