(d)(1) The Contracting Officer shall insert the clause in 352.239-70, Standard for Security Configurations, in solicitations, contracts, and orders that involve the operation or acquisition of an information technology system (for definition of the latter term, see http://www.hhs.gov/ocio/policy. )
An HHS information security policy waiver, the template for which is available at: http://intranet.hhs.gov/infosec/policies_memos.html , must be approved in order to deviate from HHS OCIO Standard 2009-0001.001S, HHS Standard for Security Configurations Language in HHS Contracts, dated January 30, 2009. A copy of the approved waiver shall be forwarded to the Contracting Officer who, in turn, shall request a comparable deviation for the clause in 352.239-70.
(2) The Contracting Officer shall insert the clause in 352.239-71, Standard for Encryption Language, in solicitations, contracts, and orders that involve the acquisition or lease of, or the requirement to use, desktop or laptop computers, mobile devices, or portable media to store or process HHS sensitive information that the Project Officer categorizes as moderate or high under Federal Information Processing Standard (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems, dated February 2004. An HHS information security policy waiver, the template for which is available at: http://intranet.hhs.gov/infosec/policies_memos.html , must be approved in order to deviate from HHS OCIO Standard 2009-0002.001S, HHS Standard for Encryption Language in HHS Contracts, dated January 30, 2009. A copy of the approved waiver shall be forwarded to the Contracting Officer who, in turn, shall request a comparable deviation for the clause in 352.239-71.
