5.1.4.1 Data Separation

The OPR shall require all members of the delivery team to identify areas of collaboration (what data is shared) or data separation (what data is not shared) in the BEP.

5.1.4.2 Security and Cybersecurity

The OPR shall direct the delivery team member(s) to follow the security plan provided by the owner. If no plan is provided the delivery team member(s) will provide a security plan. In both cases the delivery team member(s) shall document compliance with the security plan in the BEP.

5.1.4.3 Data Storage Requirements

The OPR shall include the physical location, governance, provenance, and lineage needs regarding the data for the project. If the owner is not providing these requirements the delivery team member(s) shall be required to include these items in their Security Plan.

5.1.4.4 Continuation of Operations and Disaster Recovery

The OPR shall require the Security Plan to include continuation of operations and disaster recovery plans.

5.1.4.5 Use of Security Standards

The OPR shall indicate if the owner has security standards and how they will be employed on the project.

5.1.4.6 Security Restrictions

The requirements shall indicate if any working restrictions will be employed on the project.

5.1.4.7 Confidential, Controlled Unclassified, or Sensitive Information

The OPR shall indicate if confidential, controlled unclassified, or sensitive information will be present on the project. If there is confidential, controlled unclassified, or sensitive information present on the project, the information and its classification status shall be identified by the requirements.