[Code of Federal Regulations]
[Title 48, Volume 5]
[Revised as of October 1, 2007]
From the U.S. Government Printing Office via GPO Access
[CITE: 48CFR952.204-76]

[Page 384-386]
 
            TITLE 48--FEDERAL ACQUISITION REGULATIONS SYSTEM
 
                     CHAPTER 9--DEPARTMENT OF ENERGY
 
Sec. 952.204-76  Conditional payment of fee or profit--safeguarding 
          restricted data and other classified information.

    As prescribed at 48 CFR (DEAR) 904.404(d)(6), insert the following 
clause.

 Conditional Payment of Fee or Profit--Safeguarding Restricted Data and 
                 Other Classified Information (JAN 2004)

    (a) General. (1) The payment of fee or profit (i.e., award fee, 
fixed fee, and incentive fee

[[Page 385]]

or profit) under this contract is dependent upon the contractor's 
compliance with the terms and conditions of this contract relating to 
the safeguarding of Restricted Data and other classified information 
(i.e., Formerly Restricted Data and National Security Information) 
including compliance with applicable law, regulation, and DOE 
directives. The term ``contractor'' as used in this clause to address 
failure to comply shall mean ``contractor or contractor employee.''
    (2) In addition to other remedies available to the Government, if 
the contractor fails to comply with the terms and conditions of this 
contract relating to the safeguarding of Restricted Data and other 
classified information, the contracting officer may unilaterally reduce 
the amount of fee or profit that is otherwise payable to the contractor 
in accordance with the terms and conditions of this clause.
    (3) Any reduction in the amount of fee or profit earned by the 
contractor will be determined by the severity of the contractor's 
failure to comply with contract terms and conditions relating to the 
safeguarding of Restricted data or other classified information pursuant 
to the degrees specified in paragraph (c) of this clause.
    (b) Reduction Amount. (1) If in any period (see 48 CFR 952.204-76 
(b)(2)) it is found that the contractor has failed to comply with 
contract terms and conditions relating to the safeguarding of Restricted 
Data or other classified information, the contractor's fee or profit of 
the period may be reduced. Such reduction shall not be less than 26 
percent nor greater than 100 percent of the total fee or profit earned 
for a first degree performance failure, not less than 11 percent nor 
greater than 25 percent for a second degree performance failure, and up 
to 10 percent for a third degree performance failure. The contracting 
officer must consider mitigating factors that may warrant a reduction 
below the specified range (see 48 CFR 904.402(c)). The mitigating 
factors include, but are not limited to, the following:
    (i) Degree of control the contractor had over the event or incident.
    (ii) Efforts the contractor had made to anticipate and mitigate the 
possibility of the event in advance.
    (iii) Contractor self-identification and response to the event to 
mitigate impacts and recurrence.
    (iv) General status (trend and absolute performance) of safeguarding 
Restricted Data and other classified information and compliance in 
related security areas.
    (2)(i) Except in the case of performance-based firm-fixed-price 
contracts (see paragraph (b)(3) of this clause), the contracting 
officer, for purposes of this clause, will at the time of contract 
award, or as soon as practicable thereafter, allocate the total amount 
of fee or profit that is available under this contract to equal periods 
of [insert 6 or 12] months to run sequentially for the entire term of 
the contract (i.e., from the effective date of the contract to the 
expiration date of the contract, including all options). The amount of 
fee or profit to be allocated to each period shall be equal to the 
average monthly fee or profit that is available or otherwise payable 
during the entire term of the contract, multiplied by the number of 
months established above for each period.
    (ii) Under this clause, the total amount of fee or profit that is 
subject to reduction in a period in which a performance failure occurs, 
in combination with any reduction made under any other clause in the 
contract that provides for a reduction to the fee or profit, shall not 
exceed the amount of fee or profit that is earned by the contractor in 
the period established pursuant to paragraph (b)(2)(i) of this clause.
    (3) For performance-based firm-fixed-price contracts, the 
contracting officer will at the time of contract award include negative 
monetary incentives in the contract for contractor violations relating 
to the safeguarding of Restricted Data and other classified information.
    (c) Safeguarding Restricted Data and Other Classified Information. 
Performance failures occur if the contractor does not comply with the 
terms and conditions of this contract relating to the safeguarding of 
Restricted Data and other classified information. The degrees of 
performance failures relating to the contractor's obligations under this 
contract for safeguarding of Restricted Data and other classified 
information are as follows:
    (1) First Degree: Performance failures that have been determined, in 
accordance with applicable law, regulation, or DOE directive, to have 
resulted in, or that can reasonably be expected to result in, 
exceptionally grave damage to the national security. The following are 
examples of performance failures or performance failures of similar 
import that will be considered first degree:
    (i) Non-compliance with applicable laws, regulations, and DOE 
directives actually resulting in, or creating a risk of, loss, 
compromise, or unauthorized disclosure of Top Secret Restricted Data or 
other information classified as Top Secret, any classification level of 
information in a Special Access Program (SAP), information identified as 
sensitive compartmented information (SCI), or high risk nuclear weapons-
related data.
    (ii) Contractor actions that result in a breakdown of the safeguards 
and security management system that can reasonably be expected to result 
in the loss, compromise, or unauthorized disclosure of Top Secret 
Restricted Data, or other information classified as Top Secret, any 
classification level of information in a SAP, information identified as 
SCI, or high risk nuclear weapons-related data.

[[Page 386]]

    (iii) Failure to promptly report the loss, compromise, or 
unauthorized disclosure of Top Secret Restricted Data or other 
information classified as Top Secret, any classification level of 
information in a SAP, information identified as SCI, or high risk 
nuclear weapons-related data.
    (iv) Failure to timely implement corrective actions stemming from 
the loss, compromise, or unauthorized disclosure of Top Secret 
Restricted Data or other information classified as Top Secret, any 
classification level of information in a SAP, information identified as 
SCI, or high risk nuclear weapons-related data.
    (2) Second Degree: Performance failures that have been determined, 
in accordance with applicable law, regulation, or DOE directive, to have 
actually resulted in, or that can reasonably be expected to result in, 
serious damage to the national security. The following are examples of 
performance failures or performance failures of similar import that will 
be considered second degree:
    (i) Non-compliance with applicable laws, regulations, and DOE 
directives actually resulting in, or creating risk of, loss, compromise, 
or unauthorized disclosure of Secret Restricted Data or other 
information classified as Secret.
    (ii) Contractor actions that result in a breakdown of the safeguards 
and security management system that can reasonably be expected to result 
in the loss, compromise, or unauthorized disclosure of Sceret Restricted 
Data, or other information classified as Secret.
    (iii) Failure to promptly report the loss, compromise, or 
unauthorized disclosure of Restricted Data or other information 
regardless of classification (except for information covered by 
paragraph (c)(1)(iii) of this clause).
    (iv) Failure to timely implement corrective actions stemming from 
the loss, compromise, or unauthorized disclosure of Secret Restricted 
Data or other information classified as Secret.
    (3) Third Degree: Performance failures that have been determined, in 
accordance with applicable law, regulation, or DOE directive, to have 
actually resulted in, or that can reasonably be expected to result in, 
undue risk to the common defense and security. In addition, this 
category includes performance failures that result from a lack of 
contractor management and/or employee attention to the proper 
safeguarding of Restricted Data and other classified information. These 
performance failures may be indicators of future, more severe 
performance failures and/or conditions, and if identified and corrected 
early would prevent serious incidents. The following are examples of 
performance failures or performance failures of similar import that will 
be considered third degree:
    (i) Non-compliance with applicable laws, regulations, and DOE 
directives actually resulting in, or creating risk of, loss, compromise, 
or unauthorized disclosure of Restricted Data or other information 
classified as Confidential.
    (ii) Failure to promptly report alleged or suspected violations of 
laws, regulations, or directives pertaining to the safeguarding of 
Restricted Data or other classified information.
    (iii) Failure to identify or timely execute corrective actions to 
mitigate or eliminate identified vulnerabilities and reduce residual 
risk relating to the protection of Restricted Data or other classified 
information in accordance with the contractor's Safeguards and Security 
Plan or other security plan, as applicable.
    (iv) Contractor actions that result in performance failures which 
unto themselves pose minor risk, but when viewed in the aggregate 
indicate degradation in the integrity of the contractor's safeguards and 
security management system relating to the protection of Restricted Data 
and other classified information.

                             (End of clause)

[68 FR 68777, Dec. 10, 2003]