04_DD254_30_Sep_2015.pdf

FA8811-15-R-0001 DD Form 254

Appendix A

(8) Actual Performance – Additional

(a) Location (b) Cage Code (c) Cognizant Security Office

CONTINUATION – DD FORM 254

Contract # FA8811-15-R-0001

(10a.) Communications Security (COMSEC) lnformation

The contractor shall forward requests for COMSEC material/information to the COMSEC officer through the EELV Program Security Manager (SMC/LRE). COMSEC material/information shall not be released to DoD contractors without Air Force Cryptological Support Center (AFCSC) approval. The contractor is governed by the NSA Industrial COMSEC Manual, NSA Central Security Service (CSS) Policy Manual No. 3-16, dated 5 Aug 2005, or as applicable, AFI 33- 210, Vol ll, lll, and IX for the control and protection of COMSEC material/information. Access to COMSEC material by personnel is restricted to U.S. citizens holding final U.S. Government clearances. Such information is not releasable to personnel holding only reciprocal clearances.

(10j) For Official Use Only (FOUO)

Controlled Unclassified Information (CUI) is now the term which collectively refers to FOUO and Unclassified Controlled Nuclear Information (UCNI). CUI information provided under this contract shall be managed and safeguarded in accordance with DoDM 5200.01, Volume 4, Controlled Unclassified Information (CUI).

(10k) Security of Unclassified DoD Information on Non-DoD Information Systems

The Contractor must comply with the information safeguards as specified in DoDI 8582.01, Security of Unclassified DOD Information on Non-DOD Information Systems, DoD Commercial Mobile Device (CMD) Interim Policy dated 17 Jan 2012, Use of Commercial Mobile Devices Not Connected to Department of Defense Networks dated 31 Jul 2012, and Air Force (AF) Guidance memorandum to AF Manual 33-282 dated 4 April 2013. The aforementioned policies apply to Government issued, Contractor provided, or personal devices. The Contractor shall immediately notify the EELV Program Security Manager (SMC/LRE) of any instance of a network security breach involving the unauthorized access of DoD information.

Non-enterprise activated CMD is defined as any mobile handheld device that is not connected to any DoD network (wired or wireless) or to a PC that is/will be connected to a DoD network.

The devices can be used for any non-sensitive unclassified DoD tasks and process/store publically released information. Non-enterprise activated commercial mobile devices, regardless of ownership, are prohibited from storing and/or processing classified information, Personally Identifiable Information (PII), Health Insurance Portability and Accountability Act (HIPAA) information, Controlled Unclassified Information (CUI), For Official Use Only (FOUO) and DoD sensitive information.

Definitions:

Non-Sensitive Information -- Information available in the public domain or DoD information that has been approved for public release

Sensitive Information -- Information, the loss, misuse, or unauthorized access to or modification of, could adversely affect the national interest or the conduct of Federal programs, or the privacy to which individuals are entitled under Section 552a of title 5, United States Code, "The Privacy Act" but which has not been specifically authorized under criteria established by Executive order or an Act of Congress to be kept secret in the interest of national defense or foreign policy.

(Section 278g-3 of title 15, United States Code, “The Computer Security Act of 1987").

(11j) Operation Security (OPSEC)

The contractor shall comply with the EELV OPSEC Plan while on military/government installations and implement an OPSEC program in accordance with the EELV OPSEC Plan.

The contractor shall develop and implement government approved OPSEC guidance to protect critical information as identified in the EELV OPSEC Plan, if not on government installation.

OPSEC shall be part of the ongoing security awareness program conducted in accordance with Chapter 3, Section 1, of the National Industrial Security Program Operating Manual (NISPOM).

The contractor shall protect sensitive unclassified information and activities, which could compromise classified information or operations, or degrade the planning and execution of military operations performed by the contractor in support of the mission. Sensitive unclassified information is that Information marked FOUO, PA, COMPANY PROPRIETARY.

Disposition of Critical Information, FOUO, and PA obtained or produced pursuant to this contract shall be shredded/degaussed to prevent reconstruction.

Email transmission of Critical Information, FOUO, and PA obtained or produced pursuant to this contract shall be encrypted or password protected. In addition, email containing FOUO and PA shall be marked in the subject line. FOUO shall also be included at the beginning and end of the email.

(11k) Be Authorized To Use the Defense Courier Service:

Contractor is authorized to use the Defense Courier Service.

(11l) Visitor Group Security Agreement (VGSA):

For activities at the Air Force installations identified in ITEM 8, the Contractor may be required by the host agency to enter into a VGSA in accordance with Air Force Instruction 31-601, Industrial Security. The VGSA is executed with the Contractor who requires or will have access to classified information or to sensitive unclassified information. The VGSA must address those security requirements and/or procedures that are unique to the installation for which the contractor shall be held contractually liable. VGSAs need only address those areas of security, safeguarding and/or protection that have not been covered elsewhere within the contract, DD Form 254, Statement of Work, Statement of Objectives, Performance-based Work Statement, etc.

(13) Program Protection

The contractor shall protect critical program information (CPI) in compliance with the Program Protection Plan (PPP) and mission critical components. The contractor shall develop a Program Protection Implementation Plan (PPIP), to be approved by the program office that describes the protection measures being implemented by the contractor and sub-contractors for protecting CPI and mission critical components. The prime contractor shall flow-down to any subcontractor protection requirements for implementation as described in the PPIP in compliance with PPP.

The government program office shall conduct Program Protection Surveys at contractor’s locations to assess the effectiveness of the established PPIP.

Additionally, classified national security information, special access and unclassified controlled information as prescribed in applicable Security Classification Guides (SCGs) shall be protected as outlined in the NISPOM.

Personnel Security

Contractor and subcontractor personnel have or may need access to Launch Site Restricted or Controlled areas containing EELV Space Launch Systems and/or Information Systems which directly affect a Launch System. As described in the prime contract, the contractor will have subcontracts with its parent company, who will perform the work.

For purposes of this requirement, any reference to “Contractor” shall include employees of both Contractor and its parent company.

All contractor personnel performing on this contract and permanently assigned to launch site operations must be a U.S. Person and must be in process for, or possess a favorable National Agency Check Inquiry (NAC-I), an equivalent clearance approval as indicated in the Air Force Space Command Supplement to Air Force Instruction (AFI) 31-101, paragraph 7.2.1.1, or higher government security clearance, in accordance with AFI 31-501 or the NISPOM.

Contractor personnel who are visiting or on a temporary duty assignment at launch site operations and who require access to Launch Site Restricted or Controlled areas containing EELV Space Launch Systems or Information Systems which directly affect a Launch System shall be escorted by authorized personnel, unless the visitor or temporarily assigned individual is a U.S. Person and is in process for or possesses a favorable NAC-I, an equivalent clearance approval, or higher government security clearance.

All subcontractor personnel who require access to Launch Site Restricted or Controlled areas containing EELV Space Launch Systems or Information Systems which directly affect a Launch System shall be escorted by authorized personnel, unless such subcontractor personnel are US Citizens, in process for or possess a favorable NAC-I, an equivalent clearance approval, or higher government security clearance.

International Affairs

The contractor and its subcontractors shall adhere to the current version of the U.S. State Department, International Traffic in Arms Regulations (ITAR), 22 CFR 120 et seq. as relating to export and munitions list controlled items, laws and regulations. Whenever the exchange of unclassified information with a foreign subcontractor or foreign government is required, the information shall be regulated by the ITAR. Visits by a Foreign Person and/or U.S. Person acting as a Representative of a Foreign Interest to facilities and/or locations regulated by the ITAR and/or NISPOM, DoD 5220.22-M, shall comply with applicable visit notifications, information access and escorting requirements. The exchange of classified Foreign Government Information is not permitted by this contract, ref. 10.h. of this specification.