(a) DHS's policies and procedures on contractor personnel security requirements are set forth in various management directives (MDs), Directives, and Instructions. MD 11042.1, Safeguarding Sensitive But Unclassified (For Official Use Only) Information describes how contractors must handle sensitive but unclassified information. The DHS Sensitive Systems Policy Directive 4300A and the DHS 4300A Sensitive Systems Handbook, provide the policies and procedures on security for Information Technology resources. Compliance with these policies and procedures, as amended, is required.

(b) The contractor must not use or redistribute any DHS information processed, stored, or transmitted by the contractor except as specified in the contract.