4.1901 Definitions
Source: FAR 4.1901 on acquisition.gov
FAR 4.1901 defines key terms that determine which contractor systems and information must be safeguarded under federal contracts.
Overview
FAR 4.1901 provides definitions for key terms used in Subpart 4.19, which addresses the basic safeguarding of covered contractor information systems. These definitions clarify what constitutes a covered contractor information system, federal contract information, information, information system, and safeguarding. Understanding these terms is essential for contractors to determine their obligations regarding the protection of sensitive government information processed, stored, or transmitted on their systems. The section ensures that all parties have a common understanding of the scope and requirements for safeguarding information in federal contracts.
Key Rules
- Covered Contractor Information System
- Defined as any contractor-owned or operated system that handles federal contract information.
- Federal Contract Information
- Refers to non-public information provided by or generated for the government under a contract, excluding publicly available or simple transactional data.
- Information and Information System
- Broadly defines information and the systems that manage it, referencing federal standards.
- Safeguarding
- Specifies that safeguarding involves prescribed measures to protect information systems.
Responsibilities
- Contracting Officers: Must ensure contractors understand and comply with safeguarding requirements based on these definitions.
- Contractors: Must identify if their systems and data fall under these definitions and implement required safeguards.
- Agencies: Oversee compliance and provide guidance on safeguarding requirements.
Practical Implications
- This section exists to establish a clear, shared vocabulary for safeguarding requirements in federal contracts.
- It impacts daily contracting by determining which systems and data require protection.
- Common pitfalls include misidentifying what constitutes federal contract information or a covered contractor information system, leading to compliance failures.
As used in this subpart–
Covered contractor information system means an information system that is owned or operated by a contractor that processes, stores, or transmits Federal contract information.
Federal contract information means information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, but not including information provided by the Government to the public (such as that on public Web sites) or simple transactional information, such as that necessary to process payments.
Information means any communication or representation of knowledge such as facts, data, or opinions in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual (Committee on National Security Systems Instruction (CNSSI) 4009).
Information system means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information (http://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3502&num=0&edition=prelim" target="_blank">44 U.S.C. 3502).
Safeguarding means measures or controls that are prescribed to protect information systems.