entirety as unnecessary and duplicative of the FAR.
    We propose to revise clause 1252.222-70, Strikes or Picketing
Affecting Timely Completion of the Contract Work, to make to make minor
administrative corrections in the title and the TAR citation
referencing the prescription.
    We propose to revise clause 1252.222-71, Strikes or Picketing
Affecting Access to a DOT Facility, to make to make minor
administrative corrections in the title and the TAR citation
referencing the prescription.
    We proposed to add clause 1252.222-72, Contractor Cooperation in
Equal Employment Opportunity and Anti-Harassment Investigations, which
adds definitions to provide common meaning to three terms as used in
the clause. It would require that in addition to complying with the
clause at FAR 52.222-26, Equal Opportunity, the Contractor shall, in
good faith, cooperate with the Department of Transportation in
investigations of Equal Employment Opportunity (EEO) complaints
processed pursuant to 29 CFR part 1614 as well as internal Anti-
Harassment investigations. It would also provide that failure to
cooperate could be potential grounds for termination for cause or
default, and it requires flowdown of the clause in all subcontracts, at
any tier.
    We propose to revise clause 1252.223-70, Removal or Disposal of
Hazardous Substances--Applicable Licenses and Permits, to make to make
minor administrative corrections in the title, the TAR citation
referencing the prescription, and make minor editorial formatting
changes in the clause.
    We propose to revise clause 1252.223-71, Accident and Fire
Reporting, to make minor administrative corrections in the title and
the TAR citation referencing the prescription, and other minor
administrative editorial corrections, as well as to remove in paragraph
(b)(1) two outdated reference to ``by telegram or facsimile
transmission'' to instead state that reports of accidents or fires
resulting in a death, hospitalization of five or more persons, or
destruction of Government-owned or leased property (either real or
personal), the total value of which is estimated at $100,000 or more,
shall be reported immediately by telephone to the Contracting Officer
or his/her authorized representative and shall be confirmed in writing
within 24 hours to the Contracting Officer.
    We propose to revise clause 1252.223-72, Protection of Human
Subjects, to make minor administrative corrections in the title and the
TAR citation referencing the prescription, to correct a FAR citation in
paragraph (g), and to update the clause to indicate that DOT
regulations and any OA specific procedures apply.
    We propose to revise clause 1252.223-73, Seat Belt Use Policies and
Programs, to make minor administrative corrections in the title and the
TAR citation referencing the prescription, to update the name of the
safety campaigns now in use by DOT--``Click It or Ticket'', and to
provide updated website information, as well as make other minor
grammatical corrections.
    We propose to revise clause 1252.228-70, Loss of or Damage to
Leased Aircraft, to make minor administrative corrections in the title
and the TAR citation referencing the prescription, as well as to make
other minor editorial corrections.
    We propose to revise clause 1252.228-71, Fair Market Value of
Aircraft, to make minor administrative corrections in the title and the
TAR citation referencing the prescription, as well as to make other
minor editorial corrections, and to add the reference to clause number
1252.228-70 to the cited clause title, ``Loss of or Damage to Leased
Aircraft,'' to conform with FAR drafting conventions.
    We propose to revise clause 1252.228-72, Risk and Indemnities, to
make minor administrative corrections in the title and the TAR citation
referencing the prescription.
    We propose to add clause 1252.228-73, Command of Aircraft, to
require that during the performance of a contract for out-service
flight training for DOT, whether the instruction to DOT personnel is in
leased, contractor-provided, or Government-provided aircraft,
contractor personnel shall always, during the entirety of the course of
training and during operation of the aircraft, remain in command of the
aircraft. At no time shall other personnel be permitted to take command
of the aircraft.
    We propose to renumber clause 1252.228-73 to 1252.228-74, and to
revise the title to read ``Notification of Payment Bond Protection,''
in lieu of ``Notification of Miller Act payment bond protection'' to
comport with the

current reference to the older ``Miller Act'' statute, to correct the
TAR citation referencing the prescription, as well as to make other
minor editorial corrections that would also update the correct title
for the ``Miller Act'' statute to ``Bonds statute'' in paragraphs (a)
and (b). We propose to add a new paragraph (c) to add subcontract
flowdown requirements requiring prime contractors to insert this notice
clause in all first-tier subcontracts and to require the clause to be
subsequently flowed down by all first-tier subcontractors to all
subcontractors, at any tier.
    We propose to revise clause 1252.231-70, Date of Incurrence of
Costs, to make minor administrative corrections in the title, the TAR
citation referencing the prescription and to make minor editorial
formatting changes.
    We propose to add clause 1252.232-70, Electronic Submission of
Payment Requests, that would provide four definitions to establish a
common meaning when used in the clause; provide notice to contractors
that electronic payment requests are required, with exceptions; specify
the processing system DOT uses and the iSupplier (DELPHI) system and
login address that would be used to submit such electronic invoices;
invoice requirements to receive payment; specify payment registration
system procedures; and specify how waivers are processed and exceptions
and alternate payment procedures for DOT. This clause is required to be
inserted into DOT contracts to ensure contractors and vendors are aware
of electronic invoice processing requirements and how to submit and
process invoices to ensure payment under DOT contracts.
    We propose to add clause 1252.232-71, Limitation of Government's
Obligation, that would permit contracting officers, if funding is not
currently available to fully fund the contract due to the Government
operating under a continuing resolution to incrementally fund items if
listed in a table contained in the clause. The clause outlines the
parameters of the incremental funding, to include a requirement that
the contractor provide notice to the contracting officer in writing
when work will reach the point at which the total amount payable by the
Government, including any cost for termination for convenience, will
approximate 85 percent of the total amount then allotted to the
contract for performance of the item(s) identified. The clause also
cautions that nothing in the clause shall be construed as authorization
of voluntary services whose acceptance is otherwise prohibited under 31
U.S.C. 1342. This clause is necessary to permit DOT contracting
officers to proceed with performance during periods of continuing
resolutions if partial funds are available and provide a mechanism to
incrementally fund the contract. This clause was benchmarked with other
Federal agencies who have similarly authorized this type of incremental
funding.
    We propose to revise clause 1252.235-70, Research Misconduct, to
make minor administrative corrections in the title and the TAR citation
referencing the prescription, and to make other minor grammatical and
editorial non-substantive edits in the clause to comport with FAR
drafting convention. Further, we propose to add a paragraph (i) to the
clause to add subcontract flowdown language to require the contractor
to include the clause in all subcontracts that involve research.
    We propose to add clause 1252.235-71, Technology Transfer, to
provide the text of the clause prescribed by 1235.011-70. The clause
would require the contractor to develop a Technology Transfer Plan in
accordance with the statement of work and to receive approval by the
contracting officer prior to the initiation of any work under the
contract. It details the minimum requirements for the plan, as well as
a requirement to periodically update the plan at least once every six
months via a Technology Transfer Report, and also details the minimum
information for the report. DOT requires this clause to obtain
essential information on the output of research so that the Government
can efficiently identify reporting requirements and leverage research
in which DOT invests. This provides clarity to the public prior to
commencement of work under a cognizant research contract so that the
contractor can appropriate identify and track information prior to
commencement of the effort.
    We propose to revise clause 1252.236-70, Special Precautions for
Work at Operating Airports, to make minor administrative corrections in
the title and the TAR citation referencing the prescription, and to
make other minor grammatical and editorial non-substantive edits in the
clause to comport with FAR drafting convention.
    We propose to revise clause 1252.237-70, Qualifications of
Contractor Employees, to make minor administrative corrections in the
title and the TAR citation referencing the prescription; to make other
minor grammatical and editorial non-substantive edits in the clause to
comport with FAR drafting convention; and to remove paragraphs (f) and
(g) because it is duplicative of other DOT or FAR clauses or contains
outdated information. We also propose to make substantive edits to
paragraphs (b) and (e). In paragraph (b), we are providing clarity to
the need to protect sensitive information and the requirement for
contractors to train contractor employees who are authorized to access
sensitive information, and detail the requirement for the contractor to
provide information to assist the Government in determining an
individual's suitability to have an authorization to access DOT
information and information systems. In paragraph (e), we removed
subparagraphs (e)(1) and (2) in their entirety to streamline the
paragraph to state that the contractor shall ensure that contractor
employees are citizens of the United States of America or non-citizens
who have been lawfully admitted for permanent residence or employment
(indicated by immigration status) as evidenced by U.S. Citizenship and
Immigration Services (USCIS) documentation. DOT also proposes to add a
new paragraph (f) to describe an updated subcontract flowdown
requirement requiring the contractor to include the clause in
subcontracts whenever clause 1252.237-70 is included in the prime
contractor's contract.
    We propose to revise section 1252.237-71, Certification of Data, to
make minor administrative corrections in the title and the TAR citation
referencing the prescription, and to remove the ``NOTICE'' paragraph
text preceding paragraph (a) as it contains an internal DOT
determination and reference to an outdated memorandum that is
unnecessary and inappropriate to include within the body of the
provision. We proposed to add in paragraph (b) ``or for cause'' after
``termination for default'' when stating that offerors submitting
inaccurate data to the Department of Transportation may subject the
offeror, its subcontractors, employees or its representatives to
prosecution for false statements pursuant to 18 U.S.C. 1001 and/or
enforcement action for false claims or statements, or termination for
default or for cause under any contract resulting from its offer, and/
or debarment or suspension. In paragraph (c), we propose to add the
phrase, ``and submit such certification(s) with its offer'' after the
existing sentence so that it now reads: The offeror agrees to obtain a
similar certification from its subcontractors and submit such
certification(s) with its offer.
    We propose to revise clause 1252.237-72, Prohibition on

Advertising, to make minor administrative corrections in the title and
the TAR citation referencing the prescription.
    We propose to revise clause 1252.237-73, Key Personnel, to make
minor administrative corrections in the title and the TAR citation
referencing the prescription, as well as minor grammatical corrections
and formatting of contracting officer insert instructions in the text.
    We propose to revise clause 1252.239-70, Security Requirements for
Unclassified Information Technology Resources, in its entirety, to make
substantive revisions to the clause to clarify that the contractor
shall be responsible for information technology security for all
systems connected to a DOT network or operated by the contractor for
DOT, regardless of location. It provides examples of tasks that require
security provisions. The clause requires a contractor to develop,
provide, implement, and maintain an IT Security Plan that would
describe the processes and procedures the contractor will follow to
ensure appropriate security of IT resources developed, processed, or
used under the contract. It requires the contractor to submit written
proof of IT security accreditation to the contracting officer and
requires, on an annual basis, the contractor to verify in writing that
the IT Security Plan remains valid. It also requires contractor
personnel to be screened and trained, and that contractors shall
provide the Government access to the Contractor's and subcontractors'
facilities, installations, operations, documentation, databases and
personnel used in performance of the contract. The Contractor shall
provide access to enable a program of IT inspection (to include
vulnerability testing), investigation and audit (to safeguard against
threats and hazards to the integrity, availability and confidentiality
of DOT data or to the function of information technology systems
operated on behalf of DOT), and to preserve evidence of computer crime.
The contractor is also required to flow down the clause to all
subcontracts as specified in the clause. This revision is necessary to
update DOT information system and security requirements to meet current
Federal Governmentwide requirements.
    We propose to revise clause 1252.239-71, Information Technology
Security Plan and Accreditation, to make minor administrative
corrections in the title and the TAR citation referencing the
prescription, to use the word ``shall'' in lieu of ``must'' in regards
to the requirement that all offers submitted in response to the
solicitation shall address the approach for completing the security
plan and accreditation requirements, and to add the name of the title
of the referenced clause 1252.239-70, Security Requirements for
Unclassified and Sensitive Information Technology Resources.
    We propose to add clause 1252.239-72, Compliance with Safeguarding
DOT Sensitive Data Controls, that would require contractors to
implement security requirements contained in clause 1252.239-74,
Safeguarding DOT Sensitive Data and Cyber Incident Reporting, for all
DOT sensitive data on all Contractor information systems that support
the performance of the contract. This clause would exclude contractor
information systems not part of an information technology service or
system operated on behalf of the Government. The offeror would be
required to represent that it will implement the security requirements
specified by National Institute of Standards and Technology (NIST)
Special Publication (SP) 800-171 ``Protecting Controlled Unclassified
Information in Nonfederal Information Systems and Organizations.'' This
clause would also specify procedures when the contractor proposes to
vary from any security requirements specified by NIST SP 800-171. This
clause would ensure compliance with NIST SP 800-171 requirements
imposed throughout the Federal Government.
    We propose to add clause 1252.239-73, Limitations on the Use or
Disclosure of Third-Party Contractor Reported Cyber Incident
Information, as prescribed by 1239.7003(b), to provide six definitions
that would establish common meaning for terms used in the clause. The
clause identifies certain restrictions and conditions that apply to any
information the contractor receives or creates in the performance of
the contract, and it would set forth that a breach of obligations or
restrictions under the contract may subject a contractor to criminal,
civil, administrative, and contractual penalties and other appropriate
remedies and civil actions for damages and other appropriate remedies
by a third party that may report a cyber incident under the clause. It
would also require flowdown in subcontracts.
    We propose to add clause 1252.239-74, Safeguarding DOT Sensitive
Data and Cyber Incident Reporting, as prescribed in 1239.7003(c). The
clause would provide 14 key definitions that would establish common
meaning and usage for the terms as used in the clause and outlines the
requirement for a contractor to provide adequate security on all
covered contractor information systems. The clause details the minimum
adequate security requirements; details that if the contractor intends
to use an external cloud service provider to store, process, or
transmit any DOT sensitive data in performance of this contract, the
contractor shall require and ensure that the cloud service provider
meets security requirements equivalent to those established by the
Government for the Federal Risk and Authorization Management Program
(FedRAMP) Moderate baseline (https://www.fedramp.gov/resources/documents/) and that the cloud service provider complies with
requirements in paragraphs (c) through (h) of the clause for cyber
incident reporting, malicious software, media preservation and
protection, access to additional information and equipment necessary
for forensic analysis, and cyber incident damage assessment. The clause
outlines in paragraphs (k) and (j) when certain information is
authorized to be released outside of DOT. It would require that
notwithstanding the safeguarding and cyber incident reporting required
by the clause, the contractor retains responsibility for other
safeguarding or cyber incident reporting pertaining to its unclassified
information systems as required by other applicable clauses of a
contract, or as a result of other applicable U.S. Government statutory
or regulatory requirements. The clause would also require flowdown to
subcontracts as required by paragraph (o). Subcontractors would be
required to notify the prime contractor (or next higher-tier
subcontractor) when submitting a request to vary from a NIST SP 800-171
security requirement to the contracting officer, and to provide the
incident report number, automatically assigned by DOT, to the prime
contractor (or next higher-tier subcontractor) as soon as practicable,
when reporting a cyber incident to DOT as required by the clause.
    We propose to add clause 1252.239-75, DOT Protection of Information
About Individuals, PII, and Privacy Risk Management Requirements, as
prescribed by 1239.7104. The clause outlines the requirement for
contractors to comply with all applicable Federal law, guidance, and
standards, as well as DOT policies pertaining to the protection of
Personally Identifiable Information (PII), to the extent the contractor
creates, maintains, acquires, discloses, uses, or has access to PII
under the contract. The clause would require action on the part of the

contractor or the Government when there are unanticipated threats to
bring the situation to the attention of the other party. The clause
also contains requirements with respect to compliance with the Privacy
Act of 1974, including DOT implementing regulations at 49 CFR part 10,
as well as the requirement to protect Privacy Act records, to execute a
confidentiality agreement, and to surrender records when required. The
clause outlines the requirement to comply with NIST FIPS 140-2 and FIPS
199 to protect sensitive information, actions that are required in the
event of a breach to include reporting breaches involving PII directly
to DOT at a centrally manned reporting number within two hours of
discovery, the obligation to information employees and associates of
the obligations contained in the clause, training requirements for such
individuals, and the requirement to flowdown the clause to all
subcontracts.
    We propose to add clauses 1252.239-76 through 1252.239-88 to comply
with clause requirements outlined for Federal agencies in accordance
with the Federal Risk and Authorization Management Program (FedRAMP), a
government-wide program that provides a standardized approach to
security assessment, authorization, and continuous monitoring for cloud
products and services:
    We propose to add clause 1252.239-76, Cloud Computing Services, as
prescribed in 1239.7204(a). The clause outlines requirements
contractors must comply with when cloud computing services are used to
provide information technology services in the performance of the
contract. The clause provides nine key definitions for terms used in
the clause to provide common meaning and understanding. It would
require contractors to receive permission to use cloud computing
services under the contract if the offer did not provide or anticipate
such use. It would require contractors to implement and maintain
administrative, technical, and physical safeguards and controls with
the security level and services required in accordance with the DOT
Order 1351.37, Departmental Cybersecurity Policy, and the requirements
of DOT Order 1351.18, Departmental Privacy Risk Management Policy. It
would also require the contractor to maintain all Government data not
physically located on DOT premises within the United States, the
District of Columbia, and all territories and possessions of the United
States, unless the contractor receives written notification from the
contracting officer to use another location, in accordance with DOT
Policy. The clause outlines how DOT will determine the security
classification level for the cloud system, the requirement to comply
with certain FedRAMP standards, and the requirement to implement
privacy and security safeguards. The clause provides that the
Government may perform manual or automated audits, scans, reviews, or
other inspections of the vendor's IT environment being used to provide
or facilitate services for the Government. The clause also outlines
limitations on access to and use and disclosure of Government data and
Government-related data; cloud computing services cyber incident
reporting; spillage; malicious software; media preservations and
protection requirements; access to additional information or equipment
necessary for forensic analysis; cyber incident damage assessment
activities; and subcontract flowdown requirements. This clause would
ensure compliance with Federal-wide FedRAMP requirements and cloud
computing services standards and to ensure contractors who perform such
work for DOT are aware of the requirements.
    We propose to add clause 1252.239-77, Data Jurisdiction, as
prescribed by 1239.7204(b), that would require contractors to identify
all data centers that the data at rest or data backup will reside,
including primary and replicated storage. It would also require the
contractor to ensure that all data centers not physically located on
DOT premises reside within the United States, the District of Columbia,
and all territories and possessions of the United States, unless
otherwise authorized by the DOT CIO.
    We propose to add clause 1252.239-78, Validated Cryptography for
Secure Communications, as prescribed by 1239.7204(c), that would
require a contractor to use only cryptographic mechanisms that comply
with certain levels of FIPS 140-2 using a fill-in. It would also
require that external transmission or dissemination of certain
Government information to or from a Government computer must be
encrypted.
    We propose to add clause 1252.239-79, Authentication, Data
Integrity, and Non-Repudiation, as prescribed in 1239.7204(d), that
would require the contractor to provide a cloud service system that
provides for origin authentication, data integrity, and signer non-
repudiation.
    We propose to add clause 1252.239-80, Audit Record Retention for
Cloud Service Providers, as prescribed in 1239.7204(e), that would
require the contractor to manage their electronic records in accordance
with 36 CFR1236.20 and 1236.22, as well as other standards, including
NARA Bulletin 2008-05, July 31, 2008, Guidance concerning the use of
email archiving applications to store email. It would also require the
contractor to maintain records to retain functionality and integrity
throughout the records' full lifecycle.
    We propose to add clause 1252.239-81, Cloud Identification and
Authentication (Organizational Users) Multi-Factor Authentication, as
prescribed in 1239.7204(f), that would require a contractor to support
a secure, multi-factor method of remote authentication and
authorization to identified Government Administrators that will allow
Government-designated personnel the ability to perform management
duties on the system.
    We propose to add clause 1252.239-82, Identification and
Authentication (Non-Organizational Users), as prescribed in
1239.7204(g), that would require contractors to support a secure,
multi-factor method of remote authentication and authorization to
identified Contractor Administrators that will allow Contractor
designated personnel the ability to perform management duties on the
system as required by the contract.
    We propose to add clause 1252.239-83, Incident Reporting
Timeframes, as prescribed in 1239.7204(h), that would require
contractors to report all computer security incidents to the DOT
Security Operations Center (SOC) in accordance with Subpart 1239.70--
Information Security and Incident Response Reporting. It also requires
contractors and subcontractors are required to report cyber incidents
directly to DOT via the DOT SOC 24 hours-a-day, 7 days-a-week, 365 days
a year.
    We propose to add clause 1252.239-84, Media Transport, as
prescribed in 1239.7204(i), that would require the contractor to
document activities associated with the transport of DOT information
stored on digital and non-digital media and employ cryptographic
mechanisms to protect the confidentiality and integrity of this
information during transport outside of controlled areas. And it would
also require that DOT or other Federal agency sensitive or third-party
provided information that resides on mobile/portable devices (e.g., USB
flash drives, external hard drives, and SD cards) must be encrypted.
    We propose to add clause 1252.239-85, Personnel Screening--
Background Investigations, as prescribed in 1239.7204(j), that would
require contractors to provide support

personnel who are U.S. persons maintaining a NACI clearance or greater
in accordance with OMB memorandum M-05-24, Section C. The clause also
outlines the requirement that contractor employees with access to DOT
systems containing sensitive information may be required to obtain
security clearances (i.e., Confidential, Secret, or Top Secret), and
provides how such investigations and documentation will be processed.
    We propose to add clause 1252.239-86, Boundary Protection--Trusted
Internet Connections, as prescribed in 1239.7204(k), that would require
contractors to ensure that Federal information, other than non-
sensitive information, being transmitted from Federal government
entities to external entities using cloud services is inspected by
Trusted Internet Connections (TIC) processes or that all external
connections be routed through a Trusted Internet Connection (TIC).
    We propose to add clause 1252.239-87, Protection of Information at
Rest, as prescribed in 1239.7204(l). The clause would require
contractors to provide security mechanisms for handling data at rest
and in transit in accordance with FIPS 140-2 and contains a contracting
officer fill-in for the encryption standard.
    We propose to add clause 1252.239-88, Security Alerts, Advisories,
and Directives, as prescribed in 1239.7204(m). The clause would require
contractors to provide a list of contractor personnel, identified by
name and role, who are assigned system administration, monitoring, and/
or security responsibilities and are designated to receive security
alerts, advisories, and directives, as well as a similar list of
individuals responsible for the implementation of remedial actions
associated with them.
    We propose to add clause 1252.239-89, Technology Modernization, as
prescribed in 1239.7303(a), that would, after contract award and when
applicable, permit the Government to solicit and the contractor to
propose independently, a modernization approach to the hardware,
software, specifications, or other requirements of the contract. This
would be permitted to increase efficiencies (both system and process
level), reduce costs, strengthen the cyber security posture, or for any
other purpose which presents an advantage to the Government. The clause
outlines proposal requirements, the process for withdrawal of a
proposal not adopted by contract modification within the period
specified in the proposal, as well as requirements for product testing,
contract modification issuance and use of change orders.
    We propose to add clause 1252.239-90, Technology Upgrades/
Refreshment, as prescribed in 1239.7303(b). This clause would, after
issuance of the contract, allow the Government to solicit, and
encourage the Contractor to propose independently, technology
improvements to the hardware, software, specifications, or other
requirements of the contract. These improvements may be proposed to
save money, to improve performance, to save energy, to satisfy
increased data processing requirements, or for any other purpose that
presents a technological advantage to the Government. The clause
provides the requirement for a price or cost proposal to be included
with the proposed changes for evaluation, and the minimum information
required to be submitted to the contracting officer. It also provides
that the Government may wish to test and evaluate any item(s) proposed
and provides the procedures the Government will follow.
    We propose to add clause 1252.239-91, Records Management, as
prescribed in 1239.7403, that would provide requirements for
contractors to comply with all applicable records management laws and
regulations, as well as National Archives and Records Administration
(NARA) records policies, including but not limited to the Federal
Records Act (44 U.S.C. chapters 21, 29, 31, 33), NARA regulations at 36
CFR Chapter XII Subchapter B, and those policies associated with the
safeguarding of records covered by Privacy Act of 1974 (5 U.S.C. 552a).
These policies include the preservation of all records, regardless of
form or characteristics, mode of transmission, or state of completion.
The clause outlines the applicability of the data that falls under the
purview of the clause, records maintenance requirements and custody
responsibilities, restrictions related to unauthorized disclosure, and
the requirement that the contractor shall not create or maintain any
records containing any non-public DOT information that are not
specifically authorized by the contract. It also provides information
on rights in data under the contract which are set forth in specific
clauses prescribed by FAR part 27 and included in the contract, and
requires that contractors must make any assertion of copyright in the
data or other deliverables under the contract and substantiate such
assertions; requires contractors to mark any data to which contractors
assert any rights; requires contractors to mark any data to which
contractors assert any rights; provides training requirements for
contractor employees and subcontractors; and requires flowdown of the
clause in all subcontracts.
    We propose to add provision 1252.239-92, Information and
Communication Technology Accessibility Notice, as prescribed in
1239.203-70(a), that would provide notice to potential offerors that
any offeror responding to this solicitation must comply with
established DOT Information and Communication Technology (ICT)
(formerly known as Electronic and Information (EIT)) accessibility
standards. Information about Section 508 is available at https://www.section508.gov/ or https://www.access-board.gov/guidelines-and-standards/communications-and-it/about-the-section-508-standards. The
provision provides notice that to facilitate the Government's
determination whether proposed ICT supplies and services meet
applicable Section 508 accessibility standards, offerors must submit
appropriate Section 508 Checklists, in accordance with the checklist
completion instructions. The purpose of the checklists is to assist DOT
acquisition and program officials in determining whether proposed ICT
supplies or information, documentation and services support conform to
applicable Section 508 accessibility standards. The provision states
that Section 508 accessibility standards applicable to the solicitation
are stated in the clause at 1252.239-81, Information and Communication
Technology Accessibility. This was benchmarked based on similar clauses
at other agencies and ensures that DOT provides the public notice of
important Section 508 requirements and how offerors must submit
information.
    We propose to add clause 1252.239-94, Information and Communication
Technology Accessibility, as prescribed in 1239.203-70(b), that would
provide a key definition for the term ``Electronic and Information
Technology (EIT) to provide common meaning as used in the clause and
state that it is intended to refer to Information and Communication
Technology (ICT) and any successor terms used to describe such
technology. The clause would require that all EIT supplies,
information, documentation and services support developed, acquired,
maintained or delivered under the contract or order must comply with
the Information and Communication Technology (ICT) Standards and
Guidelines (see 36 CFR parts 1193 and 1194). It also states that
Section 508 accessibility standards applicable to the contract or order
are identified in the

Specification, Statement of Work, or Performance Work Statement. The
clause also provides that in the event a modification to the contract
or order adds new ICT supplies or services or revises the type of, or
specifications for, supplies or services, the contracting officer may
require that the contractor submit a completed Section 508 Checklist
and any other additional information necessary to assist the Government
in determining that the ICT supplies or services conform to Section 508
accessibility standards. It also provides that if the contract is an
indefinite-delivery type contract, a Blanket Purchase Agreement or a
Basic Ordering Agreement, the task/delivery order requests that include
ICT supplies or services will define the specifications and
accessibility standards for the order.
    We propose to revise clause 1252.242-70, Dissemination of
Information--Educational Institutions, to make minor administrative
corrections in the title and to the TAR citation referencing the
prescription to comport with FAR drafting convention.
    We propose to revise clause 1252.242-71, Contractor Testimony, to
make minor administrative corrections in the title and to the TAR
citation referencing the prescription to comport with FAR drafting
convention.
    We propose to revise clause 1252.242-72, Dissemination of Contract
Information, to make minor administrative corrections in the title and
to the TAR citation referencing the prescription to comport with FAR
drafting convention.
    We propose to remove clause 1252.242-73, Contracting officer's
technical representative, as the clause has been revised and moved to
TAR part 1201 as 1252.201-70, Contracting Officer's Representative.
    We propose to add clause 1252.242-70, Contract Audit Support, as
prescribed in 1242.170, that would set forth that the Government may at
its sole discretion utilize certified public accountant(s) to provide
contract audit services in lieu of the cognizant government audit
agency to accomplish the contract administration requirements of FAR
parts 32 and 42 under the terms and conditions of the contract. It
would prohibit disclosure of proprietary financial data or use of such
data for any purpose other than to perform the required audit services.
And it would also detail that when the Government utilizes such
contract audit support under the contract, access to accounting
systems, records and data is required to be provided to the audit
services contractor like that provided to the cognizant government
auditor. This would provide the necessary notice to the contractor that
would permit such non-Government auditors to be utilized.
    We propose to remove clause 1252.245-70, Government property
records. The prescription was removed at 1245.505-70 because the
requirement is outdated and in conflict with the updated FAR part 45.
The updated FAR part 45 provides that contractors may submit property
reports using standard commercial practice, and the cited DOT Form
4220.43, Contractor Report of Government Property, is not required to
be utilized. This results in potential savings to contractors who may
use existing standard commercial practices and eliminates the
requirement to use a specialized Government form.
    We propose to add subpart 1252.3, Provision and Clause Matrix, and
the section 1252.301, Solicitation provisions and contract clauses
(Matrix). This section states the TAR matrix is not published in the
CFR. It is available on the Acquisition.gov website at https://www.acquisition.gov/TAR. This is comparable to the FAR, which also does
not incorporate a matrix in the CFR. The matrix is a tool that explains
how and when prescribed provisions and clauses may be utilized in
accordance with the FAR or TAR, but is not codified and is not policy.
    We propose to remove the TAR Provision and Clause Matrix, which is
currently reflected in the TAR part 1252 as an Appendix.

TAR Part 1253--Forms

    We propose to revise the authority citations for part 1253, for the
reasons set forth in the discussion and analysis section, to read as
follows: 5 U.S.C. 301; 40 U.S.C. 121(c); 41 U.S.C. 1121(c)(3); 41
U.S.C. 1702; and 48 CFR 1.301-1.304.
    We propose to revise subpart 1253.2, Prescription of Forms, and
section 1253.204, Administrative matters, to renumber the section and
title as 1253.204-70, Administrative matters--agency specific forms, to
make minor administrative correction to the TAR citation referencing
the form prescriptions and in the body of the text to comport with FAR
drafting conventions, and to make other non-substantive editorial
edits.
    We propose to remove section 1253.222, Application of labor laws to
Government acquisitions, which would remove the prescription for the
use of Form DOT F 4220.7, Employee Claim for Wage Restitution from the
TAR. The requirement for use of this form is currently set forth in
subpart 1222.4, Labor Standards for Contracts Involving Construction,
and the underlying sections 1222.406, Administration and Enforcement,
and 1222.406-9, Withholding from or suspension of contract payments.
These provisions are also proposed for removal. Form DOT F 4220.7 would
only be used if an employee raises an issue with lack of payment of
wages by a contractor. DOT would investigate, with the Department of
Labor and in accordance with the policies and procedures referenced in
FAR 22.406-8--22.406-9. The form would not be submitted to or through a
contractor and thus is unnecessary as part of the TAR. Removal from the
TAR of these provisions, and thus the requirement to use Form DOT F
4220.7, does not impact the rights of employees or the requirement for
the Government to investigate labor standards violations in accordance
with the FAR as cited, nor for a DOT contracting officer to properly
take action under the contract to withhold funds as the investigation
warrants. The form would only be required and used outside of the
Government--contractor communication channels and directly with the
affected employee(s) to help them receive payment for any wages
adjudicated as owed. This scenario would only come into play if the
wage issues are not resolved by the contracting officer and the
contractor under the contract. It is a form the Government uses to pay
Government funds directly to employees when an investigation finds
wages are due and a contractor does not act under the contract to
remedy the issue. In this instance, the form would be used to provide
funds from the U.S. Treasury directly to the affected employee. Thus,
the process involving use of Form DOT F 4220.7 is outside of the TAR.
    We propose to add 1253.227, Patents, data, and copyrights, as a
section title with no text, and to revise 1253.227, Conveyance of
invention rights acquired by the Government, to renumber the section
and title as 1253.227-3, Patent rights under Government contracts,
which more accurately conveys where in the TAR the applicable forms fit
within TAR part 1227. The revisions would make minor administrative
corrections to the TAR citation referencing the form prescriptions and
to the body of the text to comport with FAR drafting convention. We
also propose to update the form where the public may obtain a DD Form
882, Report of Inventions and Subcontracts, that is authorized for use
under DOT contracts.
    We propose to remove 1253.245-70 Report of Government property,
because the form prescribed in the section is no longer in use. For DOT
to require its use

would be conflict with FAR part 45. This results in potential savings
to contractors who may use existing standard commercial practices and
eliminates the requirement to use a specialized Government form.
    In subpart 1253.3, Illustration of Forms, we propose to revise the
subpart by retitling the subpart to read: ``Forms Used in
Acquisitions'' to comport with FAR subpart 53.3. We also propose to
revise 1253.303, Agency forms, to renumber it as 1253.303-70, and
retitle it as ``DOT agency forms.''
    We propose to remove the ``Appendix to Subpart 1253.3 of Part
1253'' as unnecessary, to revise the text to clarify how the public may
access DOT agency forms, and to provide an updated website for the
Office of the Senior Procurement Executive.
    We propose to add the Table header, ``Table 1253-1--Forms Use in
DOT Acquisitions'' above the existing table of DOT forms. In this table
we propose to remove the following rows, the reference to the forms,
and the related .pdf and word document links:
    The second row and form titled, Employee Claim for Wage
Restitution,'' 4220.7 as the form prescription is removed in 1253.222,
Application of labor laws to Government acquisitions;
    The third row and form titled, ``Contractor Report of Government
Property,'' 4220.43, as the prescription is removed in 1253.245-70
Report of Government property; and
    The last row and the form titled, ``Report of Inventions and
Subcontracts and Instructions, DD Form 882. The Department of Defense
maintains their own accessible public-facing website where the form can
be obtained as indicated in the proposed section 1253.227-3.

Regulatory Reviews

Executive Order 12866 and 13563

    Executive Orders (E.O.) 12866 and 13563 direct agencies to assess
all costs and benefits of available regulatory alternatives and, when
regulation is necessary, to select regulatory approaches that maximize
net benefits (including potential economic, environmental, public
health and safety effects, and other advantages; distributive impacts,
and equity). Executive Order 13563 (Improving Regulation and Regulatory
Review) emphasizes the importance of quantifying both costs and
benefits, reducing costs, harmonizing rules, and promoting flexibility.
    The Office of Information and Regulatory Affairs has examined the
economic, interagency, budgetary, legal, and policy implications of
this regulatory action, and has determined that this rule is not a
significant regulatory action under E.O. 12866.
    DOT's impact analysis can be found as a supporting document at
http://www.regulations.gov, usually within 48 hours after the
rulemaking document is published.

Paperwork Reduction Act

    This proposed rule includes provisions constituting collections of
information under the Paperwork Reduction Act of 1995 (44 U.S.C. 3501-
3521) that require approval by the Office of Management and Budget
(OMB). Accordingly, under 44 U.S.C. 3507(d), DOT has submitted a copy
of this rulemaking action to OMB for its review.
    OMB assigns control numbers to collections of information it
approves. DOT may not conduct or sponsor, and a person is not required
to respond to, a collection of information unless it displays a
currently valid OMB control number. DOT is describing 12 collections of
information proposed in this rule under the TAR, 48 CFR part 1252,
Solicitation Provisions and Contract Clauses, that are related to 48
CFR part 1239, Acquisition of Information Technology:
     48 CFR 1252.239-70, Security Requirements for Unclassified
Information Technology Resources.
     48 CFR 1252.239-72, Compliance with Safeguarding DOT
Sensitive Data Controls.
     48 CFR 1252.239-74, Safeguarding DOT Sensitive Data and
Cyber Incident Reporting.
     48 CFR 1252.239-75, DOT Protection of Information About
Individuals, PII, and Privacy Risk Management Requirements.
     48 CFR 1252.239-76, Cloud Computing Services.
     48 CFR 1252.239-77, Data Jurisdiction.
     48 CFR 1252.239-80, Audit Record Retention for Cloud
Service Providers.
     48 CFR 1252.239-83, Incident Reporting Timeframes.
     48 CFR 1252.239-85, Personnel Screening--Background
Investigations.
     48 CFR 1252.239-88, Security Alerts, Advisories, and
Directives.
     48 CFR 1252.239-89, Technology Modernization.
     48 CFR 1252.239-90, Technology Upgrades/Refreshments.
    If OMB does not approve the collections of information as
requested, DOT will immediately remove the provisions containing a
collection of information or take such other action as is directed by
OMB.
    Comments on the collections of information contained in this
proposed rule should be submitted to the Office of Management and
Budget, Attention: Desk Officer for the Department of Transportation,
Office of Information and Regulatory Affairs, Washington, DC 20503,
with copies sent by mail or hand delivery to the U.S. Department of
Transportation, Office of the Chief Information Officer, Attn: Claire
Barrett, Room E31-312, 1200 New Jersey Avenue SE, Washington, DC 20590;
or email to [email protected]; and email to www.regulations.gov.
Comments should indicate that they are submitted in response to ``RIN
2105-AE26--Streamline and Update the Department of Transportation
Acquisition Regulation (TAR Case 2020-001).''
    OMB is required to make a decision concerning the collections of
information contained in this proposed rule between 30 and 60 days
after publication of this document in the Federal Register. Therefore,
a comment to OMB is best assured of having its full effect if OMB
receives it within 30 days of publication. This does not affect the
deadline for the public to comment on the proposed rule.
    The Department considers comments by the public on proposed
collections of information in--
     Evaluating whether the proposed collections of information
are necessary for the proper performance of the functions of the
Department, including whether the information will have practical
utility;
     Evaluating the accuracy of the Department's estimate of
the burden of the proposed collections of information, including the
validity of the methodology and assumptions used;
     Enhancing the quality, usefulness, and clarity of the
information to be collected; and
     Minimizing the burden of the collections of information on
those who are to respond, including through the use of appropriate
automated, electronic, mechanical, or other technological collection
techniques or other forms of information technology, e.g., permitting
electronic submission of responses.
    TAR Part 1239 related collections of information: Individual
summaries of collection of information, description of need for
information and proposed use of information, along with supporting
estimated data are described below. The total estimates related to PRA
and information collection burden on the public for the proposed rule,
to include the estimated burden hours, average number of respondents,
total estimated

annual responses, and total estimated annual reporting and
recordkeeping burden are provided below:
    Total estimated burden hours: 2,006.
    Estimated average number of respondents: 2,200.
    Total estimated annual responses: 2,511.
    Total estimated annual cost to all respondents (reporting and
recordkeeping burden): $66,398.60 (2,006 hours at $33.10 per hour). The
Bureau of Labor Statistics (BLS) gathers information on full-time wage
and salary workers. According to the latest (May 2019) available BLS
data, the mean hourly wage is $33.10 on BLS wage code--``15-1231
Computer Network Support Specialists.'' This information was taken from
the following website: https://www.bls.gov/oes/current/oes151231.htm.

Summary of Total Cost of ICR to Public

----------------------------------------------------------------------------------------------------------------
                                                 Average number   Average annual    OPM hourly     Total annual
            Clause               Burden hours         resp.            resp.           rate            cost
----------------------------------------------------------------------------------------------------------------
1252.239-70...................             422               844             844          $33.10      $13,968.20
1252.239-72...................              21                41              41           33.10          695.10
1252.239-74...................              52               104             104           33.10        1,721.20
1252.239-75...................             622               311             622           33.10       20,588.20
1252.239-76...................              54                36              36           33.10        1,787.40
1252.239-77...................              71               142             142           33.10        2,350.10
1252.239-80...................              54                36              36           33.10        1,787.40
1252.239-83...................              18                36              36           33.10          595.80
1252.239-85...................              71               142             142           33.10        2,350.10
1252.239-88...................              71               142             142           33.10        2,350.10
1252.239-89...................             440               293             293           33.10       14,564.00
1252.239-90...................             110                73              73           33.10        3,641.00
                               ---------------------------------------------------------------------------------
    Total.....................           2,006             2,200           2,511
                               ---------------------------------------------------------------------------------
        Total Cost to All       ..............  ................  ..............  ..............       66,398.60
         Respondents (Sum of
         all costs of all
         clauses).............
----------------------------------------------------------------------------------------------------------------

    The twelve clauses containing collections of information are
described below:

1252.239-70, Security Requirements for Unclassified Information
Technology Resources

    The collection of information contained in section 1239.106-70,
Contract clauses, and part 1252 at proposed clause 1252.239-70, is
described immediately following this paragraph.

Summary of Collection of Information

    We propose the use of 1252.239-70, Security Requirements for
Unclassified Information Technology Resources, as prescribed at
1239.106-70, Contract clauses.
    Proposed revised TAR clause 1252.239-70, Security Requirements for
Unclassified Information Technology Resources, is required in all
solicitations and contracts for Information Technology (IT) services
and is intended to protect DOT information and information technology
by requiring contractors to be responsible for information technology
security for all systems connected to a DOT network or operated by the
contractor for DOT, regardless of location. This clause is applicable
to all or any part of the contract that includes information technology
resources or services in which the contractor has physical or
electronic access to DOT information that directly supports the mission
of DOT. DOT would use the information collection requirements to assess
the contractor's compliance with specific Federal and DOT IT security
requirements. The information collection requirement is necessary to
ensure DOT information and information systems are adequately
protected.

Description of Need for Information and Proposed Use of Information

    Under Public Law 113-283, Federal Information Security
Modernization Act of 2014, each agency of the Federal Government must
provide security for the information and information systems that
support the operations and assets of the agency, including those
provided or managed by another agency, contractor, or other source.
    To comply with Public Law 113-283, Federal Information Security
Modernization Act of 2014, DOT developed clause 1252.239-70, Security
Requirements for Unclassified Information Technology Resources. The
clause contains the following information collection requirements: An
IT Security Plan within 30 days after contract award, and IT Security
Accreditation and accompanying documents within 6 months of contract
award to include a Final Security Plan, a Risk Assessment, a Security
Test and Evaluation Plan, and a Disaster Recovery/Continuity of
Operations Plan.
    Total Burden Hours: 422.
    Average Number of Respondents: 844.
    Average Annual Responses: 844.

----------------------------------------------------------------------------------------------------------------
                       x Number of responses                                                  Number of burden
Number of respondents      per respondent      x Number of minutes     / By 60 min/hour            hours
----------------------------------------------------------------------------------------------------------------
              844                      1                     30                                           422
----------------------------------------------------------------------------------------------------------------
Note: DOT has estimated the number of respondents based on identified NAICS codes reflecting previous contract
  awards averaged over the last three fiscal years--FY 2017, FY 2018, and FY 2019 where the clause may be
  required. DOT estimates that in the future for a typical contract performance period estimated of five years,
  the majority of the information collection requirements might be required in one of the years and thus
  estimates 20% of the total average of contract awards represents the potential pool of number of respondents
  who might submit an information collection requirement (ICR) response as shown below.

------------------------------------------------------------------------
                                                 (Respondents) Contract
         NAICS code: (as shown below)           award actions (average 3
                                                          FY)
------------------------------------------------------------------------
518210.......................................                        196
541511.......................................                      1,243
541512.......................................                        911
541513.......................................                        357
541519.......................................                      1,355
561621.......................................                        158
                                              --------------------------
    Total....................................                      4,220
------------------------------------------------------------------------

    Basis for estimated number of respondents: Number of NAICS code
contract actions = 4220 x 20% estimated number of annual respondents
(based on typical five-year period of performance and ICR would be
submitted in first year of contract) = 844.

1252.239-72, Compliance With Safeguarding DOT Sensitive Data Controls

    The collection of information contained in section 1239.7003,
Contract clauses, and part 1252 at proposed clause 1252.239-72, is
described immediately following this paragraph.

Summary of Collection of Information

    We propose the use of 1252.239-72, Compliance with Safeguarding DOT
Sensitive Data Controls, as prescribed at 1239.7003, Contract clauses.
    New proposed TAR clause 1252.239-72, Compliance with Safeguarding
DOT Sensitive Data Controls, requires contractors to provide to the
Government the submittal and approval(s) of current or previous NIST
800-171 Variance requests and approvals.
    Clause 1252.239-72, Compliance with Safeguarding DOT Sensitive Data
Controls, is required to implement security requirements contained in
clause 1252.239-74, Safeguarding DOT Sensitive Data and Cyber Incident
Reporting, for DOT sensitive data on Contractor information systems
that support the performance of the contract. If the Offeror proposes
to vary from any security requirements specified by NIST SP 800-171 in
effect at the time the solicitation is issued or as authorized by the
Contracting Officer, the Offeror shall submit to the Contracting
Officer, for consideration by the DOT Chief Information Officer (CIO),
a written explanation of--(1) Why a particular security requirement is
not applicable; or (2) How the Contractor will use an alternative, but
equally effective, security measure to satisfy the requirements of NIST
SP 800-171. DOT would use the information collection requirements to
assess the contractor's compliance with specific Federal and DOT IT
security requirements. The information is necessary to ensure DOT
information and information systems are adequately protected.

Description of Need for Information and Proposed Use of Information

    Under Public Law 113-283, Federal Information Security
Modernization Act of 2014, each agency of the Federal Government must
provide security for the information and information systems that
support the operations and assets of the agency, including those
provided or managed by another agency, contractor, or other source. To
comply with Public Law 113-283, Federal Information Security
Modernization Act of 2014, DOT developed clause 1252.239-72, Compliance
with Safeguarding DOT Sensitive Data Controls.
    Total Burden Hours: 21.
    Average Number of Respondents: 41.
    Average Annual Responses: 41.

----------------------------------------------------------------------------------------------------------------
                       x Number of responses                                                  Number of burden
Number of respondents      per respondent      x Number of minutes     / By 60 min/hour            hours
----------------------------------------------------------------------------------------------------------------
               41                      1                     30                                            21
----------------------------------------------------------------------------------------------------------------

    Note:  DOT has estimated the number of respondents based on
identified NAICS codes reflecting previous contract awards averaged
over the last three fiscal years--FY 2017, FY 2018, and FY 2019
where the clause may be required. DOT estimates that in the future
for a typical contract performance period estimated of five years,
the majority of the information collection requirements might be
required in one of the years and thus estimates 2% of the total
average of contract awards represents the potential pool of number
of respondents who might submit an information collection
requirement (ICR) response as shown below principally pertaining to
cyber incidents.

------------------------------------------------------------------------
                                                 (Respondents) contract
         NAICS code: (as shown below)           award actions (average 3
                                                          FY)
------------------------------------------------------------------------
518210.......................................                        196
541199.......................................                         12
541513.......................................                        357
541618.......................................                         60
541990.......................................                        932
541110.......................................                        335
561499.......................................                         22
561621.......................................                        158
                                              --------------------------
                                                                   2,072
------------------------------------------------------------------------

    Basis for estimated number of respondents: Number of NAICS code
contract actions = 2072 x 2% estimated number of annual respondents
might submit a NIST 800-171 variance request or approval ICR = 41.

1252.239-74, Safeguarding DOT Sensitive Data and Cyber Incident
Reporting

    The collection of information contained in section 1239.7003,
Contract clauses, and part 1252 at proposed clause 1252.239-74, is
described immediately following this paragraph.

Summary of Collection of Information

    We propose the use of 1252.239-74, Safeguarding DOT Sensitive Data
and Cyber Incident Reporting, as prescribed at 1239.7003, Contract
clauses.
    New proposed TAR clause 1252.239-74, Safeguarding DOT Sensitive
Data and Cyber Incident Reporting, requires contractors to provide to
the Government--
     Submittal and approval(s) of current or previous NIST 800-
171 Variance requests and approvals, along with subcontractor reporting
of the same;
     Cyber incident reporting and assessment; and subcontractor
reporting of the same;
     Submittal of malicious software; and
     Submittal of media images of known information systems and
relevant monitoring/packet capture data.
    Clause 1252.239-74, Safeguarding DOT Sensitive Data and Cyber
Incident Reporting, requires that contractors shall provide adequate
security on all covered contractor information systems. To provide
adequate security, the contractor shall implement, at a minimum,
information security protections set forth in the clause. DOT would use
the information collection requirements to assess the contractor's
compliance with specific Federal and DOT IT security requirements. The
information is necessary to ensure DOT information and information
systems are adequately protected.

Description of Need for Information and Proposed Use of Information

    Under Public Law 113-283, Federal Information Security
Modernization Act of 2014, each agency of the Federal Government must
provide security for the information and information systems that
support the operations and assets of the agency, including those
provided or managed by another agency, contractor, or other source. To
comply with Public Law 113-283, Federal Information Security
Modernization Act of 2014, DOT developed clause 1252.239-74,
Safeguarding DOT Sensitive Data and Cyber Incident Reporting.
    Total Burden Hours: 52.
    Average Number of Respondents: 104.
    Average Annual Responses: 104.

----------------------------------------------------------------------------------------------------------------
                       x Number of responses                                                  Number of burden
Number of respondents      per respondent      x Number of minutes     / By 60 min/hour            hours
----------------------------------------------------------------------------------------------------------------
              104                      1                     30                                            52
----------------------------------------------------------------------------------------------------------------

------------------------------------------------------------------------
                                                 (Respondents) contract
         NAICS code: (as shown below)           award actions (average 3
                                                          FY)
------------------------------------------------------------------------
518210.......................................                        196
541199.......................................                         12
541513.......................................                        357
541618.......................................                         60
541990.......................................                        932
541110.......................................                        335
561499.......................................                         22
561621.......................................                        158
                                              --------------------------
                                                                   2,072
------------------------------------------------------------------------

    Basis for estimated number of respondents: Number of NAICS code
contract actions = 2072 x 5% estimated number of annual respondents
might submit a NIST 800-171 variance request or approval ICR or report
and submittal of cyber incidents and associated submittals = 104.

1252.239-75, DOT Protection of Information About Individuals, PII, and
Privacy Risk Management Requirements

    The collection of information contained in section 1239.7104,
Contract clause, and part 1252 at proposed clause 1252.239-75, is
described immediately following this paragraph.

Summary of Collection of Information

    We propose the use of 1252.239-75, DOT Protection of Information
About Individuals, PII, and Privacy Risk Management Requirements, as
prescribed at 1239.7104, Contract clause.
    New proposed TAR clause 1252.239-75, DOT Protection of Information
About Individuals, PII, and Privacy Risk Management Requirements,
contains the following information collection requirements from the
public:
     Notification/reporting of non-compliance with DOT data
protection standards with respect to Personally Identifiable
Information (PII).
     Notification of new or unanticipated threats or hazards,
or if existing safeguards have ceased to function.
     Execution and submittal of confidentiality agreements
(protection of PII).
     Notification and secure return of PII to Government when
any part of PII, in any form, the Contractor obtains from or behalf of
DOT ceases to be required by Contractor or upon termination of
contract, within ten (10) business days; or, at DOT's written request
to destroy, un-install and/or remove all copies of such PII and provide
certification that PII has been returned, or remove or destroyed; and
subcontractor certification of return of all records within 30 days of
subcontractor's completion of services.

     Breach reporting; and subcontractor breach reporting.
     Notification of subcontractor access to PII.
    Clause 1252.239-75, DOT Protection of Information About
Individuals, PII, and Privacy Risk Management Requirements, requires
any contractor under a DOT contract that creates, maintains, acquires,
discloses, uses, or has access to PII in furtherance of the contract,
to comply with all applicable Federal law, guidance, and standards and
DOT policies pertaining to its protection. The clause requires
contractors to comply with the Privacy Act of 1974, 5 U.S.C. 552a, DOT
implementing regulations (49 CFR part 10), and DOT policies issued
under the Act in the design, development, and/or operation of any
system of records on individuals to accomplish a DOT function when the
contract specifically identifies the work that the contractor is to
perform. It imposes certain information collection requirements,
reporting, and submissions as outlined above. DOT would use the
information collection requirements to assess the contractor's
compliance with specific Federal and DOT IT security requirements. The
information is necessary to ensure DOT information and information
systems are adequately protected.

Description of Need for Information and Proposed Use of Information

    Under Public Law 113-283, Federal Information Security
Modernization Act of 2014, each agency of the Federal Government must
provide security for the information and information systems that
support the operations and assets of the agency, including those
provided or managed by another agency, contractor, or other source.
    To comply with Public Law 113-283, Federal Information Security
Modernization Act of 2014, DOT developed clause 1252.239-75, DOT
Protection of Information About Individuals, PII, and Privacy Risk
Management Requirements.
    Total Burden Hours: 622.
    Average Number of Respondents: 311.
    Average Annual Responses: 622.

----------------------------------------------------------------------------------------------------------------
                       x Number of responses                                                  Number of burden
Number of respondents      per respondent      x Number of minutes     / By 60 min/hour            hours
----------------------------------------------------------------------------------------------------------------
              311                      2                     60                                           622
----------------------------------------------------------------------------------------------------------------

    Note:  DOT has estimated the number of respondents based on
identified NAICS codes reflecting previous contract awards averaged
over the last three fiscal years--FY 2017, FY 2018, and FY 2019
where the clause may be required. DOT estimates that in the future
for a typical contract performance period only 15% of the total
average of contract awards represents the potential pool of number
of respondents who might deal with PII and are required to submit an
information collection requirement (ICR) response, as shown below.

------------------------------------------------------------------------
                                                 (Respondents) contract
         NAICS code: (as shown below)          award actions  (average 3
                                                          FY)
------------------------------------------------------------------------
518210.......................................                        196
541199.......................................                         12
541513.......................................                        357
541618.......................................                         60
541990.......................................                        932
541110.......................................                        335
561499.......................................                         22
561621.......................................                        158
                                              --------------------------
                                                                   2,072
------------------------------------------------------------------------

    Basis for estimated number of respondents: Number of NAICS code
contract actions = 2072 x 15% estimated number of annual respondents
might submit a ICRs under this clause = 311.

1252.239-76, Cloud Computing Services

    The collection of information contained in section 1239.7204,
Contract clauses, and part 1252 at proposed clause 1252.239-76, is
described immediately following this paragraph.

Summary of Collection of Information

    We propose the use of 1252.239-76, Cloud Computing Services, as
prescribed at 1239.7204, Contract clauses.
    New proposed TAR clause 1252.239-76, Cloud Computing Services,
contains the following information collection requirements from the
public:
     Notification of new or unanticipated threats or hazards,
or if existing safeguards have ceased to function.
     Providing results of vendor-conducted scans or audits.
     Cyber incident reporting and assessment.
     Malicious software submittal.
     Media images of known information systems and relevant
monitoring/packet capture data.
    Clause 1252.239-76, Cloud Computing Services, requires contractors
to implement and maintain administrative, technical, and physical
safeguards and controls with the security level and services required
in accordance with DOT Order 1351.37, Departmental Cybersecurity
Policy, and the requirements of DOT Order 1351.18, Departmental Privacy
Risk Management Policy. It requires cyber incident reporting and
notification of threats and hazards, and submittal of associated scans,
malicious software, and media images.

Description of Need for Information and Proposed Use of Information

    Under Public Law 113-283, Federal Information Security
Modernization Act of 2014, each agency of the Federal Government must
provide security for the information and information systems that
support the operations and assets of the agency, including those
provided or managed by another agency, contractor, or other source. DOT
would use the information collection

requirements to assess the contractor's compliance with specific
Federal and DOT IT security requirements. The information is necessary
to ensure DOT information and information systems are adequately
protected.
    Total Burden Hours: 54.
    Average Number of Respondents: 36.
    Average Annual Responses: 36.

----------------------------------------------------------------------------------------------------------------
                       x Number of responses                                                  Number of burden
Number of respondents      per respondent      x Number of minutes     / By 60 min/hour            hours
----------------------------------------------------------------------------------------------------------------
               36                      1                     90                                            54
----------------------------------------------------------------------------------------------------------------

    Note:  DOT has estimated the number of respondents based on
identified NAICS codes reflecting previous contract awards averaged
over the last three fiscal years--FY 2017, FY 2018, and FY 2019
where the clause may be required. DOT estimates that in the future
for a typical contract performance period estimated of five years,
the majority of the information collection requirements might be
required in one of the years and thus estimates 5% of the total
average of contract awards represents the potential pool of number
of respondents who might submit an information collection
requirement (ICR) response as shown below principally pertaining to
cyber incidents and related reporting requirements.

------------------------------------------------------------------------
                                                 (Respondents) contract
         NAICS code: (as shown below)           award actions (average 3
                                                          FY)
------------------------------------------------------------------------
518210.......................................                        196
541513.......................................                        357
561621.......................................                        158
                                              --------------------------
                                                                     711
------------------------------------------------------------------------

    Basis for estimated number of respondents: Number of NAICS contract
actions = 711 x 5% estimated number of annual respondents might submit
an ICR or report and submittal of cyber incidents and associated
submittals = 36.

1252.239-77, Data Jurisdiction

    The collection of information contained in section 1239.7204,
Contract clauses, and part 1252 at proposed clause 1252.239-77, is
described immediately following this paragraph.

Summary of Collection of Information

    We propose the use of 1252.239-77, Data Jurisdiction, as prescribed
at 1239.7204, Contract clauses.
    New proposed TAR clause 1252.239-77, Data Jurisdiction, contains
the following information collection requirements from the public:
     Identifying all data centers that data at rest or data
back-up resides, including primary and replicated storage.
    Clause 1252.239-77, Data Jurisdiction, requires the contactor to
identify all data centers that the data at rest or data backup will
reside, including primary and replicated storage. The Contractor shall
ensure that all data centers not physically located on DOT premises
reside within the United States, the District of Columbia, and all
territories and possessions of the United States, unless otherwise
authorized by the DOT CIO.

Description of Need for Information and Proposed Use of Information

    Under Public Law 113-283, Federal Information Security
Modernization Act of 2014, each agency of the Federal Government must
provide security for the information and information systems that
support the operations and assets of the agency, including those
provided or managed by another agency, contractor, or other source. DOT
would use the information collection requirements to assess the
contractor's compliance with specific Federal and DOT IT security
requirements. The information is necessary to ensure DOT information
and information systems are adequately protected.
    Total Burden Hours: 71.
    Average Number of Respondents: 142.
    Average Annual Responses: 142.

----------------------------------------------------------------------------------------------------------------
                       x Number of responses                                                  Number of burden
Number of respondents      per respondent      x Number of minutes     / By 60 min/hour            hours
----------------------------------------------------------------------------------------------------------------
              142                      1                     30                                            71
----------------------------------------------------------------------------------------------------------------

------------------------------------------------------------------------
                                                 (Respondents) contract
         NAICS code: (as shown below)           award actions (average 3
                                                          FY)
------------------------------------------------------------------------
518210.......................................                        196
541513.......................................                        357
561621.......................................                        158
                                              --------------------------
                                                                     711
------------------------------------------------------------------------

    Basis for estimated number of respondents: Number of NAICS code
contract actions = 711 x 20% estimated number of annual respondents
might submit an ICR under the clause = 142.

1252.239-80, Audit Record Retention for Cloud Service Providers

    The collection of information contained in section 1239.7204,
Contract clauses, and part 1252 at proposed clause 1252.239-80, is
described immediately following this paragraph.

Summary of Collection of Information

    We propose the use of 1252.239-80, Audit Record Retention for Cloud
Service Providers, as prescribed at 1239.7204, Contract clauses.
    New proposed TAR clause 1252.239-80, Audit Record Retention for
Cloud Service Providers, contains the following information collection
requirements from the public:
     Transfer of permanent records to NARA or deletion of
temporary records and reporting of same.
    Clause 1252.239-80, Audit Record Retention for Cloud Service
Providers, requires contractors to support a system in accordance with
the requirement for Federal agencies to manage their electronic records
in accordance with 36 CFR 1236.20 and 1236.22, including but not
limited to capabilities such as those identified in DoD STD-5015.2 V3,
Electronic Records Management Software Applications Design Criteria
Standard, NARA Bulletin 2008-05, July 31, 2008, Guidance concerning the
use of email archiving applications to store email, and NARA Bulletin
2010-05 September 08, 2010, Guidance on Managing Records in Cloud
Computing Environments. The clause requires transfer of permanent
records to NARA or deletion of temporary records and reporting of same.

Description of Need for Information and Proposed Use of Information

    Under Public Law 113-283, Federal Information Security
Modernization Act of 2014, each agency of the Federal Government must
provide security for the information and information systems that
support the operations and assets of the agency, including those
provided or managed by another agency, contractor, or other source. DOT
would use the information collection requirements to assess the
contractor's compliance with specific Federal and DOT IT security
requirements. The information is necessary to ensure DOT information
and information systems are adequately protected.
    Total Burden Hours: 54.
    Average Number of Respondents: 36.
    Average Annual Responses: 36.

----------------------------------------------------------------------------------------------------------------
                                               x Number of
           Number of respondents              responses per     x Number of     / by 60  min/   Number of burden
                                                respondent        minutes            hour             hours
----------------------------------------------------------------------------------------------------------------
36.........................................               1               90                                 54
----------------------------------------------------------------------------------------------------------------

------------------------------------------------------------------------
                                                 (Respondents) contract
         NAICS code: (as shown below)           award actions (average 3
                                                          FY)
------------------------------------------------------------------------
518210.......................................                        196
541513.......................................                        357
561621.......................................                        158
                                              --------------------------
                                                                     711
------------------------------------------------------------------------

    Basis for estimated number of respondents: Number of NAICS code
contract actions = 711 x 5% estimated number of annual respondents
might submit an ICR under the clause = 36.

1252.239-83, Incident Reporting Timeframes

    The collection of information contained in section 1239.7204,
Contract clauses, and part 1252 at proposed clause 1252.239-83, is
described immediately following this paragraph.

Summary of Collection of Information

    We propose the use of 1252.239-83, Incident Reporting Timeframes,
as prescribed at 1239.7204, Contract clauses.
    New proposed TAR clause 1252.239-83, Incident Reporting Timeframes,
contains the following information collection requirements from the
public:
     Cyber incident reporting.
    Clause 1252.239-83, Incident Reporting Timeframes, requires
contractors to report all computer security incidents to the DOT
Security Operations Center (SOC) in accordance with Subpart 1239.70--
Information Security and Incident Response Reporting and provides
specific points of contact and phone numbers to report cyber incidents.

Description of Need for Information and Proposed Use of Information

    Under Public Law 113-283, Federal Information Security
Modernization Act of 2014, each agency of the Federal Government must
provide security for the information and information systems that
support the operations and assets of the agency, including those
provided or managed by another agency, contractor, or other source. DOT
would use the information collection requirements to assess the
contractor's compliance with specific Federal and DOT IT security
requirements. The information is necessary to ensure DOT information
and information systems are adequately protected.
    Total Burden Hours: 18.
    Average Number of Respondents: 36.
    Average Annual Responses: 36.

----------------------------------------------------------------------------------------------------------------
                                               x Number of
           Number of respondents              responses per     x Number of      / by 60 min/   Number of burden
                                                respondent        minutes            hour             hours
----------------------------------------------------------------------------------------------------------------
36.........................................               1               30                                 18
----------------------------------------------------------------------------------------------------------------

------------------------------------------------------------------------
                                                 (Respondents) contract
         NAICS code: (as shown below)           award actions (average 3
                                                          FY)
------------------------------------------------------------------------
518210.......................................                        196
541513.......................................                        357
561621.......................................                        158
                                              --------------------------
                                                                     711
------------------------------------------------------------------------

    Basis for estimated number of respondents: Number of NAICS code
contract actions = 711 x 5% estimated number of annual respondents
might submit an ICR under the clause = 36.

1252.239-85, Personnel Screening--Background Investigations

    The collection of information contained in section 1239.7204,
Contract clauses, and part 1252 at proposed clause 1252.239-85, is
described immediately following this paragraph.

Summary of Collection of Information

    We propose the use of 1252.239-85, Personnel Screening--Background
Investigations, as prescribed at 1239.7204, Contract clauses.
    New proposed TAR clause 1252.239-85, Personnel Screening--
Background Investigations, contains the following information
collection requirements from the public:
     Furnish documentation reflecting favorable adjudication of
background investigations.
    Clause 1252.239-85, Personnel Screening--Background Investigations,
requires contractors provide support personnel who are U.S. persons
maintaining a NACI clearance or greater in accordance with OMB
memorandum M-05-24, Section C. Contractors must also furnish
documentation reflecting favorable adjudication of background
investigations for all personnel supporting the system.

Description of Need for Information and Proposed Use of Information

    Under Public Law 113-283, Federal Information Security
Modernization Act of 2014, each agency of the Federal Government must
provide security for the information and information systems that
support the operations and assets of the agency, including those
provided or managed by another agency, contractor, or other source. DOT
would use the information collection requirements to assess the
contractor's compliance with specific Federal and DOT IT security
requirements. The information is necessary to ensure DOT information
and information systems are adequately protected.
    Total Burden Hours: 71.
    Average Number of Respondents: 142.
    Average Annual Responses: 142.

----------------------------------------------------------------------------------------------------------------
                                               x Number of
           Number of respondents              responses per     x Number of      / by 60 min/   Number of burden
                                                respondent        minutes            hour             hours
----------------------------------------------------------------------------------------------------------------
142........................................               1               30                                 71
----------------------------------------------------------------------------------------------------------------

------------------------------------------------------------------------
                                                 (Respondents) contract
         NAICS code: (as shown below)           award actions (average 3
                                                          FY)
------------------------------------------------------------------------
518210.......................................                        196
541513.......................................                        357
561621.......................................                        158
                                              --------------------------
                                                                     711
------------------------------------------------------------------------

    Basis for estimated number of respondents: Number of NAICS code
contract actions = 711 x 20% estimated number of annual respondents
might submit an ICR under the clause = 142.

1252.239-88, Security Alerts, Advisories, and Directives

    The collection of information contained in section 1239.7204,
Contract clauses, and part 1252 at proposed clause 1252.239-88, is
described immediately following this paragraph.

Summary of Collection of Information

    We propose the use of 1252.239-88, Security Alerts, Advisories, and
Directives as prescribed at 1239.7204, Contract clauses.
    New proposed TAR clause 1252.239-88, Security Alerts, Advisories,
and Directives, contains the following information collection
requirements from the public:
     Provide list of personnel assigned system administration,
monitoring, and/or security responsibilities and designated to receive
security alerts, advisories, and directives, as well as a list of those
personnel responsible for implementation of remedial actions associated
with them.

Description of Need for Information and Proposed Use of Information

    Under Public Law 113-283, Federal Information Security
Modernization Act of 2014, each agency of the Federal Government must
provide security for the information and information systems that
support the operations and assets of the agency, including those
provided or managed by another agency, contractor, or other source. DOT
would use the information collection requirements to assess the
contractor's compliance with specific Federal and DOT IT security
requirements. The information is necessary to ensure DOT

information and information systems are adequately protected.
    Total Burden Hours: 71.
    Average Number of Respondents: 142.
    Average Annual Responses: 142.

----------------------------------------------------------------------------------------------------------------
                                               x Number of
           Number of respondents              responses per     x Number of      / by 60 min/   Number of burden
                                                respondent        minutes            hour             hours
----------------------------------------------------------------------------------------------------------------
142........................................               1               30                                 71
----------------------------------------------------------------------------------------------------------------

------------------------------------------------------------------------
                                                 (Respondents) contract
         NAICS code: (as shown below)           award actions (average 3
                                                          FY)
------------------------------------------------------------------------
518210.......................................                        196
541513.......................................                        357
561621.......................................                        158
                                              --------------------------
                                                                     711
------------------------------------------------------------------------

    Basis for estimated number of respondents: Number of NAICS code
contract actions = 711 x 20% estimated number of annual respondents
might submit an ICR under the clause = 142.

1252.239-89, Technology Modernization

    The collection of information contained in section 1239.7303,
Contract clauses, and part 1252 at proposed clause 1252.239-89, is
described immediately following this paragraph.

Summary of Collection of Information

    We propose the use of 1252.239-89, Technology Modernization, as
prescribed at 1239.7303, Contract clauses.
    New proposed TAR clause 1252.239-89, Technology Modernization,
contains the following information collection requirements from the
public:
     Submittal of price or cost proposals for modernization
approach.
    Clause 1252.239-89, Technology Modernization, encourages the
contractor to propose independently a modernization approach to the
hardware, software, specifications, or other requirements of the
contract. This modernization approach may be proposed to increase
efficiencies (both system and process level), reduce costs, strengthen
the cyber security posture, or for any other purpose which presents an
advantage to the Government. The clause requires the contractor to
submit a price or cost proposal to the Contracting Officer for
evaluation.

Description of Need for Information and Proposed Use of Information

    Under Public Law 113-283, Federal Information Security
Modernization Act of 2014, each agency of the Federal Government must
provide security for the information and information systems that
support the operations and assets of the agency, including those
provided or managed by another agency, contractor, or other source.
    To comply with Public Law 113-283, Federal Information Security
Modernization Act of 2014, DOT developed clause 1252.239-89, Technology
Modernization. DOT would use the information collection requirements to
assess the contractor's proposal(s), the comparative advantages and
disadvantages of the existing contract requirement and the proposed
change; itemized requirements of the contract that must be changed; an
estimate of the changes in performance and price or cost; and potential
delivery schedule impact(s). The information is needed by the
Government to adequately evaluate the proposals and negotiate any
contract modification terms and conditions, to include cost or price.
    Total Burden Hours: 440.
    Average Number of Respondents: 293.
    Average Annual Responses: 293.

----------------------------------------------------------------------------------------------------------------
                                               x Number of
           Number of respondents              responses per     x Number of      / by 60 min/   Number of burden
                                                respondent        minutes            hour             hours
----------------------------------------------------------------------------------------------------------------
293........................................               1               90                                440
----------------------------------------------------------------------------------------------------------------

    Note: DOT has estimated the number of respondents based on
identified NAICS code reflecting previous contract awards averaged over
the last three fiscal years--FY 2017, FY 2018, and FY 2019 where the
clause may be required. DOT estimates that in the future for a typical
contract performance period estimated of five years, the majority of
the information collection requirements might be required in one of the
years and thus estimates 20% of the total average of contract awards
represents the potential pool of number of respondents who might submit
an information collection requirement (ICR) response as shown below.

------------------------------------------------------------------------
                                                 (Respondents) contract
         NAICS code: (as shown below)           award actions (average 3
                                                          FY)
------------------------------------------------------------------------
518210.......................................                        196
541512.......................................                        911
541513.......................................                        357
                                              --------------------------
                                                                   1,464
------------------------------------------------------------------------

    Basis for estimated number of respondents: Number of NAICS code
contract actions = 1,464 x 20% estimated number of annual respondents
(based on typical five-year period of performance and ICR might be
requested or submitted in one of the five total possible years of the
contract) = 293.

1252.239-90, Technology Upgrades/Refreshments

    The collection of information contained in section 1239.7303,
Contract clauses, and part 1252 at proposed clause 1252.239-90, is
described immediately following this paragraph.

Summary of Collection of Information

    We propose the use of 1252.239-90, Technology Upgrades/
Refreshments, as prescribed at 1239.7303, Contract clauses.
    New proposed TAR clause 1252.239-90, Technology Upgrades/
Refreshments, contains the following information collection
requirements from the public:
     Submittal of price or cost proposals for upgrade/
refreshment approach.
    Clause 1252.239-90, Technology Upgrades/Refreshments, encourages
contractors to propose independently technology improvements to the
hardware, software, specifications, or other requirements of the
contract. These improvements may be proposed to save money, to improve
performance, to save energy, to satisfy increased data processing
requirements, or for any other purpose that presents a technological
advantage to the Government. The clause requires the contractor to
submit a price or cost proposal to the Contracting Officer for
evaluation.

Description of Need for Information and Proposed Use of Information

    Under Public Law 113-283, Federal Information Security
Modernization Act of 2014, each agency of the Federal Government must
provide security for the information and information systems that
support the operations and assets of the agency, including those
provided or managed by another agency, contractor, or other source.
    To comply with Public Law 113-283, Federal Information Security
Modernization Act of 2014, DOT developed clause 1252.239-90, Technology
Upgrades/Refreshments. DOT would use the information collection
requirements to assess the contractor's proposal(s), the comparative
advantages and disadvantages of the existing contract requirement and
the proposed change; itemized requirements of the contract that must be
changed; an estimate of the changes in performance and price or cost;
and potential delivery schedule impact(s). The information is needed by
the Government to adequately evaluate the proposals and negotiate any
contract modification terms and conditions, to include cost or price.
    Total Burden Hours: 110.
    Average Number of Respondents: 73.
    Average Annual Responses: 73.

----------------------------------------------------------------------------------------------------------------
                                               x Number of
           Number of respondents              responses per     x Number of      / by 60 min/   Number of burden
                                                respondent        minutes            hour             hours
----------------------------------------------------------------------------------------------------------------
73.........................................               1               90                                110
----------------------------------------------------------------------------------------------------------------

------------------------------------------------------------------------
                                                 (Respondents) contract
         NAICS code: (as shown below)           award actions (average 3
                                                          FY)
------------------------------------------------------------------------
518210.......................................                        196
541512.......................................                        911
541513.......................................                        357
                                              --------------------------
                                                                   1,464
------------------------------------------------------------------------

    Basis for estimated number of respondents: Number of NAICS code
contract actions = 1,464 x 5% estimated number of annual respondents
(based on typical five-year period of performance and ICR might be
requested or submitted in one of the five total possible years of the
contract) = 73.

Regulatory Flexibility Act

    DOE expects that the overall impact of the proposed rule would
benefit small businesses because DOT proposes to update the TAR to,
among other things, revise outdated information, remove extraneous
procedural information that applies only to DOT's internal operating
procedures, and remove policy or procedures duplicative of FAR
requirements. Any additional costs associated with the rule, such as
costs to implement the substantive new and revised requirements
concerning information technology (IT) security provisions of the
Federal Information Security Management Act of 2002 (FISMA), (Title III
of the E-Government Act of 2002 (E-Gov Act)), can be factored into the
contract price. On this basis, the Secretary hereby certifies that this
proposed rule will not have a significant economic impact on a
substantial number of small entities as they are defined in the
Regulatory Flexibility Act, 5 U.S.C. 601-612. Therefore, pursuant to 5
U.S.C. 605(b), the initial and final regulatory flexibility analysis
requirements of sections 603 and 604 do not apply.
    While on the basis of the foregoing, DOT has determined that the
agency is not required to prepare an Initial Regulatory Flexibility
Analysis (IRFA), DOT has prepared an IRFA that is summarized here.
Comments are solicited from small businesses and other interested
parties and will be considered in the development of the final rule.

Initial Regulatory Flexibility Analysis

    This Initial Regulatory Flexibility Analysis has been prepared
consistent with 5 U.S.C. 603.
    1. Description of the reasons why the action is being taken.
    This proposed rule would amend the Transportation Acquisition
Regulation (TAR) to implement updates to the TAR, remove extraneous
procedural information that applies only to DOT's internal operating
procedures, and remove policy or procedures duplicative of FAR
requirements. The proposed rule also includes substantive new and
revised requirements concerning information technology (IT) security
provisions of the Federal Information Security Management Act of 2002
(FISMA), (Title III of the E-Government Act of 2002 (E-Gov Act)). FISMA

requires agencies to identify and provide information security
protections commensurate with security risks to Federal information
collected or maintained for the agency and information systems used or
operated on behalf of an agency by a contractor. The Federal Regulatory
Council (FAR Council) contemplated in their previous FAR rules on IT
that subsequent supplemental policy-making at the agency level may have
some impact on small business entities, because FISMA requires that
agencies establish IT security policies commensurate with agency risk
and potential for harm and that meet certain minimum requirements. The
impact on small entities was understood to be variable depending on the
agency implementation. Based on a review of the potential impact on
small business entities, DOT has determined that the requirements
specified in the rule are inherent to successful performance on any
Federal contract.
    2. Succinct statement of the objectives of, and legal basis for,
the rule.
    In addition to updating the TAR to remove outdated information,
remove extraneous procedural information that applies only to DOT's
internal operating procedures, and to remove policy or procedures
duplicative of FAR requirements, the rule implements the IT security
provisions of the FISMA. Section 301 of FISMA (44 U.S.C. 3544) requires
that contractors be held accountable to the same security standards as
Government employees when collecting or maintaining information or
using or operating information systems on behalf of an agency. Security
is to be considered during all phases of the acquisition life cycle.
FISMA requires that agencies establish IT security policies
commensurate with agency risk and potential for harm and that meet
certain minimum requirements. Agencies are further required, through
the Chief Information Officer (CIO) or equivalent, to assure compliance
with agency security policies. The law requires that contractors and
Federal employees be subjected to the same requirements in accessing
Federal IT systems and data.
    3. Description of and, where feasible, estimate of the number of
small entities to which the rule will apply.
    To estimate the number of small businesses who could potentially be
impacted by the rule, DOT identified contract award actions across key
North American Industry Classification System (NAICS) codes that could
be affected for three fiscal years--FY 2017, 2018, and 2019 as set
forth in the table below. DOE focused on businesses who could be
impacted by the proposed revisions to part 1239, Acquisition of
Information Technology, because of the potential costs resulting from
the associated Paperwork Reduction Act information collection burdens
(though as noted above, DOT ultimately pays those costs as part of the
contract).

----------------------------------------------------------------------------------------------------------------
             NAICS                  NAICS description       FY 2017    FY 2018    FY 2019     Total     Average
----------------------------------------------------------------------------------------------------------------
518210........................  Data Processing, Hosting,        172        177        238        587        196
                                 and Related Services.
541199........................  All Other Legal Services.          9         12         15         36         12
541511........................  Custom Computer                  896      1,964        870      3,730      1,243
                                 Programming Services.
541512........................  Computer Systems Design          754        942      1,036      2,732        911
                                 Services.
541513........................  Computer Facilities              385        358        329      1,072        357
                                 Management Services.
541519........................  Other Computer Related         1,270      1,440      1,355      4,065      1,355
                                 Services.
541618........................  Other Management                  86         53         40        179         60
                                 Consulting Services.
541990........................  All Other Professional,          947      1,002        848      2,797        932
                                 Scientific, and Tech.
                                 Svcs.
561110........................  Office Administrative            373        352        279      1,004        335
                                 Services.
561499........................  All Other Business                20         20         25         65         22
                                 Support Services.
561621........................  Security Systems Services        187        142        146        475        158
                                                          ------------------------------------------------------
                                   Total.................      5,099      6,462      5,181     16,742      5,581
----------------------------------------------------------------------------------------------------------------

    As shown, DOT awarded over 16,742 contracts for IT or IT-related
services during FY 2017 through FY 2019. To estimate the number of
small businesses potentially impacted by the rule, DOT notes that in FY
2019, the department achieved a 37.12% goal of overall awards to all
small business concerns across all NAICS and all operating
administrations. Using this figure to project the potential impact to
small business entities who may be affected by the rule, the Department
estimates that these businesses could be awarded 10%-25% of such work,
or up to 4,186 contracts awarded to small businesses.
    4. Description of projected reporting, recordkeeping, and other
compliance requirements of the rule, including an estimate of the
classes of small entities which will be subject to the requirement and
the type of professional skills necessary for preparation of the report
or record.
    The revised record keeping and reporting requirements and estimated
impacts are described in the Paperwork Reduction Act (PRA) section of
the rule.
    5. Identification, to the extent practicable, of all relevant
Federal rules which may duplicate, overlap, or conflict with the rule.
    The rule does not duplicate, overlap, or conflict with any other
Federal rules.
    6. Description of any significant alternatives to the rule which
accomplish the stated objectives of applicable statutes and which
minimize any significant economic impact of the rule on small entities.
    DOT considered whether any other alternatives would reduce the
impact on small businesses but concluded that the proposed rule was
necessary for consistency with the FAR, for FISMA compliance, and to
ensure the information security and integrity of DOT information and
information systems.

Comments on the Economic Impacts of the Rule

    DOT has submitted a copy of the IRFA to the Chief Counsel for
Advocacy of the Small Business Administration. DOT will consider
comments from small entities concerning the affected TAR parts, to
include 1239 that pertains to IT. Interested parties should cite 5
U.S.C 601, et seq. and reference RIN 2105-AE26--Streamline and Update
the Department of Transportation Acquisition Regulation (TAR Case 2020-
001), in comments on the certification or the IRFA presented in this
proposed rule.

Unfunded Mandates

    The Unfunded Mandates Reform Act of 1995 requires, at 2 U.S.C.
1532, that agencies prepare an assessment of anticipated costs and
benefits before issuing any rule that may result in the expenditure by
State, local, and tribal governments, in the aggregate, or by the

private sector, of $100 million or more (adjusted annually for
inflation) in any one year. DOE has determined that this proposed rule
would have no such effect on State, local, and tribal governments or on
the private sector. Therefore, the analytical requirements of UMRA do
not apply.

List of Subjects in 48 CFR Chapter 12

    Government procurement, Conflict of interest, Small business,
Labor, Copyright, Inventions and patents, Insurance, Surety bonds,
Accounting, Government property, Warranties, Transportation.

Signing Authority

    Date Approved: October 20, 2021.
Polly E. Trottenberg,
Deputy Secretary, Department of Transportation.
    For the reasons set out in the preamble, DOT proposes to revise 48
CFR chapter 12 to read as follows:

CHAPTER 12--DEPARTMENT OF TRANSPORTATION

SUBCHAPTER A--GENERAL
Sec.
1200 [RESERVED]
1201 Federal Acquisition Regulations System.
1202 Definitions of Words and Terms.
1203 Improper Business Practices and Personal Conflicts of Interest.
1204 Administrative and Information Matters.

SUBCHAPTER B--ACQUISITION PLANNING

1205 Publicizing Contract Actions.
1206 Competition Requirements.
1207 Acquisition Planning.
1209 Contractor Qualifications.
1211 Describing Agency Needs.
1212 Acquisition of Commercial Items.
SUBCHAPTER C--CONTRACTING METHODS AND CONTRACT TYPES
1213 Simplified Acquisition Procedures.
1214 [RESERVED]
1215 Contracting by Negotiation.
1216 Types of Contracts.
1217 Special Contracting Methods.
SUBCHAPTER D--SOCIOECONOMIC PROGRAMS
1219 Small Business Programs.
1222 Application of Labor Laws to Government Acquisitions.
1223 Environment, Energy and Water Efficiency, Renewable Energy
Technologies, Occupational Safety, and Drug-Free Workplace.
1224 Protection of Privacy and Freedom of Information.
SUBCHAPTER E--GENERAL CONTRACTING REQUIREMENTS
1227 Patents, Data, and Copyrights.
1228 Bonds and Insurance.
1231 Contract Cost Principles and Procedures.
1232 Contract Financing.
1233 Protests, Disputes, and Appeals.
SUBCHAPTER F--SPECIAL CATEGORIES OF CONTRACTING
1234 [RESERVED]
1235 Research and Development Contracting.
1236 Construction and Architect-Engineer Contracts.
1237 Service Contracting.
1239 Acquisition of Information Technology.
1241 [RESERVED]
SUBCHAPTER G--CONTRACT MANAGEMENT
1242 Contract Administration and Audit Services.
1245 [RESERVED]
1246 Quality Assurance.
1247 Transportation.
SUBCHAPTER H--CLAUSES AND FORMS
1252 Solicitation Provisions and Contract Clauses.
1253 Forms.
1254-1299 [RESERVED]

PART 1201--FEDERAL ACQUISITION REGULATIONS SYSTEM

Sec.
Subpart 1201.1--Purpose, Authority, Issuance
1201.101 Purpose.
1201.102-70 DOT statement of guiding principles for Department of
Transportation Acquisition System.
1201.104 Applicability.
1201.105 Issuance.
1201.105-1 Publication and code arrangement.
1201.105-2 Arrangement of regulations.
1201.105-3 Copies.
1201.106 OMB approval under the Paperwork Reduction Act.
Subpart 1201.2--Administration
1201.201 Maintenance of the FAR.
1201.201-1 The two councils.
Subpart 1201.3--Agency Acquisition Regulations
1201.301 Policy.
1201.301-70 Amendment of the Transportation Acquisition Regulation.
1201.301-71 Effective dates for Transportation Acquisition Circulars
or TAR Notices.
1201.301-72 Transportation Acquisition Circular numbering.
1201.304 Agency control and compliance procedures.
Subpart 1201.470--Deviations From the FAR and TAR
1201.403 Individual deviations.
1201.404 Class deviations.
Subpart 1201.6--Career Development, Contracting Authority, and
Responsibilities
1201.602 Contracting officers.
1201.602-2 Responsibilities.
1201.602-3 Ratification of unauthorized commitments.
1201.603 Selection, appointment, and termination of appointment of
contracting officers.
1201.603-1 General.
1201.604 Contracting Officer's Representative (COR).
1201.604-70 Contract clause.

    Authority:  5 U.S.C. 301; 41 U.S.C. 1121(c)(3); 41 U.S.C. 1702;
and 48 CFR 1.301-1.304.

Subpart 1201.1--Purpose, Authority, Issuance

1201.101  Purpose.

    The Department of Transportation (DOT), Transportation Acquisition
Regulation (TAR), establishes uniform acquisition policies and
procedures that implement and supplement the Federal Acquisition
Regulation (FAR). The TAR provides regulatory or policy instruction
when coverage is needed for DOT-specific subject matter not covered in
the FAR. The TAR also includes policy statements that DOT considers
important to both internal and external TAR audiences. The
Transportation Acquisition Manual (TAM) contains internal operating
procedures, providing supplementary guidance and instructions for
carrying out FAR and TAR requirements.

1201.102-70   DOT statement of guiding principles for the Department of
Transportation Acquisition System.

    (a) Vision. The TAR applies to all Department acquisitions unless
otherwise excluded by statute. DOT strives to make its acquisition
process effective, efficient, and transparent, and to embody fairness
and government-wide best practices.
    (b) Mission. The TAR is a key component of DOT's acquisition
process and is designed to provide clear and current regulatory and
policy oversight to supplement or support implementation of the FAR.
    (c) Role of the Office of the Senior Procurement Executive. The
Office of the Senior Procurement Executive (OSPE) applies leadership
and best-in-industry acquisition practices to establish acquisition
policies and procedures. The OSPE supports the DOT's mission by
providing timely, effective, and ethical business policies, practices,
products, innovative programs, strategies, and services.

1201.104   Applicability.

    (a) Applicable statutes, the FAR, Title 48, Chapter 1, and the TAR,
48 CFR, Chapter 12, apply to all acquisitions within the Department
unless otherwise specifically excluded by statute, the FAR, or the TAR.
    (b) The following order of precedence applies to resolve any
question of

applicability concerning an acquisition regulation or a procedure found
within the TAR, or the TAM which comprises the Department's internal
operating procedures and guidance--
    (1) U.S. Statutes;
    (2) The FAR;
    (3) The TAR;
    (4) DOT Orders; and
    (5) The TAM.
    (c) The Maritime Administration may depart from the requirements of
the FAR and TAR as authorized by 40 U.S.C. 113(e)(15), but shall adhere
to those regulations to the maximum extent practicable. Deviations from
the FAR or TAR requirements shall be documented according to Maritime
Administration procedures or in each contract file, as appropriate.
    (d) The FAR, TAR, and TAM do not apply to the Federal Aviation
Administration as provided by 49 U.S.C. 40110(d).
    (e) For purposes of the FAR, TAR, and TAM, the Office of the
Assistant Secretary for Research and Technology shall have the same
authority as an Operating Administration as defined in 1202.1, and the
Assistant Secretary for Research and Technology shall have the same
authority as a Head of the Operating Administration as defined in
1202.1.

1201.105   Issuance.

1201.105-1   Publication and code arrangement.

    (a) The TAR is published or available in--
    (1) The Federal Register;
    (2) Cumulative form in the CFR; and
    (3) Online via the internet at https://www.acquisition.gov/tar.
    (b) The TAR is issued as chapter 12 of Title 48 of the CFR.

1201.105-2   Arrangement of regulations.

    (a) General. The TAR, which encompasses both Department and
Operating Administration (OA)/Office of the Assistant Secretary for
Research and Technology (OST-R)-specific guidance (see subpart 1201.3),
conforms with the arrangement and numbering system prescribed by FAR
1.104. Guidance that is OA-specific contains the OA's acronym directly
after the heading.
    (b) Numbering--(1) Department-wide guidance. (i) The numbering
illustrations at FAR 1.105-2(b) apply to the TAR.
    (ii) Coverage within the TAR is identified by the prefix ``12''
followed by the complete TAR citation. For example, 1201.201-1(b).
    (iii) Coverage in the TAR that supplements the FAR will use part,
subpart, section and subsection numbers ending in ``70'' through ``89''
(e.g., 1201.301-70). A series of numbers beginning with ``70'' is used
for provisions and clauses.
    (iv) Coverage in the TAR, other than that identified with a ``70''
or higher number, that implements the FAR uses the identical number
sequence and caption of the FAR segment being implemented, which may be
to the paragraph level. Paragraph numbers and letters are not always
shown sequentially, but may be shown by the specific FAR paragraph
implemented. For example, TAR 1201.201-1 contains only paragraph (b)
because only this paragraph, correlated with the FAR, is implemented in
the TAR.
    (2) Operating Administration-unique guidance. Supplementary
material for which there is no counterpart in the FAR or TAR shall be
identified using chapter, part, subpart, section, or subsection numbers
of ``90'' and higher.
    (c) References and citations. The Department of Transportation
Acquisition Regulation may be referred to as the TAR. Cross reference
to the FAR in the TAR will be cited by ``FAR'' followed by the FAR
numbered citation, and cross reference to the TAM in the TAR will be
cited by ``TAM'' followed by the TAM numbered citations. References to
specific citations within the TAR will be referenced by the numbered
citation only, e.g., 1201.105-3.
    (3) Using the TAR coverage at 1201.105-2(b) as a typical
illustration, reference to the--
    (i) Part would be ``TAR part 1201'' outside the TAR and ``part
1201'' within the TAR.
    (ii) Subpart would be ``TAR subpart 1201.1'' outside the TAR and
``subpart 1201.1'' within the TAR.
    (iii) Section would be ``TAR 1201.105'' outside the TAR and
``1201.105'' within the TAR.
    (iv) Subsection would be ``TAR 1201.105-1'' outside the TAR and
``1201.105-1'' within the TAR.
    (v) Paragraph would be ``TAR 1201.105-1(b)'' outside the TAR and
``1201.105-1(b)'' within the TAR.

1201.105-3   Copies.

    (a) Copies of the TAR as published in Federal Register and as set
forth in the CFR may be purchased from the Government Publishing Office
(GPO), U.S. Government Online Bookstore on the internet at https://bookstore.gpo.gov/.
    (b) The TAR and Transportation Acquisition Circulars (TACs) are
available on the internet at https://www.acquisition.gov.

1201.106   OMB approval under the Paperwork Reduction Act.

    The information collection and recordkeeping requirements contained
in the TAR have been approved by the Office of Management and Budget
(OMB). Details concerning any TAR related OMB approved control numbers
are specified in the TAM.

Subpart 1201.2--Administration

1201.201   Maintenance of the FAR.

1201.201-1   The two councils.

    (b) The Senior Procurement Executive is responsible for providing a
DOT representative to the Civilian Agency Acquisition Council (CAAC).

Subpart 1201.3--Agency Acquisition Regulations

1201.301   Policy.

    (a)(1) Acquisition regulations. (i) Department-wide acquisition
regulations. The Department of Transportation's (DOT's) Senior
Procurement Executive (SPE) is the individual having authority to issue
or authorize the issuance of agency regulations that implement or
supplement the FAR to include agency-unique policies, procedures,
contract clauses, solicitation provisions, and forms that govern the
contracting process. This authority is re-delegated from the Assistant
Secretary for Administration to the SPE.
    (ii) Operating Administration (OA) acquisition regulations. OA
supplemental acquisition regulations proposed to be inserted in the TAR
as a TAR supplement regulation shall be reviewed and approved by the
SPE. If approved by the SPE, the Office of the Senior Executive will
prepare the rule for publication in the Federal Register in accordance
with FAR 1.501. OA regulations may be more restrictive or require
higher approval levels than those required by the TAR unless otherwise
specified.
    (2) Acquisition procedures. The SPE issues or authorizes the
issuance of internal agency guidance at any organizational level. DOT
internal operating procedures are contained in the TAM. OA procedures
necessary to implement or supplement the FAR, TAR, or TAM may be issued
by the head of the contracting activity (HCA), who may delegate this
authority to any organizational level deemed appropriate. OA procedures
may be more restrictive or require higher approval levels than those
permitted by the TAM unless otherwise specified.
    (b) The authority of the agency head under FAR 1.301(b) to
establish

procedures to ensure that agency acquisition regulations are published
for comment in the Federal Register in conformance with the procedures
in FAR subpart 1.5 is delegated to the Office of the General Counsel,
Assistant General Counsel for Regulation.

1201.301-70   Amendment of the Transportation Acquisition Regulation.

    (a) Changes to the TAR may be the result of recommendations from