DID FinderBack
Source
DI-MGMT-82383

Information Management and Control Plan (IMCP) for Department of Defense (DoD) Assessments

This DID defines the format and content requirements for the Information Management and Control Plan and Supplier Compliance Supplement that DoD contractors use to control CUI flow within the supply chain.

Approval DateMay 4, 2022
AMSC Number10314
Preparing ActivityMDA
Project NumberMGMT-2021-013
OPR—
DTIC ApplicableNo
GIDEP ApplicableNo
Limitation—
Applicable FormsNone
Approval Limitation—
Form Version—
DID Formatfree_text
963C CompliantYes
DISTRIBUTION STATEMENT A: Approved for public release; distribution is unlimited.
Supersedes
—
Related
—

Description & Purpose

—

Application & Interrelationship

—

Use & Relationship

This Data Item Description (DID) supports the Information Management and Control Plan (IMCP) related to Department of Defense (DoD) Assessments. The IMCP for DoD Assessments complies with DFARS 252.204-7012, 252.204-7019, 252.204-7020, and the 110 National Institute of Science and Technology (NIST) Special Publication (SP) 800-171 Rev.2 security requirements. This DID is separate and distinct from the IMCP for Cybersecurity Maturity Model Certification (CMMC) Assessments.

The IMCP for DoD Assessments requires the Prime Contractor to develop a plan for controlling the flow of Controlled Unclassified Information (CUI) within the supply chain. An acceptable IMCP for DoD Assessments is required for contract award. The Prime Contractor shall flow the IMCP for DoD Assessments to their 1st tier Subcontractors and require that this plan be flowed down to all tiers of the supply chain that utilize CUI. Contract Prime and Subcontractors handling CUI are required to develop an IMCP but only the Prime is required to submit their IMCP to the Government. The IMCP requires the Prime and Subcontractors to submit a Supplier Compliance Supplement directly to the Government Procuring Contracting Officer. It also requires the Contractors to submit their System Security Plan (SSP) and Plan of Action and Milestones (POA&M) to the Agency when/if required.

This DID contains the format and content preparation instructions for the data product generated by the specific task requirement included in the contract.

Preparation Instructions

1Reference Documents.None
2Format.The IMCP for DoD Assessments consists of two parts: (1) the IMCP and (2) the Supplier Compliance Supplement. The IMCP describes how the contractor will protect CUI in the supply chain. The Supplier Compliance Supplement is used to illuminate the supply chain by identifying subcontractors at all tiers that develop, transmit, use, or store CUI. It also provides a high-level understanding of how the CUI is protected within the supply chain. The Supplier Compliance Supplement is required to be followed down to all subcontractors at all tiers that develop, transmit, or store CUI. The IMCP data shall be in electronic MS Word format in accordance with the IMCP Template and its instructions for use (see Table 1). The IMCP Supplier Compliance Supplement data shall be submitted using the MS Excel template and in accordance with the Supplier Compliance Supplement instructions for use (see Table 2). Submitted electronic media shall comply with and be readable by approved Government systems.
3Content.

References

Use the Supplier Compliance Supplement (MS Excel) Template located at link below to complete the Supplier Compliance Supplement requirement. https://www.mda.mil/global/documents/pdf/IMCP_Supplier_Compliance_Supplement.pdf

Figures

Figure Table 1: IMCP Template

Figure Table 1. IMCP Template

Figure Table 1: IMCP Template (continued)

Figure Table 1. IMCP Template (continued)

Figure Table 2: IMCP Supplier Compliance Supplement Template

Figure Table 2. IMCP Supplier Compliance Supplement Template

Figure Table 2: IMCP Supplier Compliance Supplement Template (continued)

Figure Table 2. IMCP Supplier Compliance Supplement Template (continued)

Figure Table 2: IMCP Supplier Compliance Supplement Template (continued)

Figure Table 2. IMCP Supplier Compliance Supplement Template (continued)

Schema v3.0Community-maintained · Verify against ASSIST
Community-maintained — not an official government database.
Verify against ASSIST·GitHub·About·Disclaimer