Attachment 10 - Document Security Form.pdf

Attachment B January 05, 2026

This document is the property of the U.S. Government. Further reproduction and/or distribution outside the Contractor Team is prohibited without the express written approval of the U.S. Federal Bureau of Investigation, Project Contracting officer, Washington, DC 20535

ATTACHMENT B

FBI DOCUMENT SECURITY REQUIREMENTS

1.1 DOCUMENT SECURITY REQUIREMENTS AND PROCEDURES

1.2 REQUEST FOR CONSTRUCTION DOCUMENTS CERTIFICATION

15F06726R0000045 Multi-Purpose Range Complex

This document is the property of the U.S. Government. Further reproduction and/or distribution outside the Contractor Team is prohibited without the express written approval of the U.S. Federal Bureau of Investigation, Project Contracting officer, Washington, DC 20535

January 05, 2026

1.0 REQUEST FOR FBI CONSTRUCTION DOCUMENTS

1.1 DOCUMENT SECURITY REQUIREMENTS AND PROCEDURES

This solicitation includes Sensitive but Unclassified FBI building information. For the purpose of this solicitation Sensitive but Unclassified Information should be treated as if it were Controlled Unclassified Information (CUI). FBI documents provided under this solicitation are intended for use only by authorized recipient and users, as defined in this Document. In support of this requirement, the FBI requires bidders/offerors to exercise the level of care mandated herein when handling such documents.

The FBI takes security very seriously. The protection of FBI employees and facilities is a major priority. In the wake of incidents such as the Alfred P. Murrah Federal Building bombing, it is an objective of the FBI to reduce the exposure of FBI Facilities to possible attacks or threats to FBI controlled space by diminishing the potential that sensitive information about FBI buildings, in paper or other forms, will be available for use by a person or persons with an interest in causing harm to persons or property. In line with that objective, this provision outlines the policies and procedures to be followed in conjunction with access to and handling of FBI Construction Documents. Failure to adhere to these procedures will result in that firm(s) forfeiting its right to a deposit refund for the documents. In addition, the firm may be precluded from participating in the current and/or future solicitations.

1. Dissemination Limited to Authorized Recipients and Users Only

Dissemination of FBI construction documents shall only occur after a determination is made that the recipient is a U.S. Citizen and authorized to receive it. The criterion to determine whether a potential recipient has a need is whether that recipient has a "need to know.” Typically, those with such a need to know are the persons/firms necessary to do work at the request of the FBI, such as architects, engineers, consultants, contractors, subcontractors, suppliers, and others that the contractor determines are necessary in order to submit an offer/bid or to complete the work or contract, such as maintenance and repair contractors and equipment service contractors.

NOTE: It is the responsibility of the General Contractor (GC) and any subcontractor or authorized firm disseminating construction documents or drawings to ensure that recipients have a valid "need to know" and have a current Non-Disclosure Agreement (NDA) on file. A document control log must be maintained for all issued project documents, whether electronic or hard copy. This log shall include the issuance and return dates, specific details about the documents checked out (including volume, copy number, and page count), the full legal name and signature of the individual receiving the documents, their associated company (GC or subcontractor), and a checkbox verifying the recipient has a valid NDA on record. The log must also contain the name and signature of the administrating official from the GC who issued the documents.

The document control log may be maintained electronically or in hard copy and must be provided to the Site Security Manager (SSM) upon request for audit or review. As individuals leave the project or no longer require access, the log must be updated to

This document is the property of the U.S. Government. Further reproduction and/or distribution outside the Contractor Team is prohibited without the express written approval of the U.S. Federal Bureau of Investigation, Project Contracting officer, Washington, DC 20535 reflect the return of all issued documents. The GC is responsible for verifying that all pages have been returned and accounted for. In the event any pages are missing, all efforts must be made to recover them. If recovery is not possible, the GC must submit a written statement detailing the loss and the corrective measures to be taken. A security infraction will be issued by the SSM to any individual responsible for the loss.

These requirements must be flowed down to all subcontractors, suppliers, and other document recipients involved in the project. Please reference the CSP for a complete listing of these requirement.

Valid Identification Required for Non-Government Recipients

An element of establishing a person/firm's status as an authorized recipient will entail providing valid identification prior to receiving FBI building documents and/or drawings.

This identification shall be presented and verified prior to any dissemination. Valid identification shall include, at minimum, items (A) through (D) below:

(A) A copy of a valid business license or other documentation granted by the state or local jurisdiction to conduct business. The license, at a minimum, shall provide the name, address, telephone number of the company, state of incorporation, or business establishment, and the name of the individual legally authorized to act on behalf of the company. The business must be of the type required to accomplish the work which is the subject of the solicitation. A general contractor's license may be substituted for the business license in states that Issue such licenses. In rare instances where a business license in not available from the jurisdiction, the information shall be provided and certified by the submitting party,

(B) Verification of a valid DUNS Number against the company listed on the business license. Such verification may be obtained by through http://www.fpdc.gov, or by calling Dun and Bradstreet at 703-807-5078 to set up an account.

(C) A valid IRS tax ID Number of the company requesting the information.

(D) Submission of a signed certification executed by the Chief Executive or other Corporate Officer on behalf of the requesting company or business enterprise. This executive/official shall be a U.S. Citizen and provide the following information: Social Security Number, Address, Date of Birth, and Place of Birth.

2. Retaining and Returning of FBI Construction Documents/ Digital Media:

The efforts required above shall continue throughout the entire term of the contract and for whatever specific time thereafter as may be necessary. Necessary record copies for legal purposes (such as those retained by the architect, engineer, or contractor) must be requested through FFD. All original documents/digital media issued by the FBI and no longer needed shall be returned to the FBI for proper destruction. Contractors who fail to return digital media & full hard copy shall forfeit their deposit. Destruction shall only be done by the FBI.

In accordance with the CSP, Hard copy documents no longer needed must be returned to the

This document is the property of the U.S. Government. Further reproduction and/or distribution outside the Contractor Team is prohibited without the express written approval of the U.S. Federal Bureau of Investigation, Project Contracting officer, Washington, DC 20535 government for destruction. Documents must be returned to the FBI personnel that released them. All project-related information must be permanently deleted beyond recoverability from all electronic and physical devices, including tablets, computers, memory cards for cameras, and cloud storage locations. The end-of-project definition can be finalized with the government project manager, contract officer, and security office. All other individual sheet reproductions created by the requesting company or business enterprise shall be destroyed by shredding or disintegrator by the contractor not later than 10 days after unsuccessful offer notification is made. A Contractor’s request for the return of its deposit must be accompanied by a written statement, on company letterhead, certifying that, to the best of your knowledge, neither your company, nor any subsequent recipients (subcontractors, suppliers, etc) have retained any copies of the Construction Documents and have destroyed these documents and digital media in accordance with the instructions set forth in this document and shall provide the FBI with the record dissemination logs

It is FBI Document Security Requirements and Procedures, that normal day-to-day operations for contractors who received FBI construction documents be conducted as follows: If transmitted or stored electronically, construction documents must be encrypted with an approved National Institute of Standards and Technology (NIST) algorithm, such as Advanced Encryption Standard (AES), in accordance with Federal Information Processing Standards Publication (FIPS PUB) 140-2, Security Requirements for Cryptographic Modules and stored on a secure web site portal with access controls. UNDER NO CIRCUMSTANCES SHALL THE

FBI CONSTRUCTION DOCUMENTS / DRAWINGS BE POSTED TO A WEBSITE, BLOG, FORUM,

FTP SITES, OR ANY OPEN AREA ON THE INTERNET.

It is the responsibility of the person or firm disseminating the information to assure that the recipient is an authorized user and to keep detailed records of recipients as set forth herein.

In addition to the above, contractors who possess digital media copies shall follow NIST Special Publications 800-88 Guidelines for Media Sanitization http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.PDF. Media sanitization is the process for removing data from storage media with reasonable assurance that the data cannot be retrieved and reconstructed. All of the residual magnetic, optical, or electrical representation of data that has been deleted from the media must not be easily recoverable.

3. Required Certification For Receipt of FBI Building Documents/Drawings By the Original Recipient.

Based on a significant number of reported instances of unauthorized disseminations from past FBI construction contracts involving information systems, the internet and reproductions equipment, the FBI has determined that it is necessary to institute measures designed to address this issue. Those measures require that original recipients of FBI building documents/drawings must provide the following documentation with in 5 calendar days after bid closing:

January 05, 2026

15F06726R0000045 Multi-Purpose Range Complex

KBCasey Sticky Note Accepted set by KBCasey

This document is the property of the U.S. Government. Further reproduction and/or distribution outside the Contractor Team is prohibited without the express written approval of the U.S. Federal Bureau of Investigation, Project Contracting officer, Washington, DC 20535

(A) Vendors shall acknowledge by self-certification that they are compliant with NIST 800 standards as well as by providing a written statement, on company letterhead, certifying that, to the best of their knowledge, neither the company, nor any subsequent recipients (subcontractors, suppliers, etc) utilized any information technology system, the internet, or reproduction equipment in conjunction with the documentation. Any "other companies" should be identified by name and address. In addition, shall provide the FBI with the record dissemination logs.

(B) The recipient acknowledges the requirement to use reasonable care, as outlined above, to safeguard the digital media and Hard Copies of documents and, if not awarded, the contract (and at the completion of any protest/appeal process) shall return the contract documents in good condition to the FBI.

(C) If an unauthorized disclosure occurred or occurs, the company shall provide a written statement, on company letterhead certifying that, the following actions has been taken in conjunction with that unauthorized disclosure using any information technology system or reproduction equipment:

1) The electronic media that contained the documentation/drawings has been destroyed or sanitized as set forth in #2 below;

2) In addition to the above, the contractor shall follow NIST Special Publications 800-88 Guidelines for Media Sanitization. Media sanitization is the process for removing data from storage media with reasonable assurance that the data cannot be retrieved and reconstructed. All of the residual magnetic, optical, or electrical representation of data that has been deleted from the media must not be easily recoverable.

Additionally, the company must be able to audit the electronic media. Specifically, the company must be able to generate a report that states that all of the electronic media have been "wiped". A print out must be available. A copy of this print out must be sent back to the FBI certifying that the sanitization process described herein has been followed.

3) The company or business enterprise shall provide the FBI with the record dissemination logs.

January 05, 2026

15F06726R0000045 Multi-Purpose Range Complex

KBCasey Sticky Note Accepted set by KBCasey

KBCasey

This document is the property of the U.S. Government. Further reproduction and/or distribution outside the Contractor Team is prohibited without the express written approval of the U.S. Federal Bureau of Investigation, Project Contracting officer, Washington, DC 20535

1.2 REQUEST FOR CONSTRUCTION DOCUMENTS CERTIFICATION

SOLICITATION NUMBER: 15F06726R0000045

DOCUMENT SECURITY

NOTICE TO PROSPECTIVE BIDDERS/OFFERORS

This solicitation includes Sensitive But Unclassified (FBI) building information. FBI documents provided under this solicitation are intended for use by authorized recipients and users only. In support of this requirement, FBI requires bidders/offerors to exercise reasonable care when handling documents relating to FBI building information per the solicitation.

1. Limiting Dissemination to authorized users: Dissemination of information shall only be made upon determination that the recipient is authorized to receive it and a U.S. citizen.

The criterion to determine authorization is need-to-know. Those with a need-to-know are those who are specifically granted access for the conduct of business on behalf of or with the FBI. This includes all persons or firms necessary to do work at the request of the Government, such as architects and engineers, consultants, contractors, sub-contractors, suppliers, and others that the contractor deems necessary in order to submit an offer/bid or to complete the work or contract, as well as maintenance and repair contractors and equipment service contractors.

Note: It is the responsibility of the person or firm disseminating the information to assure that the recipient is an authorized user and to keep detailed records of recipients.

Authorized users shall provide identification as set forth below:

Valid identification for non-Government users: Authorized non-Government users shall provide valid identification to receive FBI building information. The identification shall be presented and verified for each dissemination. Valid identification shall be all items (a) through (d).

(a) A copy of a valid business license or other documentation granted by the state or local jurisdiction to conduct business. The license at a minimum shall provide the name, address, phone number of the company, state of incorporation, or business establishment, and the name of the individual legally authorized to act for the company. The business must be of the type required to do the work. A general contractor’s license may be substituted for the business license in states that issue such licenses. In the rare cases where a business license is not available from the jurisdiction, the information shall be provided and testified to the submitter; and

This document is the property of the U.S. Government. Further reproduction and/or distribution outside the Contractor Team is prohibited without the express written approval of the U.S. Federal Bureau of Investigation, Project Contracting officer, Washington, DC 20535

(b) Verification of a valid DUNS Number against the company listed on the business license or certification. Verification may be obtained through http://www.fpdc.gov, or by calling Dun & Bradstreet at 703-807-5078 to set up an account; and

(c) A valid IRS Tax ID Number of the company requesting the information; and

(d) This certification executed by the Chief Executive or other Corporate Officer on behalf of the requesting company or business enterprise. This executive/official shall be a U.S. Citizen and provide the following information: Social Security Number, Address, Date of Birth, and Place of Birth.

2. Retaining and returning Construction Documents/Digital Media: The efforts required above shall continue throughout the entire term of the contract and for whatever specific time thereafter as may be necessary. Necessary record copies for legal purposes must be requested through the FBI. All original Documents/Digital Media issued by the FBI and no longer needed shall be returned to the FBI for proper destruction. Contractors who fail to return Digital Media & Full Hard Copy shall forfeit their deposit. Destruction shall only be done by the FBI. All other individual sheet reproductions created by the requesting company or business enterprise when no longer required shall be destroyed by shredding or disintegration by the contractor.

It is FBI Document Security Requirements and Procedures, that normal day-to-day operations of contractors who receive FBI construction documents be conducted on an authorized Automated Information System (AIS), as referred to in American National Standard T1.523-2001 which has the proper level of security control to provide nonrepudiation; authentication; and encryption to ensure confidentiality and integrity of the information. Under no circumstances shall the FBI construction documents/drawings be posted to a website, blog, forum, FTP sites, or any open area on the internet.

In addition to the above, contractors who possess Digital Media copies shall follow NIST Special Publications 800-88 Guidelines for Media Sanitization http://csrc.nist.gov/publications/nistpubs/800-88/NISTSP800-88_rev1.PDF. Media sanitization is the process for removing data from storage media with reasonable assurance that the data cannot be retrieved and reconstructed. All of the residual magnetic, optical, or electrical representation of data that has been deleted from the media must not be easily recoverable.

3. Written agreement for return of documents: The recipient acknowledges the requirement to use reasonable care, as outlined above, to safeguard the Digital Media and Hard Copies of documents and, if not awarded, the contract(and at the completion of any protest/appeal process) shall return the contract documents in good condition to the FBI.

January 05, 2026

15F06726R0000045 Multi-Purpose Range Complex http://www.fpdc.gov/ KBCasey

15F06726R0000045 Multi-Purpose Range Complex 8 of 8

This document is the property of the U.S. Government. Further reproduction and/or distribution outside the Contractor Team is prohibited without the express written approval of the U.S. Federal Bureau of Investigation, Project Contracting officer, Washington, DC 20535

SOLICITATION NUMBER: RFP 15F06726R0000045

DOCUMENT SECURITY CERTIFICATION

I the recipient, acknowledge the requirement and shall use reasonable care as outlined in the Request for Construction Document Certification to safeguard the Digital Media and Hard Copies of the documents and, if not awarded, the contract (and at the completion of any protest/appeal process) shall return the contract documents in good conditions to the FBI.

I agree that I will abide by this agreement and all paragraphs above and will only disseminate Sensitive But Unclassified (FBI) building information to other authorized users under the conditions set forth above.

Any person or firm failing to adhere to the above shall forfeit its right to a deposit refund for documents and may be precluded from bidding on the current or future solicitations.

Signature:________________________________

Title:____________________________________

Date:_____________________________________

Address:__________________________________

SSN:______________________________________

DOB:______________________________________

POB:______________________________________

Copy of business license attached

UEI Number:______________________________

Verified: Yes NO

IRS Tax ID Number:________________________