safeguarding or cyber incident reporting pertaining to its
unclassified information systems as required by other applicable
clauses of this contract, or as a result of other applicable
Government statutory or regulatory requirements.
    (o) Subcontract flowdown requirements. The Contractor shall--
    (1) Include this clause, including this paragraph (o), in
subcontracts, or similar contractual instruments, for operationally
critical support, or for which subcontract performance will involve
DOT sensitive data, including subcontracts for commercial products
and commercial services, without alteration, except to identify the
parties. The Contractor shall determine if the information required
for subcontractor performance retains its identity as DOT sensitive
data and will require protection under this clause, and, if
necessary, consult with the Contracting Officer; and
    (2) Require subcontractors to--
    (i) Notify the prime Contractor (or next higher-tier
subcontractor) when submitting a request to vary from a NIST SP 800-
171, Rev. 2 security requirement to the Contracting Officer, in
accordance with paragraph (b)(2)(iii) of this clause; and
    (ii) Provide the incident report number, automatically assigned
by DOT, to the prime Contractor (or next higher-tier subcontractor)
as soon as practicable, when reporting a cyber incident to DOT as
required in paragraph (c) of this clause.
(End of clause)

1252.239-75  DOT Protection of Information About Individuals, PII, and
Privacy Risk Management Requirements.

    As prescribed in 1239.7104, insert the following clause:

DOT Protection of Information About Individuals, PII, and Privacy Risk
Management Requirements (NOV 2022)

    (a) Compliance with standards. To the extent Contractor creates,
maintains, acquires, discloses, uses, or has access to PII in
furtherance of the contract, Contractor shall comply with all
applicable Federal law, guidance, and standards and DOT policies
pertaining to its protection. Contractor shall notify DOT in writing
immediately upon the discovery that Contractor is no longer in
compliance with DOT data protection standards with respect to any
PII.
    (b) Unanticipated threats. If new or unanticipated threats or
hazards are discovered by either the Government or the Contractor,
or if existing safeguards have ceased to function, the discoverer
shall immediately bring the situation to the attention of the other
party.
    (c) Privacy Act. The Contractor will--
    (1) Comply with the Privacy Act of 1974, 5 U.S.C. 552a, DOT
implementing regulations (49 CFR part 10), and DOT policies issued
under the Act in the design, development, and/or operation of any
system of records on individuals to accomplish a DOT function when
the contract specifically identifies the work that the Contractor is
to perform.
    (2) Include the Privacy Act notification contained in this
contract in every solicitation and resulting subcontract and in
every subcontract awarded without a solicitation, when the work
statement in the proposed subcontract requires the redesign,
development, and/or operation of a system of records on individuals
that is subject to the Act; and
    (3) Include this clause, including this paragraph (c), in all
subcontracts awarded under this contract which requires the design,
development, and/or operation of such a system of records.
    (d) Privacy Act records. The Contractor shall not release
records subject to the Privacy Act except by the direction of the
DOT, regardless of whether DOT or the Contractor maintains the
records.
    (e) Confidentiality agreement. Contractor agrees to execute a
confidentiality agreement protecting PII, when necessary, and
further agrees not to appropriate such PII for its own use or to
disclose such information to third parties unless specifically
authorized by DOT in writing.
    (f) Surrender of records. If at any time during the term of the
Contract any part of PII, in any form, that Contractor obtains from
or on behalf of DOT ceases to be required by Contractor for the
performance of its obligations under the Contract, or upon
termination of the Contract, whichever occurs first, Contractor
shall, within ten (10) business days, notify DOT and securely return
such PII to DOT, or, at DOT's written request destroy, un-install
and/or remove all copies of such PII in Contractor's possession or
control, or such part of the PII which relates to the part of the
Contract which is terminated, or the part no longer required, as
appropriate, and certify to DOT that the requested action has been
completed.
    (g) NIST FIPS 140-2. At a minimum, the Contractor shall protect
all PII created, collected, used, maintained, or disseminated on
behalf of the Department using controls consistent with Federal
Information Processing Standard Publication 199 (FIPS 199) moderate
confidentiality standards, unless otherwise authorized by the DOT
Chief Privacy Officer.
    (h) Protection of sensitive information. The Contractor shall
comply with Government and DOT guidance for protecting PII.
    (i) Breach. The Contractor shall bear all costs, losses, and
damages resulting from the Contractor's breach of these clauses.
Contractor agrees to release, defend, indemnify, and hold harmless
DOT for claims, losses, penalties, and damages and costs to the
extent arising out of Contractor's, or its subcontractor's,
negligence, unauthorized use or disclosure of PII and/or
Contractor's, or its subcontractor's, breach of its obligations
under these clauses.
    (j) Breach reporting. Contractors shall report breaches
involving PII directly to DOT at<PHONE_NUMBER> or 1-(866)-466-5221
within two (2) hours of discovery. Contractor shall provide the
incident number automatically assigned by DOT for all breaches
reported by the Contractor or any subcontractors to the Contracting
Officer.
    (k) Applicability. Contractor shall inform all principals,
officers, employees, agents and subcontractors engaged in the
performance of this contract of the obligations contained in these
clauses.
    (l) Training. To the extent necessary and/or required by law,
the Contractor shall provide training to employees, agents, and
subcontractors to promote compliance with these clauses. The
Contractor is liable for any breach of these clauses by any of its
principals, officers, employees, agents, and subcontractors.
    (m) Subcontractor engagement. When the Contractor engages a
subcontractor in connection with its performance under the contract,
and the Contractor provides such subcontractor access to PII, the
Contractor shall provide the Contracting Officer with prompt notice
of the identity of the subcontractor and the extent of the role that
the subcontractor will play in connection with the performance of
the contract. This obligation is in addition to any limitations of
subcontracting and consent to subcontract requirements identified
elsewhere in the clauses and provisions of this contract.
    (n) Subcontract flowdown requirements. Contractors shall flow
down this clause to all subcontracts and purchase orders or other

agreements and require that subcontractors incorporate this clause
in their subcontracts, appropriately modified for identification of
the parties. The Contractor shall enforce the terms of the clause,
including action against its subcontractors, their employees and
associates, or third-parties, for noncompliance. All subcontractors
given access to any PII must agree to--
    (1) Abide by the clauses set forth herein, including, without
limitation, provisions relating to compliance with data privacy
standards for the Protection of Data about Individuals, Breach
Notification Controls, and Notice of Security and/or Privacy
Incident;
    (2) Restrict use of PII only for subcontractor's internal
business purposes and only as necessary to render services to
Contractor in connection with Contractor's performance of its
obligations under the contract;
    (3) Certify in writing, upon completion of services provided by
a subcontractor, that the subcontractor has returned to the
Contractor all records containing PII within 30 days of
subcontractor's completion of services to Contractor. Failure of
subcontractor to return all records containing PII within this
period will be reported to DOT as a privacy incident; and
    (4) Report breaches involving PII directly to DOT at (202) 385-
4357 or 1-(866)-466-5221 within two (2) hours of discovery.
Subcontractors shall provide the incident report number
automatically assigned by DOT to the prime contractor. Lower-tier
subcontractors, likewise, shall report the incident report number
automatically assigned by DOT to their higher-tier subcontractor
until the prime contractor is reached. Contractor shall provide the
DOT incident number to the Contracting Officer.
(End of clause)

1252.239-76  Cloud Computing Services.

    As prescribed in 1239.7204(a), insert the following clause:

Cloud Computing Services (NOV 2022)

    (a) Definitions. As used in this clause--
    Authorizing official, as described in Appendix B of DOT Order
1350.37, Departmental Cybersecurity Policy, means the senior Federal
official or executive with the responsibility for operating an
information system at an acceptable level of risk to organizational
operations (including mission, functions, image, or reputation),
organizational assets, individuals, other organizations, and the
Nation.
    Cloud computing means a model for enabling ubiquitous,
convenient, on-demand network access to a shared pool of
configurable computing resources (e.g., networks, servers, storage,
applications, and services) that can be rapidly provisioned and
released with minimal management effort or service provider
interaction. This includes other commercial terms, such as on-demand
self-service, broad network access, resource pooling, rapid
elasticity, and measured service. It also includes commercial
offerings for software-as-a-service, infrastructure-as-a-service,
and platform-as-a-service.
    Compromise means disclosure of information to unauthorized
persons, or a violation of the security policy of a system, whereby
without authorization information is disclosed, modified, destroyed,
lost, or copied to unauthorized media--whether intentionally or
unintentionally.
    Cyber incident means actions taken through the use of computer
networks that result in a compromise or an actual or potentially
adverse effect on an information system and/or the information
residing therein.
    Government data means any information, document, media, or
material regardless of physical form or characteristics, that is
created or obtained by the Government in the course of official
Government business.
    Government-related data means any information, document, media,
or material regardless of physical form or characteristics that is
created or obtained by a Contractor through the storage, processing,
or communication of Government data. This does not include
contractor's business records e.g., financial records, legal records
etc. or data such as operating procedures, software coding, or
algorithms that are not uniquely applied to the Government data.
    Information system means a discrete set of information resources
organized for the collection, processing, maintenance, use, sharing,
dissemination, or disposition of information.
    Media means physical devices or writing surfaces including, but
not limited to, magnetic tapes, optical disks, magnetic disks,
large-scale integration memory chips, and printouts onto which
information is recorded, stored, or printed within an information
system.
    Spillage security incident means an incident that results in the
transfer of classified information onto an information system not
accredited (i.e., authorized) for the appropriate security level.
    (b) Cloud computing security requirements. The requirements of
this clause are applicable when using cloud computing to provide
information technology services in the performance of the contract.
    (1) If the Contractor indicated in its offer that it does not
anticipate the use of cloud computing services in the performance of
a resultant contract, and after the award of this contract, the
Contractor proposes to use cloud computing services in the
performance of the contract, the Contractor shall obtain approval
from the Contracting Officer prior to utilizing cloud computing
services in performance of the contract.
    (2) The Contractor shall implement and maintain administrative,
technical, and physical safeguards and controls with the security
level and services required in accordance with the DOT Order
1351.37, Departmental Cybersecurity Policy, and the requirements of
DOT Order 1351.18, Departmental Privacy Risk Management Policy (the
versions of each that in effect at the time the solicitation is
issued or as authorized by the Contracting Officer), unless notified
by the Contracting Officer that this requirement has been waived by
the DOT Chief Information Officer.
    (3) The Contractor shall maintain all Government data not
physically located on DOT premises within the United States, the
District of Columbia, and all territories and possessions of the
United States, unless the Contractor receives written notification
from the Contracting Officer to use another location, in accordance
with DOT Policy.
    (4) DOT will determine the security classification level for the
cloud system in accordance with Federal Information Processing
Standard 199; the Contractor will then apply the appropriate set of
impact baseline controls as required in the FedRAMP Cloud Computing
Security Requirements Baseline document to ensure compliance with
security standards. The FedRAMP baseline controls are based on NIST
Special Publication 800-53, Revision 5, Security and Privacy
Controls for Information Systems and Organizations, Security Control
Baselines and also includes a set of additional controls for use
within systems providing cloud services to the Federal government.
    (5) The Contractor shall maintain a security management
continuous monitoring environment that meets or exceeds the
requirements in the Reporting and Continuous Monitoring section of
this contract/task order ___ [Fill-in: Contracting Officer enter the
requirements document paragraph reference number] based upon the
latest edition of FedRAMP Cloud Computing Security Requirements
Baseline and FedRAMP Continuous Monitoring Requirements.
    (6) The Contractor shall be responsible for the following
privacy and security safeguards:
    (i) To the extent required to carry out the FedRAMP assessment
and authorization process and FedRAMP continuous monitoring, to
safeguard against threats and hazards to the security, integrity,
and confidentiality of any non-public Government data collected and
stored by the Contractor, the Contractor shall provide the
Government access to the Contractor's facilities, installations,
technical capabilities, operations, documentation, records, and
databases.
    (ii) The Contractor shall also comply with any additional
FedRAMP and DOT Orders containing cybersecurity and privacy
policies.
    (7) The Government may perform manual or automated audits,
scans, reviews, or other inspections of the vendor's IT environment
being used to provide or facilitate services for the Government. In
accordance with the Federal Acquisition Regulation (FAR) clause
52.239-1, Privacy or Security Safeguards, the Contractor shall
provide the Government access to Contractor's facilities,
installations, technical capabilities, operations, documentation,
records and databases to carry out a program of inspection.
Contractors shall provide access within two hours of notification by
the Government. The program of inspection shall include, but is not
limited to--
    (i) Authenticated and unauthenticated operating system/network
vulnerability; scans;
    (ii) Authenticated and unauthenticated web application
vulnerability scans;
    (iii) Authenticated and unauthenticated database application
vulnerability scans; and

    (8) Automated scans can be performed by Government personnel, or
agents acting on behalf of the Government, using Government operated
equipment, and Government specified tools.
    (9) If new or unanticipated threats or hazards are discovered by
either the Government or the Contractor, or if existing safeguards
have ceased to function, the discoverer shall immediately bring the
situation to the attention of the other party.
    (10) If the vendor chooses to run its own automated scans or
audits, results from these scans may, at the Government's
discretion, be accepted in lieu of Government performed
vulnerability scans. In these cases, the Government will approve
scanning tools and their configuration. In addition, the Contractor
shall provide complete results of vendor-conducted scans to the
Government.
    (c) Limitations on access to and use and disclosure of
Government data and Government-related data.
    (1) The Contractor shall not access, use, or disclose Government
data unless specifically authorized by the terms of this contract or
a task order or delivery order issued hereunder.
    (i) If authorized by the terms of this contract or a task order
or delivery order issued hereunder, any access to, or use or
disclosure of, Government data shall only be for purposes specified
in this contract or task order or delivery order.
    (ii) The Contractor shall ensure that its employees are subject
to all such access, use, and disclosure prohibitions and
obligations.
    (iii) These access, use, and disclosure prohibitions and
obligations shall survive the expiration or termination of this
contract.
    (2) The Contractor shall use Government-related data only to
manage the operational environment that supports the Government data
and for no other purpose unless otherwise permitted with the prior
written approval of the Contracting Officer.
    (d) Cloud computing services cyber incident reporting. The
Contractor shall report all cyber incidents related to the cloud
computing service provided under this contract. to DOT via the DOT
Security Operations Center (SOC) 24 hours-a-day, 7 days-a-week, 365
days a year (24x7x365) at phone number:<PHONE_NUMBER> (Toll Free:
866-580-1852) within 2 hours of discovery.
    (e) Spillage. Upon notification by the Government of a spillage,
or upon the Contractor's discovery of a spillage, the Contractor
shall cooperate with the Contracting Officer to address the spillage
in compliance with agency procedures.
    (f) Malicious software. The Contractor or subcontractor(s) that
discovers and isolates malicious software in connection with a
reported cyber incident shall submit the malicious software in
accordance with instructions provided by the Contracting Officer.
    (g) Media preservation and protection. When a Contractor
discovers a cyber incident has occurred, the Contractor shall
preserve and protect images of all known affected information
systems identified in the cyber incident report (see paragraphs
(b)(5) and (d) of this clause) and all relevant monitoring/packet
capture data for at least 90 days from the submission of the cyber
incident report to allow DOT to request the media or decline
interest.
    (h) Access to additional information or equipment necessary for
forensic analysis. Upon request by DOT, the Contractor shall provide
DOT with access to additional information or equipment that is
necessary to conduct a forensic analysis.
    (i) Cyber incident damage assessment activities. If DOT elects
to conduct a damage assessment, the Contracting Officer will request
that the Contractor provide all of the damage assessment information
gathered in accordance with paragraph (b)(7) of this clause.
    (j) Subcontract flowdown requirement. The Contractor shall
include this clause, including this paragraph (j), in all
subcontracts that involve or may involve cloud services, including
subcontracts for commercial products or commercial services.
(End of clause)

1252.239-77  Data Jurisdiction.

    As prescribed in 1239.7204(b), insert a clause substantially as
follows:

Data Jurisdiction (NOV 2022)

    The Contractor shall identify all data centers in which the data
at rest or data backup will reside, including primary and replicated
storage. The Contractor shall ensure that all data centers not
physically located on DOT premises reside within the United States,
the District of Columbia, and all territories and possessions of the
United States, unless otherwise authorized by the DOT CIO. The
Contractor shall provide a Wide Area Network (WAN), with a minimum
of ___ [Contracting Officer fill-in: Insert specific number] data
center facilities at ___ [Contracting Officer fill-in number]
different geographic locations with at least ___ [Contracting
Officer fill-in number] internet Exchange Point (IXP) for each price
offering. The Contractor shall provide internet bandwidth at the
minimum of ___ [Contracting Officer fill-in applicable gigabytes]
GB.
(End of clause)

1252.239-78  Validated Cryptography for Secure Communications.

    As prescribed in 1239.7204(c), insert a clause substantially as
follows:

Validated Cryptography for Secure Communications (NOV 2022)

    (a) The Contractor shall use only cryptographic mechanisms that
comply with ___ [Contracting Officer insert FIPS 140-2 level #]. All
deliverables shall be labeled ___ [Contracting Officer insert
appropriate label such as ``For Official Use Only'' (FOUO) or other
DOT-agency selected designation per document sensitivity].
    (b) External transmission/dissemination of ___ [Contracting
Officer fill-in: e.g., labeled deliverables] to or from a Government
computer must be encrypted. Certified encryption modules must be
used in accordance with ___ [Contracting Officer shall insert the
standard, such as FIPS PUB 140-2, ``Security requirements for
Cryptographic Modules.''
(End of clause)

1252.239-79  Authentication, Data Integrity, and Non-Repudiation.

    As prescribed in 1239.7204(d), insert a clause substantially as
follows:

Authentication, Data Integrity, and Non-Repudiation (NOV 2022)

    The Contractor shall provide a [Fill-in: Contracting Officer
fill-in the ``cloud service'' name] system that implements ___
[Contracting Officer insert the required level (1-4) of FIPS 140-2
encryption standard] that provides for origin authentication, data
integrity, and signer non-repudiation.
(End of clause)

1252.239-80  Audit Record Retention for Cloud Service Providers.

    As prescribed in 1239.7204(e), insert the following clause:

Audit Record Retention for Cloud Service Providers (NOV 2022)

    (a) The Contractor shall support a system in accordance with the
requirement for Federal agencies to manage their electronic records
in accordance with 36 CFR 1236.20 and 1236.22, including but not
limited to capabilities such as those identified in DoD STD-5015.2
V3, Electronic Records Management Software Applications Design
Criteria Standard, NARA Bulletin 2008-05, July 31, 2008, Guidance
concerning the use of email archiving applications to store email,
and NARA Bulletin 2010-05 September 08, 2010, Guidance on Managing
Records in Cloud Computing Environments.
    (b) The Contractor shall maintain records to retain
functionality and integrity throughout the records' full lifecycle
including--
    (1) Maintenance of links between records and metadata; and
    (2) Categorization of records to manage retention and disposal,
either through transfer of permanent records to NARA or deletion of
temporary records in accordance with NARA approved retention
schedules.
(End of clause)

1252.239-81  Cloud Identification and Authentication (Organizational
Users) Multi-Factor Authentication.

    As prescribed in 1239.7204(f), insert the following clause:

Cloud Identification and Authentication (Organizational Users) Multi-
Factor Authentication (NOV 2022)

    The Contractor shall support a secure, multi-factor method of
remote authentication and authorization to identified Government
Administrators that will allow Government-designated personnel the
ability to perform management duties on the system. The Contractor
shall support multi-factor authentication in accordance with
National Institute of Standards and Technology (NIST) Federal
Information Processing Standards (FIPS) Publication (PUB) Number
201-2,

Personal Identity Verification (PIV) of Federal Employees and
Contractors, and OMB implementation guidance for personal identity
verification.
(End of clause)

1252.239-82  Identification and Authentication (Non-Organizational
Users).

    As prescribed in 1239.7204(g), insert the following clause:

Identification and Authentication (Non-Organizational Users) (NOV 2022)

    The Contractor shall support a secure, multi-factor method of
remote authentication and authorization to identified Contractor
Administrators that will allow Contractor designated personnel the
ability to perform management duties on the system as required by
the contract.
(End of clause)

1252.239-83  Incident Reporting Timeframes.

    As prescribed in 1239.7204(h), insert the following clause:

Incident Reporting Timeframes (NOV 2022)

    (a) The Contractor shall report all computer security incidents
to the DOT Security Operations Center (SOC) in accordance with
Subpart 1239.70--Information Security and Incident Response
Reporting.
    (b) Contractors and subcontractors are required to report cyber
incidents directly to DOT via the DOT SOC 24 hours-a-day, 7 days-a-
week, 365 days a year (24x7x365) at phone number:<PHONE_NUMBER> (Toll
Free:<PHONE_NUMBER>) within 2 hours of discovery, regardless of the
incident category. See 1252.239-74, Safeguarding DOT Sensitive Data
and Cyber Incident Reporting.
(End of clause)

1252.239-84  Media Transport.

    As prescribed in 1239.7204(i), insert a clause substantially as
follows:

Media Transport (NOV 2022)

    (a) The Contractor shall document activities associated with the
transport of DOT information stored on digital and non-digital media
and employ cryptographic mechanisms to protect the confidentiality
and integrity of this information during transport outside of
controlled areas. This applies to--
    (1) Digital media containing DOT or other Federal agency or
other sensitive or third-party provided information that requires
protection must be encrypted using FIPS 140-2 [Contracting Officer
insert required encryption mode, based on FIPS 199 risk category]
when transported outside of controlled areas; and
    (2) Nondigital media must be secured using the same policies and
procedures as paper.
    (b) Contractors shall ensure accountability for media containing
DOT or other Federal agency or other sensitive or third-party
provided information that is transported outside of controlled
areas. This can be accomplished through appropriate actions such as
logging and a documented chain of custody form.
    (c) DOT or other Federal agency sensitive or third-party
provided information that resides on mobile/portable devices (e.g.,
USB flash drives, external hard drives, and SD cards) must be
encrypted using FIPS 140-2 [Contracting Officer insert the required
encryption mode based on FIPS 199 risk category]. All Federal agency
data residing on laptop computing devices must be protected with
NIST-approved encryption software.
(End of clause)

1252.239-85  Personnel Screening--Background Investigations.

    As prescribed in 1239.7204(j), insert the clause as follows:

Personnel Screening--Background Investigations (NOV 2022)

    (a) Contractors shall provide support personnel who are U.S.
persons maintaining a NACI clearance or greater in accordance with
OMB memorandum M-05-24, Section C (see https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/memoranda/2005/m05-24.pdf).
    (b) The Contractor shall furnish documentation reflecting
favorable adjudication of background investigations for all
personnel supporting the system. The Contractor shall also comply
with Executive Order 12968, Access to Classified Information. DOT
separates the risk levels for personnel working on Federal computer
systems into three categories: low risk, moderate risk, and high
risk. The Contractor is responsible for the cost of meeting all
security requirements and maintaining assessment and authorization.
    (c) The Contractor's employees with access to DOT systems
containing sensitive information may be required to obtain security
clearances (i.e., Confidential, Secret, or Top Secret). National
Security work designated ``special sensitive,'' ``critical
sensitive,'' or ``non-critical sensitive,'' will determine the level
of clearance required for contractor employees. Personnel security
clearances for national security contracts in DOT will be processed
according to the Department of Defense National Industrial Security
Program Operating Manual (NISPOM).
    (d) The Contracting Officer, through the Contracting Officer's
Representative (COR) or Program Manager will ensure that all
required information is forwarded to the Federal Protective Service
(FPS) in accordance with the DOT Policy. FPS will then contact each
Applicant with instructions for completing required forms and
releases for the type of personnel investigation requested.
    (e) Applicants will not be reinvestigated if a prior favorable
adjudication is on file with FPS, OPM or DoD, there has been no
break in service, and the position is identified at the same or
lower risk level. Once a favorable FBI Criminal History Check
(Fingerprint Check) has been returned, Applicants may receive a DOT
identity credential (if required) and initial access to information
systems holding DOT information.
(End of clause)

1252.239-86  Boundary Protection--Trusted Internet Connections.

    As prescribed in 1239.7204(k), insert the clause as follows:

Boundary Protection--Trusted Internet Connections (NOV 2022)

    The Contractor shall ensure that Federal information, other than
non-sensitive information, being transmitted from Federal government
entities to external entities using cloud services is inspected by
Trusted internet Connections (TIC) processes or the Contractor shall
route all external connections through a Trusted internet Connection
(TIC).
(End of clause)

1252.239-87  Protection of Information at Rest.

    As prescribed in 1239.7204(l), insert the clause as follows:

Protection of Information at Rest and in Transit (NOV 2022)

    The Contractor shall provide security mechanisms for handling
data at rest and in transit in accordance with FIPS 140-2 ___
[Contracting officer insert encryption standard, based on NIST FIPS
199 categorization].
(End of clause)

1252.239-88  Security Alerts, Advisories, and Directives.

    As prescribed in 1239.7204(m), insert the clause as follows:

Security Alerts, Advisories, and Directives (NOV 2022)

    The Contractor shall provide a list of its personnel, identified
by name and role, who are assigned system administration,
monitoring, and/or security responsibilities and who are designated
to receive security alerts, advisories, and directives and
individuals responsible for the implementation of remedial actions
associated with them.
(End of clause)

1252.239-89  Technology Modernization.

    As prescribed in 1239.7303(a), insert the following clause:

Technology Modernization (NOV 2022)

    (a) Modernization approach. After issuance of the contract, the
Government may solicit, and the Contractor is encouraged to propose
independently, a modernization approach to the hardware, software,
specifications, or other requirements of the contract. This
modernization approach may be proposed to increase efficiencies
(both system and process level), reduce costs, or strengthen the
cyber security posture, or for any other purpose which presents an
advantage to the Government. Furthermore, the modernization approach
should, to the maximum extent practicable, align with how the
commercial sector would solve the problem.

    (b) Proposal requirements. As part of the proposed changes, the
Contractor shall submit a price or cost proposal to the Contracting
Officer for evaluation. Those proposed modernized improvements that
are acceptable to the Government will be processed as modifications
to the contract. At a minimum, the Contractor shall submit the
following information with each proposal:
    (1) A summary of how the modernized proposal aligns with the
commercial sector approach and how the current approach is out of
alignment/differs;
    (2) A description of the difference between the existing
contract requirement and the proposed change, and the comparative
advantages and disadvantages of each;
    (3) Itemized requirements of the contract that must be changed
if the proposal is adopted and the proposed revision to the contract
for each such change;
    (4) An estimate of the changes in performance and price or cost,
if any, that will result from adoption of the proposal;
    (5) An evaluation of the effects the proposed changes would have
on collateral costs to the Government, such as Government-furnished
property costs, costs of related items, and costs of maintenance,
operation and conversion (including Government application
software);
    (6) A statement of the schedule for contract modification
adopting the proposal that maximizes benefits of the changes during
the remainder of the contract, including supporting rationale; and
    (7) Identification of impacts on contract cost and schedule. The
Government is not liable for proposal preparation costs or for any
delay in acting upon any proposal submitted pursuant to this clause.
    (c) Withdrawal. The Contractor has a right to withdraw, in whole
or in part, any proposal not adopted by contract modification within
the period specified in the proposal. The decision of the
Contracting Officer whether to accept any such proposal under this
contract is final and not subject to the ``Disputes'' clause of this
contract.
    (d) Product testing. If the Government wishes to test and
evaluate any item(s) proposed, the Contracting Officer will issue
written directions to the Contractor specifying what item(s) will be
tested, where and when the item(s) will be tested, to whom the
item(s) is to be delivered, and the number of days (not to exceed 90
calendar days) that the item will be tested.
    (e) Contract modification. The Contracting Officer may accept
any proposal submitted pursuant to this clause by giving the
Contractor written notice thereof. This written notice will be given
by issuance of a modification to the contract. Until the Government
issues a modification incorporating a proposal under this contract,
the Contractor shall remain obligated to perform in accordance with
the requirements, terms, and conditions of the existing contract.
    (f) Change orders. If a proposal submitted pursuant to this
clause is accepted and applied to this contract, the equitable
adjustment increasing or decreasing the price or cost-plus-fixed-fee
(CPFF) shall be in accordance with the procedures of the applicable
``Changes'' clause incorporated by reference in the contract. The
resulting contract modification will state that it is made pursuant
to this clause.
(End of clause)

1252.239-90  Technology Upgrades/Refreshment.

    As prescribed in 1239.7303(b), insert the following clause:

Technology Upgrades/Refreshment (NOV 2022)

    (a) Upgrade/refreshment approach. After issuance of the
contract, the Government may solicit, and the Contractor is
encouraged to propose independently, technology improvements to the
hardware, software, specifications, or other requirements of the
contract. These improvements may be proposed to save money, to
improve performance, to save energy, to satisfy increased data
processing requirements, or for any other purpose that presents a
technological advantage to the Government. As part of the proposed
changes, the Contractor shall submit a price or cost proposal to the
Contracting Officer for evaluation. Those proposed technology
improvements that are acceptable to the Government will be processed
as modifications to the contract. As a minimum, the following
information shall be submitted by the Contractor with each proposal:
    (1) A description of the difference between the existing
contract requirement and the proposed change, and the comparative
advantages and disadvantages of each;
    (2) Itemized requirements of the contract that must be changed
if the proposal is adopted, and the proposed revision to the
contract for each such change;
    (3) An estimate of the changes in performance and price or cost,
if any, that will result from adoption of the proposal;
    (4) An evaluation of the effects the proposed changes would have
on collateral costs to the Government, such as Government-furnished
property costs, costs of related items, and costs of maintenance,
operation and conversion (including Government application
software);
    (5) A statement of the time by which the contract modification
adopting the proposal must be issued so as to obtain the maximum
benefits of the changes during the remainder of the contract
including supporting rationale; and
    (6) Identification of any impacts to contract completion time or
delivery schedule. The Government is not liable for proposal
preparation costs or for any delay in acting upon any proposal
submitted pursuant to this clause. The Contractor has a right to
withdraw, in whole or in part, any proposal not adopted by contract
modification within the period specified in the proposal. The
decision of the Contracting Officer whether to accept any such
proposal under this contract is final and not subject to the
``Disputes'' clause of this contract.
    (b) Test and evaluation. If the Government wishes to test and
evaluate any item(s) proposed, the Contracting Officer will issue
written directions to the Contractor specifying what item(s) will be
tested, where and when the item(s) will be tested, to whom the
item(s) is to be delivered, and the number of days (not to exceed 90
calendar days) that the item will be tested. The Contracting Officer
may accept any proposal submitted pursuant to this clause by giving
the Contractor written notice thereof. This written notice will be
given by issuance of a modification to the contract. Unless and
until a modification is executed to incorporate a proposal under
this contract, the Contractor shall remain obligated to perform in
accordance with the requirements, terms and conditions of the
existing contract. If a proposal submitted pursuant to this clause
is accepted and applied to this contract, the equitable adjustment
increasing or decreasing the price or CPFF shall be in accordance
with the procedures of the applicable ``Changes'' clause
incorporated by reference in Section I of the contract. The
resulting contract modification will state that it is made pursuant
to this clause.
(End of clause)

1252.239-91  Records Management.

    As prescribed in 1239.7403, insert the following clause:

Records Management (NOV 2022)

    (a) Definition.
    Federal record, as defined in 44 U.S.C. 3301, means all recorded
information, regardless of form or characteristics, made or received
by a Federal agency under Federal law or in connection with the
transaction of public business and preserved or appropriate for
preservation by that agency or its legitimate successor as evidence
of the organization, functions, policies, decisions, procedures,
operations, or other activities of the United States Government or
because of the informational value of data in them. The term Federal
record:
    (1) Includes all DOT records.
    (2) Does not include personal materials.
    (3) Applies to records created, received, or maintained by
Contractors pursuant to a DOT contract.
    (4) May include deliverables and documentation associated with
deliverables.
    (b) Requirements. (1) Compliance. Contractor shall comply with
all applicable records management laws and regulations, as well as
National Archives and Records Administration (NARA) records
policies, including but not limited to 44 U.S.C. chapters 21, 29,
31, and 33, NARA regulations at 36 CFR chapter XII, subchapter B,
and those policies associated with the safeguarding of records
covered by Privacy Act of 1974 (5 U.S.C. 552a). These policies
include the preservation of all records, regardless of form or
characteristics, mode of transmission, or state of completion.
    (2) Applicability. In accordance with 36 CFR 1222.32, all data
created for Government use and delivered to, or falling under, the
legal control of the Government, are Federal records subject to the
provisions of 44 U.S.C. chapters 21, 29, 31, and 33, the Freedom of
Information Act (FOIA) (5 U.S.C. 552), as amended, and the Privacy
Act of 1974 (5 U.S.C. 552a), as amended. Such Federal

records shall be managed and scheduled for disposition only as
permitted by the Federal Records Act, other relevant statutes or
regulations, and DOT Order 1351.28, Departmental Records Management
Policy.
    (3) Records maintenance. While DOT records are in the
Contractor's custody, the Contractor is responsible for preventing
the alienation or unauthorized destruction of DOT records, including
all forms of mutilation. Records may not be removed from the legal
custody of DOT or destroyed except in accordance with the provisions
of the agency records schedules and with the written concurrence of
the DOT or Component Records Officer, as appropriate. Willful and
unlawful destruction, damage or alienation of Federal records is
subject to the fines and penalties imposed by 18 U.S.C. 2701. In the
event of any unlawful or accidental removal, defacing, alteration,
or destruction of records, the Contractor must report the event to
the Contracting Officer in accordance with 36 CFR part 1230,
Unlawful or Accidental Removal, Defacing, Alteration, or Destruction
of Records, for reporting to NARA.
    (4) Unauthorized disclosure. The Contractor shall notify the
Contracting Officer within two hours of discovery of any inadvertent
or unauthorized disclosures of information, data, documentary
materials, records or equipment. Disclosure of non-public
information is limited to authorized personnel with a need-to-know
as described in the contract. The Contractor shall ensure that the
appropriate personnel, administrative, technical, and physical
safeguards are established to ensure the security and
confidentiality of this information, data, documentary material,
records and/or equipment. The Contractor shall not remove material
from Government facilities or systems, or facilities or systems
operated or maintained on the Government's behalf, without the
express written permission of the Contracting Officer. When
information, data, documentary material, records and/or equipment is
no longer required, it shall be returned to DOT control or the
Contractor must hold it until otherwise directed. Items returned to
the Government shall be hand carried, mailed, emailed, or securely
electronically transmitted to the Contracting Officer or address
prescribed in the contract. Destruction of records is expressly
prohibited unless in accordance with the contract.
    (c) Non-public information. The Contractor shall not create or
maintain any records containing any non-public DOT information that
are not specifically authorized by the contract.
    (d) Rights in data. Rights in data under this contract are set
forth in clauses prescribed by FAR part 27 and included in this
contract, (e.g., 52.227-14 Rights in Data--General). The Contractor
must make any assertion of copyright in the data or other
deliverables under this contract and substantiate such assertions.
The Contractor must add or correct all limited rights, restricted
rights, or copyright notices and take all other appropriate actions
in accordance with the terms of this contract and the clauses
included herein.
    (e) Notification of third-party access requests. The Contractor
shall notify the Contracting Officer promptly of any requests from a
third party for access to Federal records, including any warrants,
seizures, or subpoenas it receives, including those from another
Federal, State, or local agency. The Contractor shall cooperate with
the Contracting Officer to take all measures to protect Federal
records, from any unauthorized disclosure.
    (f) Training. All Contractor employees assigned to this contract
who create, work with, or otherwise handle records are required to
take DOT-provided records management training. The Contractor is
responsible for confirming to the Contracting Officer that training,
including initial training and any annual or refresher training, has
been completed in accordance with agency policies.
    (g) Subcontract flowdown requirements. (1) The Contractor shall
incorporate the substance of this clause, its terms and requirements
including this paragraph (g), in all subcontracts under this
contract, and require written subcontractor acknowledgment of same.
    (2) Violation by a subcontractor of any provision set forth in
this clause will be attributed to the Contractor.
(End of clause)

1252.239-92  Information and Communication Technology Accessibility
Notice.

    As prescribed in 1239.203-70(a), insert the following provision:

Information and Communication Technology Accessibility Notice (NOV
2022)

    (a) Any offeror responding to this solicitation must comply with
established DOT Information and Communication Technology (ICT)
(formerly known as Electronic and Information (EIT)) accessibility
standards. Information about Section 508 is available at https://www.section508.gov/.
    (b) The Section 508 accessibility standards applicable to this
solicitation are stated in the clause at 1252.239-81, Information
and Communication Technology Accessibility. In order to facilitate
the Government's determination whether proposed ICT supplies and
services meet applicable Section 508 accessibility standards,
offerors must submit appropriate Section 508 Checklists, in
accordance with the checklist completion instructions. The purpose
of the checklists is to assist DOT acquisition and program officials
in determining whether proposed ICT supplies or information,
documentation and services support conform to applicable Section 508
accessibility standards. The checklists allow offerors or developers
to self-evaluate their supplies and document--in detail--whether
they conform to a specific Section 508 accessibility standard, and
any underway remediation efforts addressing conformance issues.
    (c) Respondents to this solicitation must identify any exception
to Section 508 requirements. If an offeror claims its supplies or
services meet applicable Section 508 accessibility standards, and it
is later determined by the Government, i.e., after award of a
contract or order, that supplies or services delivered do not
conform to the described accessibility standards, remediation of the
supplies or services to the level of conformance specified in the
contract will be the responsibility of the Contractor at its
expense.
(End of provision)

1252.239-93  Information and Communication Technology Accessibility.

    As prescribed in 1239.203-70(b), insert the following clause:

Information and Communication Technology Accessibility (NOV 2022)

    (a) All Information and Communication Technology (ICT) supplies,
information, documentation and services support developed, acquired,
maintained or delivered under this contract or order must comply
with the Information and Communication Technology (ICT) Standards
and Guidelines (see 36 CFR parts 1193 and 1194). Information about
Section 508 is available at https://www.section508.gov/.
    (b) The Section 508 accessibility standards applicable to this
contract or order are identified in the Specification, Statement of
Work, or Performance Work Statement. If it is determined by the
Government that ICT supplies and services provided by the Contractor
do not conform to the described accessibility standards in the
contract, remediation of the supplies or services to the level of
conformance specified in the contract will be the responsibility of
the Contractor at its own expense.
    (c) The Section 508 accessibility standards applicable to this
contract are: ___ [Contracting Officer inserts the applicable
Section 508 accessibility standards].
    (d) In the event of a modification(s) to this contract or order,
which adds new ICT supplies or services or revises the type of, or
specifications for, supplies or services, the Contracting Officer
may require that the Contractor submit a completed Section 508
Checklist and any other additional information necessary to assist
the Government in determining that the ICT supplies or services
conform to Section 508 accessibility standards. If the Government
determines that ICT supplies and services provided by the Contractor
do not conform to the described accessibility standards in the
contract, remediation of the supplies or services to the level of
conformance specified in the contract will be the responsibility of
the Contractor at its own expense.
    (e) If this is an indefinite-delivery type contract, a Blanket
Purchase Agreement or a Basic Ordering Agreement, the task/delivery
order requests that include ICT supplies or services will define the
specifications and accessibility standards for the order. In those
cases, the Contractor may be required to provide a completed Section
508 Checklist and any other additional information necessary to
assist the Government in determining that the ICT supplies or
services conform to Section 508 accessibility standards. If it is
determined by the

Government that ICT supplies and services provided by the Contractor
do not conform to the described accessibility standards in the
provided documentation, remediation of the supplies or services to
the level of conformance specified in the contract will be the
responsibility of the Contractor at its own expense.
(End of clause)

1252.242-70  Dissemination of Information--Educational Institutions.

    As prescribed in 1242.270(a), insert the following clause:

Dissemination of Information--Educational Institutions (NOV 2022)

    (a) The Department of Transportation (DOT) desires widespread
dissemination of the results of funded transportation research. The
Contractor, therefore, may publish (subject to the provisions of the
``Data Rights'' and ``Patent Rights'' clauses of the contract)
research results in professional journals, books, trade
publications, or other appropriate media (a thesis or collection of
theses should not be used to distribute results because
dissemination will not be sufficiently widespread). All costs of
publication pursuant to this clause shall be borne by the Contractor
and shall not be charged to the Government under this or any other
Federal contract.
    (b) Any copy of material published under this clause must
contain acknowledgment of DOT's sponsorship of the research effort
and a disclaimer stating that the published material represents the
position of the author(s) and not necessarily that of DOT. Articles
for publication or papers to be presented to professional societies
do not require the authorization of the Contracting Officer prior to
release. However, two copies of each article shall be transmitted to
the Contracting Officer at least two weeks prior to release or
publication.
    (c) Press releases concerning the results or conclusions from
the research under this contract shall not be made or otherwise
distributed to the public without prior written approval of the
Contracting Officer.
    (d) Publication under the terms of this clause does not release
the Contractor from the obligation of preparing and submitting to
the Contracting Officer a final report containing the findings and
results of research, as set forth in the schedule of the contract.
(End of clause)

1252.242-71  Contractor Testimony.

    As prescribed in 1242.270(b), insert the following clause:

Contractor Testimony (NOV 2022)

    All requests for the testimony of the Contractor or its
employees, and any intention to testify as an expert witness
relating to: (a) any work required by, and/or performed under, this
contract; or (b) any information provided by any party to assist the
Contractor in the performance of this contract, shall be immediately
reported to the Contracting Officer. Neither the Contractor nor its
employees shall testify on a matter related to work performed or
information provided under this contract, either voluntarily or
pursuant to a request, in any judicial or administrative proceeding
unless approved, in advance, by the Contracting Officer or required
by a judge in a final court order.
(End of clause)

1252.242-72  Dissemination of Contract Information.

    As prescribed in 1242.270(c), insert the following clause:

Dissemination of Contract Information (NOV 2022)

    The Contractor shall not publish, permit to be published, or
distribute for public consumption, any information, oral or written,
concerning the results or conclusions made pursuant to the
performance of this contract, without the prior written consent of
the Contracting Officer. Two copies of any material proposed to be
published or distributed shall be submitted to the Contracting
Officer.
(End of clause)

1252.242-74  Contract Audit Support.

    As prescribed in 1242.170, insert the following clause:

Contract Audit Support (NOV 2022)

    The Government may at its sole discretion utilize certified
public accountant(s) to provide contract audit services in lieu of
the cognizant government audit agency to accomplish the contract
administration requirements of FAR parts 32 and 42 under the terms
and conditions of this contract. The audit services contractor
reviewing the Contractor's accounting systems and data will perform
this function in accordance with contract provisions which prohibit
disclosure of proprietary financial data or use of such data for any
purpose other than to perform the required audit services. The
Contractor shall provide access to accounting systems, records, and
data to the audit services contractor like that provided to the
cognizant government auditor.
(End of clause)

Subpart 1252.3--Provision and Clause Matrix

1252.301  Solicitation provisions and contract clauses (matrix).

    The TAR matrix is not published in the CFR. It is available on the
Acquisition.gov website at https://www.acquisition.gov/TAR.

PART 1253--FORMS

Subpart 1253.2--Prescription of Forms
Sec.
1253.204-70 Administrative matters--agency specified forms.
1253.227 Patents, data, and copyrights.
1253.227-3 Patent rights under Government contracts.
Subpart 1253.3--Forms Used in Acquisitions
1253.300-70 DOT agency forms.

    Authority:  5 U.S.C. 301; 41 U.S.C. 1121(c)(3); 41 U.S.C. 1702;
and 48 CFR 1.301 through 1.304.

Subpart 1253.2--Prescription of Forms

1253.204-70  Administrative matters--agency specified forms.

    The following forms are prescribed for use in the closeout of
applicable contracts, as specified in 1204.804-570:
    (a) Department of Transportation (DOT) Form DOT F 4220.4,
Contractor's Release. Form DOT F 4220.4 is authorized for local
reproduction and a copy may be obtained at https://www.transportation.gov/assistant-secretary-administration/procurement/tar-part-1253-forms.
    (b) Form DOT F 4220.45, Contractor's Assignment of Refunds,
Rebates, Credits, and Other Amounts. Form DOT F 4220.45 is authorized
for local reproduction and a copy may be obtained at https://www.transportation.gov/assistant-secretary-administration/procurement/tar-part-1253-forms.
    (c) Form DOT F 4220.46, Cumulative Claim and Reconciliation
Statement. Form DOT F 4220.46 is authorized for local reproduction and
a copy may be obtained at https://www.transportation.gov/assistant-secretary-administration/procurement/tar-part-1253-forms.
    (d) Department of Defense DD Form 882, Report of Inventions and
Subcontracts. DD Form 882 can be found at https://www.esd.whs.mil/Directives/forms/.

1253.227  Patents, data, and copyrights.

1253.227-3  Patent rights under Government contracts.

    The following form is prescribed as a means for contractors to
report inventions made during contract performance, as specified in
1227.305-4: Department of Defense DD Form 882, Report of Inventions and
Subcontracts. DD Form 882 can be found at https://www.esd.whs.mil/Directives/forms/.

Subpart 1253.3--Forms Used in Acquisitions

1253.300-70  DOT agency forms.

    This subpart identifies, in numerical sequence, agency forms that
are specified by the TAR for use in acquisitions. See table 1 to
1253.300-70. Forms are also accessible in Adobe PDF and Microsoft Word
files on the DOT Office of Senior Procurement Executive website at
https://www.transportation.gov/assistant-secretary-administration/procurement/tar-part-1253-forms.

         Table 1 to 1253.300-70--Forms Used in DOT Acquisitions
------------------------------------------------------------------------
                        Form name                            Form No.
------------------------------------------------------------------------
Contractor's Release Form...............................          4220.4
Contractor's Assignment of Refunds, Rebates, Credits,            4220.45
 and other Amounts......................................
Cumulative Claim and Reconciliation Statement...........         4220.46
------------------------------------------------------------------------

PARTS 1254-1299 [RESERVED]

[FR Doc. 2022-19907 Filed 10-6-22; 8:45 am]
BILLING CODE 4910-9X-P


[Federal Register Volume 81, Number 86 (Wednesday, May 4, 2016)]
[Rules and Regulations]
[Pages 26673-26675]
[FR Doc No: 2016-10160]

-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 39

[Docket No. FAA-2015-3982; Directorate Identifier 2015-NM-098-AD;
Amendment 39-18503; AD 2016-09-05]
RIN 2120-AA64

Airworthiness Directives; The Boeing Company Airplanes

AGENCY: Federal Aviation Administration (FAA), DOT.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: We are adopting a new airworthiness directive (AD) for certain
The Boeing Company Model 717-200 airplanes. This AD was prompted by
multiple reports of the vertical stabilizer leading edge showing signs
of fastener distress. This AD requires a detailed inspection for any
distress of the vertical stabilizer leading edge skin, and related
investigative and corrective actions if necessary. This AD also
requires, for certain airplanes, repetitive detailed inspections of the
spar cap for any loose and missing fasteners, repetitive eddy current
testing high frequency (ETHF) and radiographic testing (RT) inspections
of the spar cap for any crack, and related investigative and corrective
actions if necessary. We are issuing this AD to detect and correct any
crack in the vertical stabilizer leading edge and front spar cap, which
may result in the structure becoming unable to support limit load, and
may lead to the loss of the vertical stabilizer.

DATES: This AD is effective June 8, 2016.
    The Director of the Federal Register approved the incorporation by
reference of a certain publication listed in this AD as of June 8,
2016.

ADDRESSES: For service information identified in this final rule,
contact Boeing Commercial Airplanes, Attention: Data & Services
Management, 3855 Lakewood Boulevard, MC D800-0019, Long Beach, CA
90846-0001; telephone:<PHONE_NUMBER>, extension 2; fax:<PHONE_NUMBER>;
Internet: https://www.myboeingfleet.com. You may view this referenced
service information at the FAA, Transport Airplane Directorate, 1601
Lind Avenue SW., Renton, WA. For information on the availability of
this material at the FAA, call<PHONE_NUMBER>. It is also available on
the Internet at http://www.regulations.gov by searching for and
locating Docket No. FAA-2015-3982.

Examining the AD Docket

    You may examine the AD docket on the Internet at http://www.regulations.gov by searching for and locating Docket No. FAA-2015-
3982; or in person at the Docket Management Facility between 9 a.m. and
5 p.m., Monday through Friday, except Federal holidays. The AD docket
contains this AD, the regulatory evaluation, any comments received, and
other information. The address for the Docket Office (phone: 800-647-
5527) is Docket Management Facility, U.S. Department of Transportation,
Docket Operations, M-30, West Building Ground Floor, Room W12-140, 1200
New Jersey Avenue SE., Washington, DC 20590.

FOR FURTHER INFORMATION CONTACT: Eric Schrieber, Aerospace Engineer,
Airframe Branch, ANM-120L, FAA, Los Angeles Aircraft Certification
Office (ACO), 3960 Paramount Boulevard, Lakewood, CA 90712-4137; phone:
562-627-5348; fax:<PHONE_NUMBER>; email<EMAIL_ADDRESS>
SUPPLEMENTARY INFORMATION:

Discussion

    We issued a notice of proposed rulemaking (NPRM) to amend 14 CFR
part 39 by adding an AD that would apply to certain The Boeing Company
Model 717-200 airplanes. The NPRM published in the Federal Register on
October 6, 2015 (80 FR 60307) (``the NPRM''). The NPRM was prompted by
multiple reports of the vertical stabilizer leading edge showing signs
of fastener distress. The NPRM proposed to require a detailed
inspection for any distress of the vertical stabilizer leading edge
skin, and related investigative and corrective actions if necessary.
The NPRM also proposed to require, for certain airplanes, repetitive
detailed inspections of the spar cap for any loose and missing
fasteners, repetitive ETHF and RT inspections of the spar cap for any
crack, and related investigative and corrective actions if necessary.
We are issuing this AD to detect and correct any crack in the vertical
stabilizer leading edge and front spar cap, which may result in the
structure becoming unable to support limit load, and may lead to the
loss of the vertical stabilizer.

Comments

    We gave the public the opportunity to participate in developing
this AD. The following presents the comments received on the NPRM and
the FAA's response to each comment. Boeing and an anonymous commenter
indicated their support for the NPRM.

Request To Add Credit for Previous Actions

    Boeing requested that we add a ``Credit for Previous Actions''
paragraph to the proposed AD that would give credit for prior
accomplishment of the initial inspection in paragraph (g) of the NPRM.
Boeing stated that operator structural inspection credit has been
incorporated as a precedent in previous ADs.
    We agree with the commenter's request. Boeing MOM-MOM-14-0437-
01B(R1), dated July 3, 2014, provides the same action and level of
safety for the initial inspection specified in this AD. We have revised
this AD by adding new paragraph (j) of this AD to give credit for the
initial inspection in paragraph (g) of this AD, if that inspection was
performed before the effective date of this AD using Boeing MOM-MOM-14-
0437-01B(R1), dated July 3, 2014. We have redesignated the remaining
paragraphs accordingly.

Conclusion

    We reviewed the relevant data, considered the comments received,
and determined that air safety and the public interest require adopting
this AD with the change described previously

and minor editorial changes. We have determined that these minor
changes:
     [Agr]re consistent with the intent that was proposed in
the NPRM for correcting the unsafe condition; and
     Do not add any additional burden upon the public than was
already proposed in the NPRM.
    We also determined that these changes will not increase the
economic burden on any operator or increase the scope of this AD.

Related Service Information Under 1 CFR Part 51

    We reviewed Boeing Alert Service Bulletin 717-55A0012, dated June
12, 2015. The service information describes procedures for a detailed
inspection for any distress of the vertical stabilizer leading edge
skin, a detailed inspection for any loose and missing fasteners of the
spar cap, ETHF and RT inspections of the spar cap for any crack, and
related investigative and corrective actions. This service information
is reasonably available because the interested parties have access to
it through their normal course of business or by the means identified
in the ADDRESSES section.

Costs of Compliance

    We estimate that this AD affects 106 airplanes of U.S. registry.
    We estimate the following costs to comply with this AD:

                                                 Estimated Costs
----------------------------------------------------------------------------------------------------------------
                                                                                Cost on U.S.
              Action                    Labor cost        Parts cost      Cost per product        operators
----------------------------------------------------------------------------------------------------------------
Inspections for distress.........  11 work-hours x $85              $0  $935 per inspection  $99,110 per
                                    per hour = $935                      cycle.               inspection cycle.
                                    per inspection
                                    cycle.
Repetitive inspections for         7 work-hours x $85                0  595 per inspection   63,070 per
 cracking and loose and missing     per hour = $595                      cycle.               inspection cycle.
 fasteners.                         per inspection
                                    cycle.
----------------------------------------------------------------------------------------------------------------

    We have received no definitive data that would enable us to provide
cost estimates for the on-condition actions specified in this AD.

Authority for This Rulemaking

    Title 49 of the United States Code specifies the FAA's authority to
issue rules on aviation safety. Subtitle I, section 106, describes the
authority of the FAA Administrator. Subtitle VII: Aviation Programs,
describes in more detail the scope of the Agency's authority.
    We are issuing this rulemaking under the authority described in
Subtitle VII, Part A, Subpart III, Section 44701: ``General
requirements.'' Under that section, Congress charges the FAA with
promoting safe flight of civil aircraft in air commerce by prescribing
regulations for practices, methods, and procedures the Administrator
finds necessary for safety in air commerce. This regulation is within
the scope of that authority because it addresses an unsafe condition
that is likely to exist or develop on products identified in this
rulemaking action.

Regulatory Findings

    This AD will not have federalism implications under Executive Order
13132. This AD will not have a substantial direct effect on the States,
on the relationship between the national government and the States, or
on the distribution of power and responsibilities among the various
levels of government.
    For the reasons discussed above, I certify that this AD:
    (1) Is not a ``significant regulatory action'' under Executive
Order 12866,
    (2) Is not a ``significant rule'' under DOT Regulatory Policies and
Procedures (44 FR 11034, February 26, 1979),
    (3) Will not affect intrastate aviation in Alaska, and
    (4) Will not have a significant economic impact, positive or
negative, on a substantial number of small entities under the criteria
of the Regulatory Flexibility Act.

List of Subjects in 14 CFR Part 39

    Air transportation, Aircraft, Aviation safety, Incorporation by
reference, Safety.

Adoption of the Amendment

    Accordingly, under the authority delegated to me by the
Administrator, the FAA amends 14 CFR part 39 as follows:

PART 39--AIRWORTHINESS DIRECTIVES

0
1. The authority citation for part 39 continues to read as follows:

    Authority:  49 U.S.C. 106(g), 40113, 44701.

Sec.  39.13  [Amended]

0
2. The FAA amends Sec.  39.13 by adding the following new airworthiness
directive (AD):

2016-09-05 The Boeing Company: Amendment 39-18503; Docket No. FAA-
2015-3982; Directorate Identifier 2015-NM-098-AD.

(a) Effective Date

    This AD is effective June 8, 2016.

(b) Affected ADs

    None.

(c) Applicability

    This AD applies to The Boeing Company Model 717-200 airplanes,
certificated in any category, as specified in Boeing Alert Service
Bulletin 717-55A0012, dated June 12, 2015.

(d) Subject

    Air Transport Association (ATA) of America Code 55, Stabilizers.

(e) Unsafe Condition

    This AD was prompted by multiple reports of the vertical
stabilizer leading edge showing signs of fastener distress. We are
issuing this AD to detect and correct any crack in the vertical
stabilizer leading edge and front spar cap, which may result in the
structure becoming unable to support limit load, and may lead to the
loss of the vertical stabilizer.

(f) Compliance

    Comply with this AD within the compliance times specified,
unless already done.

(g) Initial Inspection

    Except as required by paragraph (i)(1) of this AD, at the
applicable time specified in paragraph 1.E., ``Compliance,'' of
Boeing Alert Service Bulletin 717-55A0012, dated June 12, 2015: Do a
detailed inspection for any distress of the vertical stabilizer
leading edge skin and do all applicable related investigative and
corrective actions, in accordance with the Accomplishment
Instructions of Boeing Alert Service Bulletin 717-55A0012, dated
June 12, 2015, except as required by paragraph (i)(2) of this AD. Do
all applicable related investigative and corrective actions before
further flight.

(h) Repetitive Inspections

    For all airplanes on which no cracking was found during any
related investigative action required by paragraph (g) of this AD:
At the applicable time specified in paragraph 1.E., ``Compliance,''
of Boeing Alert Service Bulletin 717-55A0012, dated June 12, 2015,
do the actions specified in paragraphs (h)(1) and (h)(2) of this AD
and do all applicable related investigative and corrective actions,
in accordance with the Accomplishment Instructions of Boeing Alert
Service Bulletin

717-55A0012, dated June 12, 2015, except as required by paragraph
(i)(2) of this AD. Do all applicable related investigative and
corrective actions before further flight. Repeat the applicable
inspection thereafter at the intervals specified in paragraph 1.E.,
``Compliance,'' of Boeing Alert Service Bulletin 717-55A0012, dated
June 12, 2015.
    (1) Do detailed inspections for any loose and missing fasteners
of the vertical stabilizer leading edge as specified in ``Part 4''
of Boeing Alert Service Bulletin 717-55A0012, dated June 12, 2015.
    (2) Do eddy current testing high frequency (ETHF) and
radiographic testing (RT) inspections for any crack of the vertical
stabilizer spar cap as specified in ``Part 2'' of Boeing Alert
Service Bulletin 717-55A0012, dated June 12, 2015; or do ETHF
inspections for any crack of the vertical stabilizer spar cap as
specified in ``Part 3'' of Boeing Alert Service Bulletin 717-
55A0012, dated June 12, 2015.

(i) Exceptions to the Service Information

    (1) Where Boeing Alert Service Bulletin 717-55A0012, dated June
12, 2015 specifies a compliance time ``after the original issue date
of this service bulletin,'' this AD requires compliance within the
specified compliance time after the effective date of this AD.
    (2) If any crack is found during any inspection required by this
AD, and Boeing Alert Service Bulletin 717-55A0012, dated June 12,
2015, specifies to contact Boeing for appropriate action: Before
further flight, repair using a method approved in accordance with
the procedures specified in paragraph (k) of this AD.

(j) Credit for Previous Actions

    This paragraph provides credit for the initial inspection
specified in paragraph (g) of this AD, if that inspection was
performed before the effective date of this AD using Boeing MOM-MOM-
14-0437-01B(R1), dated July 3, 2014, which is not incorporated by
reference in this AD.

(k) Alternative Methods of Compliance (AMOCs)

    (1) The Manager, Los Angeles Aircraft Certification Office
(ACO), FAA, has the authority to approve AMOCs for this AD, if
requested using the procedures found in 14 CFR 39.19. In accordance
with 14 CFR 39.19, send your request to your principal inspector or
local Flight Standards District Office, as appropriate. If sending
information directly to the manager of the ACO, send it to the
attention of the person identified in paragraph (l) of this AD.
Information may be emailed to<EMAIL_ADDRESS>    (2) Before using any approved AMOC, notify your appropriate
principal inspector, or lacking a principal inspector, the manager
of the local flight standards district office/certificate holding
district office.
    (3) An AMOC that provides an acceptable level of safety may be
used for any repair, modification, or alteration required by this AD
if it is approved by the Boeing Commercial Airplanes Organization
Designation Authorization (ODA) that has been authorized by the
Manager, Los Angeles ACO, to make those findings. To be approved,
the repair method, modification deviation, or alteration deviation
must meet the certification basis of the airplane, and the approval
must specifically refer to this AD.

(l) Related Information

    For more information about this AD, contact Eric Schrieber,
Aerospace Engineer, Airframe Branch, ANM-120L, FAA, Los Angeles ACO,
3960 Paramount Boulevard, Lakewood, CA 90712-4137; phone: 562-627-
5348; fax:<PHONE_NUMBER>; email<EMAIL_ADDRESS>
(m) Material Incorporated by Reference

    (1) The Director of the Federal Register approved the
incorporation by reference (IBR) of the service information listed
in this paragraph under 5 U.S.C. 552(a) and 1 CFR part 51.
    (2) You must use this service information as applicable to do
the actions required by this AD, unless the AD specifies otherwise.
    (i) Boeing Alert Service Bulletin 717-55A0012, dated June 12,
2015.
    (ii) Reserved.
    (3) For Boeing service information identified in this AD,
contact Boeing Commercial Airplanes, Attention: Data & Services
Management, 3855 Lakewood Boulevard, MC D800-0019, Long Beach, CA
90846-0001; telephone:<PHONE_NUMBER>, extension 2; fax:<PHONE_NUMBER>;
Internet: https://www.myboeingfleet.com.
    (4) You may view this service information at the FAA, Transport
Airplane Directorate, 1601 Lind Avenue SW., Renton, WA. For
information on the availability of this material at the FAA, call
425-227-1221.
    (5) You may view this service information that is incorporated
by reference at the National Archives and Records Administration
(NARA). For information on the availability of this material at
NARA, call<PHONE_NUMBER>, or go to: http://www.archives.gov/federal-register/cfr/ibr-locations.html.

    Issued in Renton, Washington, on April 20, 2016.
John P. Piccola, Jr.,
Acting Manager, Transport Airplane Directorate, Aircraft Certification
Service.
[FR Doc. 2016-10160 Filed 5-3-16; 8:45 am]
 BILLING CODE 4910-13-P