Attachment D- Security Information.pdf

Attachment D

8.0 Security Requirements

The contractor shall include the substance of the following provisions in all cleared subcontracts, and those applying to unclassified and SBU protection in all uncleared subcontracts.

8.1 Country Clearance for Travel to Post/Site

An electronic Country Clearance (eCC) request must be sent to post for all contractor personnel traveling there, cleared or not. Contractors should forward personnel deployment itinerary to the Contracting Officer's Representative (COR) or their designee, at least 14 days in advance of travel. For both cleared and uncleared personnel, the following information must be provided to the COR: full name, date and place of birth, passport number and expiration date, name of employer, position/discipline, clearance level (indicate NONE if person is uncleared), date of arrival and expected departure. When possible, the COR will provide a copy of the post eCC approval response and the country travel information from the eCC website to the contractor. Please submit 2 clearly indicated personnel substitutes for consideration should any of your personnel be rejected.

8.2 Assignment of Non-U.S. Citizens

American prime contractors and American subcontractors that desire to assign non-U S. citizens to any portion of this contract in the United States must obtain the prior approval of the Bureau of Diplomatic Security, DS/IS/IND, in writing.

Contractor must provide non-U.S. citizen personal information to include full name, date and place of birth, country of citizenship, country where passport is issued, passport number, date of issue and expiration and description of services to be provided. In addition, for non-U.S. citizens which the prime contractor wishes to assign to work at posts/sites overseas, they must coordinate access approval/investigation as directed in writing by Regional Security Officer (RSO).

8.3 Security Classification Guide

All documents, such as blueprints, drawings, sketches, notes, surveys, reports, photographs, exposed film, negatives, specifications, scopes of work, lists of Government Furnished Equipment and any other material received or generated in conjunction with this contract, shall be classified, marked and handled in accordance with the Security Classification

Guide (SCG) for Design and Construction of Overseas Facilities dated May 21 , 2003, which identifies the specific types of information associated with diplomatic construction projects, and the level of classification for such information.

8.4 Protection of Classified Information

The contractor and all subcontractors must comply with all Department of State (DOS) and Department of Defense

(DOD) requirements relating to the protection of classified and Sensitive But Unclassified (SBU) information and cooperate fully in all security matters that may arise relating to this contract.

The loss, compromise, or suspected compromise or loss of any classified information (documents, notes, drawings, sketches, surveys, reports, exposed film, negatives, or photographs) or ANY information which may adversely affect the security interests of the United States, must be immediately brought to the attention of the Contracting Officer (CO) or

Contracting Officer's Representative (COR) and DS/IS/IND.

8.5 Disposition and Retention of Contract Information

All SBU material, including copies and reproductions stored on Information Systems and SBU electronic media, received or generated in the performance of this contract shall be returned to the CO upon completion of the contract unless the material has been destroyed or retention of the material is authorized in accordance with the National

Industrial Security Program Operating Manual (NISPOM). SBU material shall be returned or destroyed within 120 days after final delivery of project drawings and specifications and any other services; or 120 days after completion or termination of the contract.

8.6 Photographs

Photographs of any diplomatic overseas building or facility must be authorized in advance by the DOS Regional Security

Officer (RSO), or DOS COR, who will establish any controls, limits, and/or restrictions as necessary. Exposed film depicting any Controlled Access Area and/or sensitive equipment must be developed in a U .S.-controlled environment.

The contractor shall submit all CAA photographs taken by digital cameras and stored on electronic media to the RSO or

COR for review. Written approval for removal from the site must be obtained by the Government reviewer. Any photographs or storage media (memory cards) determined to be classified shall be turned over to the RSO/SSM to forward via classified Diplomatic Pouch. No further dissemination, publication, duplication, or other use beyond that which was requested and approved is authorized without specific, advance approval from DS. DS reserves the right to demand retention of all copies of said photographs and/or negatives, following fulfillment of the previously authorized usage.

8.7 Safeguarding Information

The Contractor and its employees shall exercise the utmost discretion in regard to all matters relating to their duties and functions. They shall not communicate to any person any information known to them by reason of their performance of services under this contract which has not been made public, except in the necessary performance of their duties or upon written authorization of the Contracting Officer. All documents and records (including photographs) generated during the performance of work under this contract shall be for the sole use of and become the exclusive property of the U.S.

Government. Furthermore, no article, book, pamphlet, recording, broadcast, speech, television appearance, film or photograph concerning any aspect of work performed under this contract shall be published or disseminated through any media without the prior written authorization of the Contracting Officer. These obligations do not cease upon the expiration or termination of this contract. The Contractor shall include the substance of this provision in all contracts of employment and in all subcontracts hereunder.

8.8 Public Release of Information

There shall be no release of information or photographs, to include on company websites, concerning any aspect of the design, construction, or other services relating to this contract, or other documents resulting there from, without the written prior approval of the Contracting Officer.

8.9 Transmission Requirements for SBU

Transmission of Sensitive But Unclassified (SBU) information via the Internet is prohibited, in accordance with the

Security Classification Guide (SCG) for Design and Construction of Facilities Overseas, dated May 21, 2003. SBU information can be transmitted via ProjNet, mail, GSA Schedule 48 commercial carriers or fax, as outlined in the SCG, or hand-carried by authorized contractor personnel.

When it is deemed necessary to take personal or contractor-owned laptops, Personal Digital Assistants (PDAs), smart phones (such as BlackBerrys), cell phones, digital cameras or any other electronic processing media outside a cleared facility, or overseas, to process or store any DOS project information (on or off the site), the following guidelines must be adhered to:

The device must have its hard drive encrypted using any product on the IT CCB list, or any NIST approved product.

(MST approved products can be found at http://csrc.nist.gov/groups/STM/cmvp/validation.html) An overwrite utility software must be used to remove all previous data in the following manner: A first overwrite pass using the number 'I ';

A second overwrite pass using the number '0'; and a third overwrite pass using ANY character. Transmission/storage of classified information on laptops, PDAs, smart phones or digital cameras is not authorized.

Electronic media which contains DOS project information MUST be hand-carried at all times, both domestically and overseas. This equipment shall NOT be checked with luggage. It must remain in the carrier's possession at all times. Any loss or compromise of electronic media containing project inf01Tnation must be reported to RSO, COR or Post Sponsor and DS/IS/IND immediately.

Downloading SBU information onto thumb drives, jump drives or other portable storage devices onto which project information can be downloaded, is prohibited unless specifically authorized in writing by the RSO or COR. Authorized users must have a briefing and sign a briefing acknowledgement regarding their responsibility to safeguard such media.

Any loss or compromise of storage device containing project information must be reported to the RSO or COR and DS/IS/IND immediately.

All project related working papers/drawings shall be reviewed by RSO or COR to ensure that classified material has not been generated and is not hand-carried back to contractor facility.

8.10 Security Briefings

All U.S. citizens will be required to attend Contractor-provided initial, pre-deployment, and continuing security awareness briefings regarding policies and procedures for the protection of classified, SBU and unclassified information, and the contractual security requirements contained in this Attachment to the DD Form 254. Contractor shall maintain a copy of signed briefing acknowledgements for each employee performing on the contract.

Upon arrival at an overseas Post, all American personnel will be required to attend initial and subsequent periodic security briefings by the RSO, or designee. All personnel must attend a debriefing by the RSO, or designee. Additional debriefing may be requested by Diplomatic Security, either at post/site prior to departure and/or at the Contractor's location.

8.11 Standards of Conduct

Contractor personnel assigned to the contract shall observe appropriate standards of conduct and other appropriate departmental regulations, as well as any special standards of conduct promulgated by the local embassy/post to govern U S. Government personnel. Non-adherence to the provisions of the above may subject Contractor personnel to removal at the Contractor's expense.

8.12 Removal of individual Contractor employees for cause

A determination to remove a Contractor employee from Post, or from contract performance at a domestic facility, due to misconduct or unsuitability may involve, but is not limited to, the following types of misconduct or delinquency that may be documented by the Regional Security Officer or DS/IS/IND:

Notoriously disgraceful conduct, to include the frequenting of prostitutes, engaging in public or promiscuous sexual relations, spousal abuse, neglect or abuse of children, manufacturing or distributing pornography, entering into debts the employee could not pay, or making use of one's position or immunity to profit or to provide favor to another or to create the impression of gaining or giving an improper favor.

Failure to report notoriously disgraceful conduct and/or non-compliance of other employees (DOS, Contractor or foreign national) in accordance with existing Post and Department of State policies and regulations.

Neglect of duty, unsatisfactory performance, unreasonable delays or failure to carry out assigned tasks, conducting personal affairs during official time, refusing to render assistance/cooperate in upholding the integrity of the objectives of this contract.

Falsification or unlawful concealment, removal, mutilation or destruction of any document or record, or concealment of material facts by willful omissions from documents or records. Improper use of credentials, badges or official papers.

Disorderly conduct, use of abusive or offensive language, quarreling, intimidation by words or actions, or fighting.

Participation in disruptive activities that interfere with the normal efficient operations of the worksite.

Theft, vandalism, immoral conduct, or any other criminal action under U.S. or host country law.

Selling, consuming or being under the influence of drugs, or other illegal substances that produce similar effects.

Abuse of alcohol.

Any evidence that would indicate that the individual is guilty of security violations including black market dealings, currency manipulation, violations of the post contact policy regarding criteria country nationals, espionage or treason.

Noncompliance with post security and reporting policies.

8.13 Reporting Requirements

Suspicious Contact Reports (SCRs) Any contact with host or third country nationals that seems suspicious (such as undue curiosity as to the purpose of presence in country, requests for information regarding the project or project personnel), or attempts to establish suspicious recurring contact beyond routine professional or personal services, shall be reported immediately to the RSO.

Reporting of suspicious contacts requires filing a DS-1887 form, which can be obtained from the RSO. When completed, the form should be returned to the RSO for any necessary investigative action and for submission to

Diplomatic Security's Counterintelligence Division (DS/CI). Additionally, the company FSO shall submit a Suspicious Contact Report to the Defense Security Service Industrial Security Representative (in accordance with the NIPSOM) and DS/IS/IND.

8.13.1 Reporting of Suspicious Incidents

Reporting of suspicious incidents occurring at off-site locations or during travel to/from the project site

Avoid discussing project and post activities while not on the site, to include in hotel rooms, restaurants and all other public places. Report any suspicious or actual incidents, any contact with the local authorities, or undue attention or surveillance of project personnel or the project site.

8.13.2 Foreign Contact Reporting

All contractors at the project site must adhere to the foreign contact reporting requirements specific to each project site, as briefed by the RSO, which may include all unofficial contact with nationals from specific HUMINT threat countries, the reporting of close and continuing social contact with foreign nationals, co-habitation with foreign nationals, and nonproject related personal business and/or financial relationships with any foreign nationals. Reporting of foreign contacts requires filing a DS-1887 form, which can be obtained from the RSO. When completed, the form should be returned to the RSO for any necessary investigative action and for submission to Diplomatic Security's Counterintelligence Division (DS/CI). If investigative action results in information of which the contractor should be aware, the reporting contractor will be briefed by the RSO.

8.14 Packaging Requirements for Mail and Courier Shipment of Documents and Drawings

Unclassified and SBU packages sent via U .S. Mail, Registered or Certified Mail and shall be addressed as follows:

U.S. Department of State

Office of Acquisition Management

A/LM/AQWFDCD- SA-6A, Suite 400

Attn: {Insen name of Project Personnel or Contracting Officer}

P. O. Box 9115, Rosslyn Station

Arlington VA 22219

8.15 Separate packaging of electronic media and hardcopy material The Contractor and any associated subcontractors will package all paper documents and drawings separately from electronic media, regardless of its classification. Specifically, electronic media (such as CDs) will be transported in electronic media packages that contain no other hard copies of any kind, beyond that of transfer/receipt documentation.

Paper drawings and documents will be packaged separately.

8.16 Double-wrapping and addressing of packages

For all shipping methods, the prime contractor and any associated subcontractors will ensure that all project documentation, regardless of classification, is double-wrapped with both layers addressed properly and labeled with the sender's address. Document tracking receipts should be packaged inside the inner wrapping with the materials the receipt i 8 describes. No indication of the classification or sensitivity should appear on the outer wrapper.

Unclassified and SBU packages addressed to overseas facilities or sites may not have the words

"blueprints" or "drawings" displayed on the outer wrapper.

8.17 Packaging heavy materials in appropriate containers

In applying the above double-wrapping and addressing procedures, items sent via US mail or commercial carier weighing more than one (1) pound shall be double wrapped and then the package shall be enclosed within an appropriately sized double-walled box or, for rolled drawings, a manufactured mailing tube. Unclassified and SBU packages addressed to overseas facilities or sites may not have the words "blueprints" or "drawings" displayed on the outer wrapper.

All unsuccessful bidders and their prospective Subcontractors will be required to return (or certify destruction of) all classified and SBU documents to the COR within 30 days after the contract has been awarded, or as otherwise directed by the Government.

8.18 Project Communications

8.19 General

OBO has an accredited a web-based Extranet that enhances the security associated with the exchange of DOS design/construction data, and provides business applications that improve the communication between OBO and partner contracting activities. The service name is ProjNet (Project Extranet). This service is available to support the Project Communication needs of both the Contractor and the USG.

8.20 System Capabilities

ProjNet has been developed to support web-based USG-to-Business applications related to the DOS's facility engineering, design, and construction projects worldwide. In general, ProjNet supports four generic types of business processes: document collaboration, work product evaluation, contract monitoring, and information dissemination. The following applications are available to support the contract. While there are additional applications being developed, current and active applications are described below.

8.20-1 FILER

FILER is a collaborative application that allows authorized project participants to exchange documents among a specific work group. ProjNet will support document collaboration among project teams. In

FILER, drawings and related documents may be transmitted among business partners. FILER provides permission framework and access designations to files stored on the ProjNet server. As required, audit information may also be tracked. ProjNet's FILER meets the FPS-140 USG requirement to electronically encrypt SBU data. FILER is currently DOS's only approved method for transmitting

Sensitive But Unclassified (SBU) information across the Internet.

8.21 DrChecks

Contract deliverables (typically plans and specifications) will be reviewed for contract compliance utilizing a document review and checking tool called DrChecks. DrChecks assists the team (both contractor and USG) in collecting, organizing, and tracking issues to resolution. DrChecks is the tool that supports the Request for Information (RFD process.

8.22 Classification and Sensitivity of Data Processed

ProjNet will support Sensitive But Unclassified (SBU) data only. Classified and SBU/NOFORN (No Foreign

Dissemination) information is not allowed on ProjNet. It is the responsibility of all ProjNet users to understand the

Department of State's classification guidelines, and to limit the distribution of data on the ProjNet site to unclassified and SBU information only. All movement of unclassified and SBU electronic project files across the web will be limited to ProjNet in order to protect data from interception. The Department of State, Bureau of Diplomatic Security will have complete access to all ProjNet data and logs with the purpose of policing classification guidelines. The hosting website and equipment supporting ProjNet are USG owned; all data passing across the website shall be construed as the property of the USG, subject to enforcement of its classification guidelines.

The Department of State, Bureau of Diplomatic Security will have complete access to all ProjNet data and logs with the purpose of policing classification guidelines. The hosting website and equipment supporting ProjNet are USG owned, 1 9 and all data passing across the website shall be construed as the property of the USG, subject to enforcement of its classification guidelines.

8.23 Service Operation

ProjNet uses secure socket layer (SSI.) technology to transmit data between client and server. This technology is built into the site so it is accessible from any Intemet connection. Access to ProjNet begins with a request from the prime contractor to the OBO Project Executive. Each Prime Contractor's Facility Security Officer will be responsible for validating and approving his sub-contractors and vendors access requests before forwarding them to OBO. OBO's

Project Executive will be responsible for the review and approval of all requests, and certifying access as necessary to the Department's mission.

8.24 USG's Role

The USG will support the use of the SSL technology to all Contractors and their sub-contractors. The USG will assist users with login, program usage support, and management of server hardware and software. The USG will support the

Contractor's implementation of ProjNet by providing an online training course, available via the Foreign Service

Institute (FSI), at the Contractor's expense. Instructions for completing the training will be provided by the COR.

8.25 Accounts and Passwords

Once users have a connection to ProjNet, they identify themselves to the application using a unique password. OBO will be responsible for creating and setting up all user accounts. A unique password for each user is automatically generated for that user by the system. Using their unique password, user login to the appropriate ProjNet Application.

8.26 Contractor's Role

It will be the Contractor's responsibility to send the COR a complete list of all required users for the system from each company, including subcontractors required for the project. Requests for ProjNet access for any subcontracting firms or vendors owned by, or operated in, any country on the Prohibited Countries List, will not approved. The USG will provide the contractor with a registration form requiring the name, telephone number, email address, and verification of US Citizenship for each ProjNet user. For requests involving non-US Citizens, the contractor must also provide country of citizenship, passport number, passport issue place and date, passport expiration, bifih date and place, birth name and other names used, and name in the local language characters for each user. Requests for ProjNet access by citizens of any country on the Prohibited Countries List will not approved. It will be the responsibility of the Contractor's Facility Security Officer to monitor and ensure their personnel are following the Business Rules associated with ProjNet.

8.27 Design Professional and Contractor Hardware Requirements All Architectural/Engineering/Construction project team members are required to have broadband Internet service and a compatible web browser to gain access and use ProjNet. Browser compatibility can be tested and confirmed on the ProjNet website.

8.28 Business Rules

The Contractor is restricted from transporting unencrypted SBU data electronically across the Internet using email, FTP sites, or commercial web sites. OBO encourages contractors to handle all contract drawings and documents as if they are SBU, in order to minimize risk.

ProjNet supports up to Sensitive but Unclassified (SBU) data only. It is the responsibility of all ProjNet users to understand the Department of State's classification guidelines, and to limit the distribution of data on the ProjNet site to unclassified information. Classified or SBU/NOFORN information shall not be transmitted via the ProjNet site, or any other electronic transmission using the Internet. See E.8 for electronic transmission of classified using ProjNet-C.

Contractor personnel with access to ProjNet must be U S. citizens or may be non-US Citizens that have obtained approval to operate the system from the Department of State (DOS). The contractor cannot grant non-U.S. citizens access to ProjNet without prior DOS approval. Contractors wishing to nominate non-US citizens for access must also provide country of citizenship, passport number, passport issue place and date, passport expiration, birth date and place, birth name and other names used, and name in the local language characters, if applicable, for each user to the COR and DS for registration/approval.

Requests for ProjNet access by citizens of any country on the Prohibited Countries List will not approved. Government denial of non-U.S. Citizens or subcontractors for security reasons can be made without providing rationale for denial.

It shall be the responsibility of the Contractor's Facility Security Officer to register, maintain, and delete all user accounts to the system on a need to know basis.

It shall be the responsibility of the Contractor to ensure authorized training has been given to all personnel who wish to access ProjNet prior to assigning a password. All new ProjNet users, or those requiring remedial training, will be required to complete the Foreign Service Institute's (FSI) distance learning course PA526- ProjNetSM (Facilitating Design and Construction Communication Utilizing the ProjNet Extranet Technology) in advance of being issued a new user account. The cost per person is approximately $85.

Individual users in each office will be provided with a system-generated password that will enable access to that user only.

Users shall protect their passwords as SBU information, and refrain from sharing their access into the

ProjNet system.

ProjNet workstations should not be left unattended while an active ProjNet work session is ongoing.

Users should logout of ProjNet after each work session.

8.29 ProjNet Connectivity

ProjNet is utilized in a web-based environment and therefore subject to the inherent speed and connectivity problems of the Internet. The Contractor is responsible for its own connectivity to the

Internet. ProjNet response time is dependent on the Contractor's equipment, including processor speed, Internet access speed, current traffic on the Internet, bandwidth, and hardware latency. The Government will not be liable for any delays associated from the usage of ProjNet including, but not limited to: slow response time, down time periods, connectivity problems, or loss of information. The contractor should ensure that connectivity to the ProjNet system is accomplished through DSL, cable or other broad band connection. Under no circumstances shall ProjNet usage be grounds for a time extension or cost adjustment to the contract.